Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Automated penetration testing & attack surface management platform. Recon, scan, exploit, report — 600+ exploits, 90+ integrations, 10K+ detections.

Quickly discover exposed hosts on the internet using multiple search engines.

Attack Surface Analyzer can help you analyze your operating system's security configuration for changes during software installation.

AttackSurfaceMapper is a tool that aims to automate the reconnaissance process.

OWASP Web Recon & Directory Discovery Platform

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

the blazing-fast pentesting suite.

OSINT Template Engine

jshunter is a command-line tool designed for analyzing JavaScript files and extracting endpoints. This tool specializes in identifying sensitive data, such as API endpoints and potential security vulnerabilities, making it an essential resource for and bug bounty hunters and security researchers.

Curated list of open-source & paid Attack Surface Monitoring (ASM) tools.

Find cloud assets that no one wants exposed 🔎 ☁️

Scan 30+ AWS services. Find cost waste. Detect security gaps. Map your attack surface. One command.

WebStor efficiently enumerates all websites across your organization’s networks and those in your DNS records - including cloud-hosted servers via zone transfer data - stores their responses, and lets you query for known web technologies, including those with zero-day vulnerabilities.

☁️ Curated Cloud OSINT resources — dorks, tools, and techniques for AWS, Azure, GCP, Oracle Cloud, and other major providers reconnaissance

API discovery tool that maps attack surfaces from captured traffic and generates specs for REST, GraphQL, SOAP, and WebSocket APIs

Discover the attack surface and prioritize risks with our continuous Attack Surface Management (ASM) platform - Sn1per Professional #pentest #redteam #bugbounty

Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 60+ other AI services in seconds

Find and govern AI attack surfaces in application code at PR time. Free, OSS, runs offline.

OWASP Amass Docker Compose for setting up a full instance of the infrastructure