Infrastructure & Network Reconnaissance
Tools that scan and map internet-facing infrastructure: hosts, open ports, exposed devices and the technology a website runs, plus IP reputation and IP data lookups, website crawling, and email and name harvesting for a domain.
BuiltWith
Technology profiler that reports the frameworks, analytics, hosting and other services a website is built with.
Censys
Search engine for internet-facing hosts, certs, and services.
Criminal IP
Search engine and threat-intelligence platform for internet-exposed assets, IP reputation and domain scans.
FOFA
Cyberspace search engine that indexes internet-exposed hosts, services and web fingerprints for querying.
GreyNoise
Labels internet background scan and attack traffic to separate noise from real threats.
IPinfo
IP address data service returning geolocation, ASN, company and privacy-detection details for any IP.
Masscan
Internet-scale TCP port scanner able to sweep huge address ranges very fast.
Netlas
Internet-wide scanning and attack-surface search platform.
Nmap
Free network scanner for host discovery, port scanning and service/OS detection.
OSINT.SH
All-in-one web toolkit: DNS history, reverse IP, WHOIS.
Photon
Fast crawler that extracts URLs, emails, files and other data points from a website.
PublicWWW
Search engine that finds websites by matching source-code snippets, IDs or scripts.
Shodan
Search engine for internet-connected devices, servers, and IoT.
SpiderFoot
Automates threat-intel and reconnaissance gathering.
Wappalyzer
Identifies the technology stack (CMS, frameworks, analytics) a website runs.
ZoomEye
Cyberspace search engine mapping internet-exposed devices, services and components.
theHarvester
Collects emails, subdomains, and names from public sources.