Projects sharing features with Passivedns

ZMap is a fast single packet network scanner designed for Internet-wide network surveys.

Fast Incident Response

passivedns-client provides a library and a query tool for querying several passive DNS providers

A Linux alternative to enum.exe for enumerating data from Windows and Samba hosts.

A Python application to filter and transfer Zeek logs to Elastic/OpenSearch+Humio. This app can also output pure JSON logs to stdout for further processing!

A script for advanced discovery of Privileged Accounts - includes Shadow Admins

DNS Enumeration Script

Open Source SIEM (Security Information and Event Management system).

Opensnitch is a host-based application firewall for Linux that monitors and intercepts outbound network connections in real time. By hooking into kernel-level interfaces, it tracks system-wide network activity and maps connection attempts to specific local processes, allowing users to explicitly permit or deny traffic on a per-application basis. The project distinguishes itself through its ability to manage security policies across multiple distributed nodes from a single, unified dashboard. This centralized management is secured via encrypted socket communication, enabling consistent rule en

XRay is a tool for recon, mapping and OSINT gathering from public networks.

dnsenum is a perl script that enumerates DNS information

A script for credentials-based attack surface enumeration and general reconnaissance of massive networks

Sigma Queries turned into KQL for Defender using pysigma - Automated

Sigma Queries turned into SPL for Splunk Enterprise and Enterprise Security using pysigma - Automated

TerraSigma - Modern Detection Engineering for the Cloud-Native SIEM Microsoft Sentinel

recon-ng is an open source intelligence reconnaissance framework designed to automate the collection and aggregation of public information. It is a modular intelligence tool that utilizes a system of pluggable modules to harvest target data, resolve DNS queries, and parse web content. The framework is built as an API-driven tool with a programmatic interface to integrate with other security workflows. It is provided as a containerized application, using Docker to ensure a consistent environment for running reconnaissance tasks and managing a persistent data store. Its capabilities cover exte

theHarvester is a command-line utility designed for gathering open-source intelligence and mapping an organization's external attack surface. It functions as a security information gathering framework that automates the collection of publicly available data to assist in reconnaissance and threat analysis. The tool utilizes a plugin-based architecture to execute isolated queries against various search engines and public databases. It employs asynchronous task execution to run multiple discovery operations in parallel, while a centralized pipeline aggregates and deduplicates findings from these

Utilize misconfigured DNS and old database records to find hidden IP's behind the CloudFlare network

fork of http://code.google.com/p/dnsmap/source/checkout

Open source security data lake for threat hunting, detection & response, and cybersecurity analytics at petabyte scale on AWS

Aquatone is a web screenshot reconnaissance tool that captures full-page screenshots of web services discovered during network reconnaissance and groups them by visual similarity. It scans a list of hosts or domains for HTTP and HTTPS services on common and custom ports to find responsive web endpoints, then takes full-page screenshots of those pages for quick review. The tool accepts piped input from other tools and extracts URLs, domains, and IP addresses using regex pattern matching, making it pipeline-friendly for integration into existing workflows. It can also read XML output from Nmap

A DNS reconnaissance tool for locating non-contiguous IP space.

Netdiscover, ARP Scanner (official repository)

Ncrack network authentication tool

Sublist3r is a subdomain enumeration tool and passive reconnaissance framework designed to discover subdomains by querying search engines and public intelligence sources. It functions as a security tool for identifying the digital footprint of a target domain. The project provides both passive enumeration through multi-source API aggregation and active discovery via a DNS brute force tool. It includes a TCP port scanner to identify active services and open ports on discovered subdomains, facilitating attack surface mapping. The tool can be used as a standalone utility or as a Python security