Attack surface mapping and asset discovery
OWASP project for in-depth attack surface mapping: discovers domains, subdomains, IP ranges and related assets using DNS and many public data sources.
Amass combines DNS enumeration, scraping of public sources, certificate transparency logs and APIs of many data providers to discover the external assets of an organisation. Results are stored in an asset database that tracks relationships and changes between runs.
It is an OWASP flagship project used in authorised reconnaissance, bug bounty programmes and attack surface management.
Apache-2.0 · Apache License 2.0 · Open source
GitHub does not detect the licence; the LICENSE file states Apache 2.0.
Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: NOASSERTION.
No published advisory found for OWASP Amass in GitHub repository advisories. That does not mean the tool has no vulnerabilities.
Sources: GitHub repository advisories · checked 2026-10-20.
OSINT automation for footprinting
OSINT automation tool with a web UI and more than 200 modules that gather data on IPs, domains, emails, names and more from public sources.
Gather emails, names and subdomains from public sources
Python OSINT tool that collects emails, names, subdomains, IPs and URLs about a domain from search engines and public data sources.
Fast passive subdomain enumeration
ProjectDiscovery's subdomain discovery tool that queries passive online sources, built for speed and easy chaining with other tools.
Asynchronous TCP port scanner for large ranges
Internet-scale port scanner that sends SYN packets asynchronously with its own TCP/IP stack, designed to scan very large address ranges quickly.
Fast web fuzzer for content and parameter discovery
Fast web fuzzer written in Go, used to discover hidden files, directories, virtual hosts and parameters by replacing a FUZZ keyword with wordlist entries.
