Open source

subfinder queries passive sources: certificate transparency, passive DNS, search engines and the APIs you hold keys for. API keys go in provider-config.yaml. -all queries every source, not only the fast ones; -recursive keeps only the sources that can enumerate under a subdomain.

chaos-client returns subdomains from our DNS dataset of public bug bounty programs. uncover runs one query across Shodan, Censys, FOFA and a dozen other engines and returns host:port.

alterx guesses subdomains no source lists. It reads the subdomains found so far and writes permutations of them, dev-api and api-staging from api; -enrich adds the words it sees in the input to its pattern list. shuffledns guesses from a wordlist instead: -mode bruteforce resolves every word under a domain over massdns and discards the wildcard answers.

asnmap turns an organisation name, ASN, IP or domain into its announced ranges and mapcidr expands them to addresses; -shuffle-ip randomises the order so a scan does not walk a range sequentially. cdncheck marks the addresses that belong to a CDN, WAF or cloud provider rather than an origin; -resp prints the provider beside each and -exclude drops them so a scan reaches only origins.

Pipe the union into dnsx to resolve it. -a asks for A records and -cname or -mx for another type, -r takes your own resolvers, -resp prints the answer beside the subdomain, and -silent keeps stdout to results only.

naabu scans with CONNECT by default; -s s switches to SYN, which needs root. -top-ports 100 scans the hundred most common ports, -top-ports 1000 the thousand, and -p - all of them. -rate caps packets per second.

httpx probes each host over HTTPS and HTTP. -sc, -title, -cl and -location add the status code, title, content length and redirect target; -tech-detect adds the technologies it recognises, -screenshot saves a headless capture, and -json emits every field per host.

tlsx reads the certificate on each host. -san and -cn print the names in it, including hosts the DNS sources missed. -ex, -ss and -mm flag expired, self-signed and mismatched certificates. -ce lists the ciphers the server accepts.

katana crawls with a plain HTTP client by default and with a headless browser when you pass -headless, which runs the JavaScript and sees the routes it creates. -js-crawl parses every script it downloads for paths and API endpoints, and -known-files all pulls robots.txt and sitemap.xml.

-depth sets how many links deep it follows. -field-scope rdn, the default, keeps the crawl inside the root domain; fqdn restricts it to the exact host, and -crawl-scope takes a regex. -H passes a cookie or Authorization header so it crawls as a logged-in user, and -aff fills and submits the forms it finds.

-jsonl writes one line per endpoint with the method, the URL and the response status. -output-template prints one field per line instead, such as {{url}} or {{path}}, for feeding the next tool.

nuclei reads targets from -l or stdin and runs the templates you select. -t takes a file or directory, -tags and -severity filter the public set, and -id runs one template by name. -rate-limit caps requests per second and -c sets how many templates run in parallel. -jsonl writes one line per match with the full request and response.

The public templates install on first run and update on each run unless you pass -duc. The set is written by the community, reviewed and signed by our template team; see Community. A template you write for your own target uses the same syntax; -t points nuclei at it and -validate checks it before a run.

Some bugs never show in the response, such as blind SSRF or out-of-band XXE. interactsh hands out unique hostnames for templates to use and reports the DNS, HTTP and SMTP interactions they receive. nuclei uses the public servers by default; -iserver and -itoken point it at an interactsh-server you run yourself.

vulnx looks up a CVE in our vulnerability index: the affected products, EPSS score, KEV status, and whether a public exploit or a template exists. It takes an id or a free-text query, reads ids on stdin, and --json prints the record.