$ ls ~/tools
Tools
Sorted in the order an attacker uses them: first public data, then mapping, then testing. The last group is for you - fixing it at the source.
⚠ Recon your own assets, or targets you have written permission to test. Passive OSINT reads public data, but using it to target someone else's systems can still be illegal or against their terms. Examples on this site use example.com placeholders.
## osint / recon
Public data only. This is what an attacker learns before sending a single packet to you.
crt.name
Every TLS certificate ever issued for your domain - and the subdomains in them.
osint / reconpassiveWayback Machine (CDX API)
Every URL of your site the Internet Archive has seen - including the ones you forgot.
osint / reconpassiveShodan
A search engine for internet-connected devices. Your servers are probably already in it.
osint / reconpassivetheHarvester
Emails, subdomains, IPs and URLs for a domain, from dozens of public sources.
osint / reconpassivesubfinder
Fast passive subdomain discovery from many public sources.
osint / reconpassiveOWASP Amass
In-depth attack surface mapping and asset discovery.
osint / reconpassiveRecon-ng
A modular web reconnaissance framework, with a console like Metasploit.
osint / reconpassiveMaltego
Visual link analysis: domains, people, emails and infrastructure on one graph.
## map the surface
Light, active checks: which hosts are alive, which ports are open, what they say about themselves.
httpx
Which of your subdomains are alive, and what is running on them?
authorized targets onlymap the surfaceNmap
Which ports and services does your server expose, and which versions?
authorized targets onlymap the surfaceRustScan
Scans all 65,535 ports in seconds, then hands open ones to Nmap.
authorized targets only## test it
Actively looking for vulnerabilities. Your own apps or written permission only.
## fix at source
Run on your own code, configs and images - before anything reaches the internet.
Gitleaks
Find secrets in your git history before someone else does.
fix at sourceTruffleHog
Find secrets and check whether they still work.
fix at sourceBearer
Static analysis that follows sensitive data through your code.
fix at sourceTrivy
Vulnerabilities and misconfigurations in images, dependencies and IaC.
fix at sourceCheckov
Finds misconfigurations in Terraform, Kubernetes, Dockerfiles and CI configs.
fix at sourceKICS
Infrastructure-as-code scanner with thousands of queries.
Many of these are picked from awesome-security (MIT, © sbilly) - checked for active maintenance in November 2026. Each tool page says where it came from. See credits.