Toolkit

Toolkit index

• subfinder - Fast passive subdomain enumeration that aggregates 30+ public sources. The default first step of almost every recon workflow.
• amass - In-depth attack-surface mapping and asset discovery. Slower and heavier than subfinder but finds more via active enumeration and its graph DB.
• assetfinder - Tiny, fast passive subdomain finder. Great as an extra source to pipe into anew alongside subfinder.
• dnsx - Fast, multi-purpose DNS toolkit: resolve, probe records, and filter live hosts from a subdomain list.
• puredns - Fast DNS resolver and subdomain bruteforcer built on massdns, with wildcard filtering that keeps results clean.
• shuffledns - massdns wrapper for active bruteforce and resolution with wildcard handling. Alternative to puredns.
• httpx - Fast, multi-purpose HTTP toolkit. Probes for live hosts and pulls status, title, tech, CDN, and more. The bridge between recon and scanning.
• naabu - Fast SYN/CONNECT port scanner focused on reliability. Feeds open ports into httpx/nuclei.
• nmap - The classic network scanner. Service/version detection, NSE scripts, and OS fingerprinting. Slow but authoritative.
• rustscan - Ultra-fast port scanner that pipes open ports straight into nmap for follow-up enumeration.
• ffuf - Fast web fuzzer for directories, files, vhosts, and parameters. The de-facto content discovery tool.
• feroxbuster - Recursive content discovery in Rust. Auto-recurses into found directories and is fast out of the box.
• gobuster - Directory/file, DNS, and vhost bruteforcer. Simple and reliable.
• katana - Next-gen crawler with headless mode and JS parsing. Extracts URLs and endpoints for further testing.
• gau - getallurls - pulls known URLs from the Wayback Machine, Common Crawl, OTX, and URLScan. Instant historical URL corpus.
• waybackurls - Fetches URLs a domain has served, from the Wayback Machine. Classic passive URL source.
• hakrawler - Fast, simple web crawler for gathering URLs and JS endpoints. Pipe-friendly.
• nuclei - Template-based vulnerability scanner with thousands of community templates for CVEs, misconfigs, exposures, and takeovers. The workhorse of modern bug bounty.
• jaeles - Signature-based web application scanner. Powerful custom signature format for targeted checks.
• arjun - HTTP parameter discovery suite. Finds hidden query/body parameters by inference - great before hunting injection.
• paramspider - Mines parameters from the Wayback Machine to build a list of testable URLs with query strings.
• dalfox - Fast, powerful XSS scanner and parameter analyzer. Verifies reflections and builds working payloads.
• sqlmap - The definitive automatic SQL injection and database takeover tool. Deep detection and exploitation across many DBMSes.
• gf - A wrapper around grep with reusable pattern packs (xss, sqli, ssrf, lfi, redirect). Instantly slices URL lists into likely-vulnerable candidates.
• qsreplace - Replaces query-string values in a list of URLs with a supplied value. Essential glue for building fuzz targets.
• anew - Appends only new, unique lines to a file (and prints them). The one-line dedup that makes pipelines idempotent.
• unfurl - Pulls out and formats parts of URLs (domains, paths, params, keys). Handy for building custom wordlists from URL corpora.
• gowitness - Screenshots web pages using headless Chrome and stores results in a searchable report. Fast way to triage large host lists.
• getJS - Extracts JavaScript file URLs from a set of pages - the first step of JS recon for secrets and hidden endpoints.
• LinkFinder - Parses JavaScript files with regex to discover endpoints and paths. Reveals API routes hidden in bundles.
• wpscan - WordPress security scanner - enumerates plugins, themes, users, and known vulnerabilities. Needs an API token for vuln data.
• s3scanner - Scans for open S3 buckets (and other cloud storage) and dumps their permissions. Fast cloud misconfig discovery.
• interactsh - Out-of-band interaction gathering (OOB/OAST). Catches blind SSRF, RCE, and XXE via DNS/HTTP callbacks. Self-hostable.
• notify - Streams tool output to Slack/Discord/Telegram. Wire it into pipelines to get pinged on new findings.
