Open-source alternatives to Massdns

MassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy input-output support.

Subfinder is a security reconnaissance framework designed for subdomain enumeration and attack surface management. It functions as a discovery engine that identifies and maps internet-exposed infrastructure, cloud-hosted assets, and network ranges to maintain a comprehensive inventory of an organization's digital footprint. The project distinguishes itself through a modular, template-driven scanning engine that executes security checks against discovered assets. It leverages cloud-native asset discovery to query provider APIs and infrastructure metadata, while supporting distributed agent orc

Moved to https://codeberg.org/DNS-OARC/dnsperf

SSH server auditing (banner, key exchange, encryption, mac, compression, compatibility, security, etc)

Small, fast tool for performing reverse DNS lookups en masse.

This tool generates a combination of domain names from the provided input. Combinations are created based on wordlist. Custom words are extracted per execution. Refer to Techniques section to learn more.

Amass is a network attack surface mapper and reconnaissance framework designed to discover and map the external, internet-facing infrastructure of a target organization. It functions as an open source intelligence tool that identifies public network boundaries and locates hidden or forgotten subdomains to define an organization's total reachable footprint. The project utilizes passive-source data aggregation from external APIs and public databases alongside active DNS brute-forcing and recursive subdomain expansion. It employs a graph-based asset mapping system to visualize the relationships

dnsx is a fast and multi-purpose DNS toolkit allow to run multiple DNS queries of your choice with a list of user-supplied resolvers.

Masscan is a command-line network scanner designed for large-scale discovery and infrastructure reconnaissance. It identifies open ports across specific network segments or the entire internet by probing vast address ranges with high efficiency. The tool functions as an asynchronous packet engine, bypassing standard operating system kernel networking stacks to transmit raw packets directly from application memory. The project distinguishes itself through a specialized architecture that manages millions of concurrent connections by separating packet transmission and reception into independent

ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries.

namebench

sslscan tests SSL/TLS enabled services to discover supported cipher suites

dnstwist is a Python-based tool designed to detect domain name variants and typo-squatting attempts. It generates a comprehensive list of potential domain permutations—such as misspellings, homoglyphs, and character substitutions—that could be used for phishing, brand impersonation, or other malicious activities. The project serves as a security research utility for identifying lookalike domains that might be registered by adversaries to exploit user confusion or trust. The tool systematically probes each generated domain variant to determine its registration status, DNS resolution, and other

Stenographer is a packet capture solution which aims to quickly spool all packets to disk, then provide simple, fast access to subsets of those packets. Discussion/announcements at stenographer@googlegroups.com

Knock is an attack surface management tool and DNS reconnaissance framework used for discovering and mapping an organization's external infrastructure. It functions as a subdomain enumeration tool and HTTP security scanner to identify reachable hosts and organizational assets. The project distinguishes itself by using a passive-active hybrid enumeration strategy, combining external API lookups with active wordlist brute-force attacks and DNS zone transfers. It includes a multi-stage validation pipeline that detects DNS wildcard records and verifies host connectivity to filter out false positi

SSLyze is an SSL/TLS security scanner and network encryption analyzer designed to identify vulnerabilities and misconfigurations in encryption settings. It functions as both a standalone tool for analyzing server certificates and cipher suites and a programmable Python security library for embedding automated scanning logic into larger applications. The tool distinguishes itself by supporting encryption analysis for both HTTP and non-HTTP network services, including mail, directory, and database protocols. It includes a security compliance validator that compares server configurations against

ethr is a command line network diagnostic tool and performance analyzer designed to measure throughput, latency, and packet loss across TCP, UDP, and ICMP protocols. It functions as a multi-threaded network throughput tester and a diagnostic utility for analyzing connection health between client and server endpoints. The project differentiates itself through specialized diagnostics such as TCP retransmission monitoring and bidirectional path analysis to identify asymmetric performance differences. It provides the ability to evaluate the overhead of encrypted HTTPS connections and enforce spec

Hyperfine is a command-line benchmarking tool used to measure the execution time of shell commands through multiple runs and statistical analysis. It functions as a comparative benchmarking utility and a shell performance analyzer, allowing for the evaluation of multiple commands against a reference baseline to determine relative speed. The tool distinguishes itself by isolating actual command performance through shell overhead correction and the ability to bypass the shell entirely using system calls. It supports parameterized execution, enabling benchmarks to run across a range of varying i

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

Patator is a multi-purpose brute force tool and modular security framework used for testing credentials, discovering network services, and fuzzing network protocols through automated payload delivery. It functions as a credential exhaustion framework and a network protocol fuzzer. The project provides specific utilities for recovering passwords from encrypted ZIP archives, enumerating DNS zones via forward and reverse queries, and identifying valid usernames and passwords across common network protocols. Its broader capabilities include web endpoint fuzzing, network service probing, and user

ShuiZe_0x727 is an open-source intelligence gathering framework and attack surface management tool. It functions as an asset discovery engine and cyber intelligence aggregator designed to identify internet-facing assets, map network infrastructure, and visualize total network exposure. The project integrates vulnerability scanning and sensitive data leak detection to identify security weaknesses and unauthorized access points. It employs a combination of network space API queries, certificate log analysis, and public repository scanning to extract leaked credentials, API keys, and internal ad

Mosint is an email OSINT framework and intelligence tool designed to gather data and identify digital footprints associated with email addresses. It functions as a suite of automated utilities for email validation, breach scanning, and social account discovery. The tool maps digital identities by linking email addresses to social media profiles and identifying related identities to expand the scope of investigations. It includes a breach scanner that checks email addresses against known database leaks and password dumps to detect compromised accounts. The framework also covers network intell

K8tools is a multi-stage attack framework that combines memory-only payload execution, credential testing, port forwarding, privilege escalation, and physical USB-based keystroke injection for comprehensive system compromise. At its core, the Ladon PowerShell module loads a multi-function scanner directly into memory, enabling command execution without writing files to disk, while supporting memory-only payload delivery that downloads and runs obfuscated shellcode or PowerShell commands to evade antivirus detection. The framework distinguishes itself through its breadth of integrated capabili

Generates Conventional Commit messages with AI. Supports OpenAI, Ollama, and Gemini.

OpenHands is an autonomous AI software engineer and coding assistant designed to execute software engineering tasks by interacting directly with codebases and development environments. It functions as a platform for running AI agents that can write code and manage files to automate complex development workflows. The system distinguishes itself through a container-based execution environment that isolates agent actions within a sandboxed Linux environment. It employs an autonomous agent loop of observation, planning, and action, supported by a standardized communication protocol that allows it