domain-enumeration

SubEvil is an advanced open source intelligence framework (OSINT) for grouping subdomains.

Python3 implementation of ADRecon with support for NTLM and Kerberos authentication querying LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD domain.

Streamline Domain Enumeration with this Efficient Toolset

An implementation of PyADRecon using ADWS instead of LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD domain. Evades EDR detections through ADWS.

OSINT tool abusing SecurityTrails domain suggestion API to find potentially related domains by keyword and brute force.

Automated script to run all modules for a specified list of domains, netblocks or company name

Yet another OSINT automator.

Obtain domains from certificate transparency logs

🥷 Subduer is a subdomain passive reconnaissance tool utilising Playwright and several online providers that gathers subdomains and generates wordlists and reports in multiple formats.

Fast DNS recon in Go

This tool is used to perform reverse IP lookups— searching for all domains hosted on one IP address.

Domain enumeration is the URL extraction and scanning tool for Linux OS. It is a combination of multiple tools which provide information about the URL by scanning them with multiple enumeration tools and provide information as much as possible about the sub-domain, login pages, any vulnerable pages on the webiste etc.

DNS recon CLI (A/NS/MX, AXFR, brute force, whois, reverse PTR)

Gather information from Active Directory via ADWS and generate detailed security reports to assist pentesters and security teams.

This repository contains Python tools for domain enumeration.

Domain Grabber — A Python CLI tool to fetch unique root domains from Archive.org CDX API based on given domain extensions (e.g., .id, .co.id, .ac.id). Supports multiple extensions, progress tracking, retry with User-Agent rotation, and automatic result saving. Ideal for OSINT, domain research, and penetration testing reconnaissance.

This Open Source Intelligence (OSINT) repository! This project serves as a learning resource and a practical log of subdomain enumeration techniques. It documents the tools, commands, and methodologies used to discover subdomains for a given target.

Advanced OSINT & Multi-Engine Intelligence Dashboard

PowerShell scripts for low-privileged users to audit Active Directory security risks and generate reports

ArgusScope is a modular CLI tool for domain and subdomain enumeration, leveraging Python and MongoDB. Inspired by the all-seeing Argus, it offers pre-auth detection, passive and active discovery, and structured data storage. Ideal for penetration testers and red teamers in lab environments.