Best Recon & Footprinting Tools (12)

OWASP project for in-depth attack surface mapping and subdomain enumeration.

Extracts metadata from public documents to reveal users and software.

Searching public code often reveals leaked keys, emails and infrastructure.

Scans repositories for hardcoded secrets.

Google Hacking Database of search operators that surface exposed data.

Finds and downloads public documents from a domain for metadata analysis.

Fast crawler that extracts URLs, emails and files from a site.

Modular recon framework with a Metasploit-style console; good for repeatable, scripted investigations.

Automated OSINT scanner with 200+ modules for footprinting domains, IPs and names. The open-source version runs locally.

Fast passive subdomain discovery tool that pulls from dozens of public sources.

Classic command-line tool for gathering emails, subdomains and hosts from public sources during early recon.

Finds leaked secrets and credentials in git repos and other sources.

Get the daily intel picture. The Early Bird™ Intelligence Brief lands in your inbox every morning. Subscribe →