• Burp Suite - The industry-standard intercepting proxy for manual web testing. Community edition is free; Pro adds the active scanner and automation.
• Caido - A modern, lightweight web proxy and pentest toolkit - a fast alternative to Burp with a clean workflow and scriptable automation.
• trufflehog - Scans git history, filesystems, and URLs for leaked credentials - and actually verifies them live against 800+ APIs, so you get confirmed secrets, not regex noise.
• gitleaks - Fast secret detection across git history and files with a strong default ruleset. Ideal for scanning cloned target repos and exposed .git folders.
• jsluice - Extracts URLs, paths, and secrets from JavaScript by parsing the AST (not regex) - far more accurate than LinkFinder for modern bundles.
• kiterunner - Context-aware content discovery built for APIs. Uses real request templates (from 67k+ Swagger specs) instead of dumb path lists, catching routes that need specific methods/headers.
• x8 - High-signal hidden parameter discovery in Rust. Detects reflected, stored, and behavior-changing params with fewer false positives than brute forcers.
• smuggler - Detects HTTP request smuggling (CL.TE / TE.CL desync) against a target with minimal, safe probes. First stop before manual desync exploitation.
• h2csmuggler - Tests for HTTP/2 cleartext (h2c) smuggling to bypass reverse-proxy access controls and reach restricted internal endpoints.
• graphql-cop - Fast security auditor for GraphQL: checks introspection, batching, field suggestions, CSRF, and DoS-prone features in one pass.
• clairvoyance - Recovers a GraphQL schema even when introspection is disabled, by abusing field-suggestion error messages. Rebuilds the attack surface others can't see.
• jwt_tool - Swiss-army knife for JWTs: decode, tamper claims, and test the classic attacks - alg:none, key confusion (RS→HS), weak-secret cracking, and kid injection.
• ysoserial - Generates Java deserialization payloads from known gadget chains (CommonsCollections, etc.). The reference tool once you spot a Java object sink.
• uncover - Queries Shodan, Censys, FOFA, Quake, and more from one CLI to surface a target's internet-exposed hosts without scanning them yourself.
• asnmap - Maps an organization (or ASN/IP) to its owned CIDR ranges - the fastest way to expand scope from a company name to owned IP space.
• mapcidr - Expands, aggregates, and slices CIDR ranges into IP lists for scanning. Pairs with asnmap to turn owned ranges into scannable hosts.
• tlsx - Fast TLS grabber that pulls SANs, issuers, and cert metadata - a rich, often-overlooked source of new subdomains and internal hostnames.
• cero - Scrapes domain names straight out of TLS certificates across IP ranges/ports - great for finding hosts that never appear in passive sources.
• alterx - Generates smart subdomain permutations from patterns, so a resolver can find dev1/staging-api/etc. that pure bruteforce misses.
• subzy - Purpose-built subdomain takeover checker with an up-to-date fingerprint set and low false positives. Complements nuclei's takeover templates.
• wafw00f - Fingerprints which WAF/CDN sits in front of a target so you know what filtering you're up against before you start fuzzing.
• chisel - Fast TCP/UDP tunnel over HTTP, secured by SSH. The standard way to pivot through a foothold and reach internal services during authorized testing.
• ligolo-ng - Modern pivoting via a userland TUN interface - no SOCKS proxychains gymnastics. Cleaner and faster than legacy tunneling for reaching internal subnets.
• linPEAS - Exhaustive Linux privilege-escalation enumeration - surfaces misconfigs, creds, SUID, and kernel exploits, color-coded by likelihood. The go-to after a foothold.
• pspy - Watches processes, cron jobs, and file events in real time without root - perfect for catching privileged scripts and cron-triggered commands to hijack.
• waymore - Best-in-class historical URL collector. Pulls from Wayback, Common Crawl, AlienVault OTX, URLScan and VirusTotal, with response-body download if you want JS from the past.
• urlfinder - ProjectDiscovery's passive URL finder. Fast complement to gau/waymore when you already live in the PD suite.
• gospider - Fast Go crawler that also extracts JS, forms, robots, sitemaps and subdomains. Good when katana is too quiet or you want form fields.
• chaos - Client for ProjectDiscovery Chaos datasets. Instant subdomain lists for public programs already in the dataset; still verify they are in your scope.
• pdtm - ProjectDiscovery tool manager. Installs and updates the whole PD suite with one binary. Start here on a new box.
• masscan - Internet-scale port scanner. Use on your own ranges or in-scope clouds with a sane rate. Follow with nmap -sV on the hits.
• dirsearch - Mature content-discovery scanner with recursion, extensions, and built-in wordlists. Still a solid fallback next to ffuf.
• kxss - Finds query parameters that reflect in the response. Pipe gau/waymore into it, then hand the hits to dalfox or a manual DOM check.
• uro - URL deduplicator that collapses the same endpoint with different values. Shrinks gau/waymore output before gf/ffuf so you do not scan the same path 8k times.
• hakrevdns - Bulk reverse DNS. Feed it IP ranges from asnmap/mapcidr and catch hostnames that subdomain enum missed.
• git-dumper - Dumps an exposed .git directory from a web root and reconstructs the repo. Pair with trufflehog on the result.
• noseyparker - High-signal secret scanner with a datastore. Excellent on dumped .git, org mirrors, and huge JS folders where trufflehog is noisy.
• cloud_enum - Multi-cloud OSINT: public buckets, blobs, and apps named after the target. Confirm ownership before you report.
• testssl.sh - Plain-shell TLS tester: protocols, ciphers, Heartbleed-class checks, cert chain. Use when you need a readable TLS report, not a port scan.
• jq - JSON processor. Every API hunt ends in jq. Filter httpx/nuclei JSONL, reshape GraphQL, extract token fields.
• HTTPie - Human HTTP client. Faster than curl for JSON APIs you are iterating on by hand. Not a fuzzer.
• mitmproxy - Interactive intercepting proxy with a Python addon API. Use when you want scripted mutation that Burp's UI is slow at, or HTTP/2 debugging.
• hashcat - GPU hash cracker. JWT HS256, NTLM, phpass, and the rest. Identify the mode first (the hash-id util on this site helps), then crack offline hashes you are authorized to recover.
• commix - Automated command-injection tester. Use after you have a reflected parameter that smells like a shell concat, not as a first spray.
• tplmap - Server-side template injection scanner and exploiter. Confirms the engine (Jinja, Twig, Freemarker, ...) then tries a sandbox escape. Manual confirmation still required.
• SecretFinder - Greps JS for API keys and endpoints. Noisy, but a fine first pass before jsluice on a big corpus.
• subjs - Fetches JavaScript file URLs from a list of hosts (HTML script tags). Pipe httpx live hosts into it, then jsluice.
• sourcemapper - Downloads and reconstructs original source from a .js.map. Turns a minified bundle into a readable tree for sink hunting.
• semgrep - Local SAST. Point it at reconstructed source maps or a dumped .git and hunt sinks (innerHTML, exec, pickle, yaml.load) with public rulesets.
• trivy - Scanner for container images, filesystems, IaC and secrets. Useful when the program includes Docker Hub images, GitHub repos, or Terraform.
• kube-hunter - Active Kubernetes attacker-view scanner. Only against clusters in scope. Looks for open APIs, kubelets, and dashboards.
• cloudflared - Cloudflare tunnel client. Handy as a stable ingress for OAST callbacks, local listeners, and sharing a Burp collaborator alternative you control.
• socat - Swiss-army TCP/UNIX relay. Port forwards, TLS wrappers, and 'I need this socket over there' jobs that ncat is awkward at.
• shodan - Official Shodan CLI. Search banners, SSL SANs, and org-owned IPs. Requires an API key. Stay inside program scope.
• github-subdomains - Enumerates subdomains mentioned in GitHub code search. Needs a GitHub token. Catches hostnames that never hit Certificate Transparency.
• dnsgen - Generates subdomain permutations from an existing list (dev, staging, -backup, region codes). Pipe into puredns, do not resolve blindly.
• whatweb - Web tech fingerprinting. Complements httpx -tech-detect when you want plugin-level CMS/platform IDs.
• interactsh-client - CLI client for interactsh. Generates unique callbacks and tails hits. Use instead of embedding a single collaborator host in every payload.