List of excellent OSINT tools useful for Penetration tests, Vulnerability assessments, Red/Blue Team operations, Bug Bounty
Servers
- Shodan - Search Engine for the Internet of Everything
- Censys Search - Search Engine for every server on the Internet to reduce exposure and improve security
- Onyphe.io - Cyber Defense Search Engine for open-source and cyber threat intelligence data
- ZoomEye - Global cyberspace mapping
- GreyNoise - The source for understanding internet noise
- BinaryEdge - Scans large number of internet exposed assets
- Netlas - Discover, Research and Monitor any Assets Available Online
- FOFA - Cyberspace mapping
- Quake - Cyberspace surveying and mapping system
- Hunter - Internet Search Engines For Security Researchers
- ODIN - One of the most powerful search engines for Scanned Internet Assets
- Criminal - Search for info on everything that connected to the public Internet
- ThreatMiner - Threat Intel, shows ip that shodan didn't gave
- ibm - IBM X-FORCE
- IVRE - Network Recon
- alienvault - open threat intel
- leakix - find open ports, servers, and more
Attack Surface
- FullHunt - Attack surface database of the entire Internet
- Talos Intel - The Talos Intelligence Center is the world’s most comprehensive real-time threat detection network
- RedHuntLabs - Discover your Attack Surface, Continuously
- SecurityTrails - The Total Internet Inventory
- IPInfo - The trusted source for IP address data
- IPData - IP Geolocation and Threat Intelligence API
- NetworksDB - Information about the public IPv4 and IPv6 addresses, networks and domains owned by companies and organisations across the world
- ASNlookup - Quickly lookup updated information about specific Autonomous System Number (ASN), Organization, CIDR, or registered IP addresses (IPv4 and IPv6) among other relevant data
- BGPtools - Browse the Internet ecosystem
- BGPview - Debug and investigate information about IP addresses, ASN, IXs, BGP, ISPs, Prefixes and Domain names
- BigDataCloud - The API provides comprehensive location and network data
- RADb - The world's largest public routing registry
- Deepinfo - Empower your security with the most comprehensive Internet data
- CloudFlare Radar - Global Internet traffic, attack, and technology trends and insights
- CanaryToken - creation Canary Token
- UrlScan - Scanner
- synapsint - OSINT domain
- domIQ - Find out everything about a domain name or IP address
- nerdy - builtWith/data about domain
- Rev.An - Reverse Analytics
- IDK - investigate what they download in torrent network
- redirect - redirect detective
- intelx - Open Source Intelligence & Forensic Tools
- ToS DR - find out what interesting privacy and confidentiality clauses are in the license agreements of popular websites and apps
- hacktarget - 14 tools for gathering information about domain using Hackerarget API
- Pidrila - Interactive Deepweb-oriented Rapid Intelligent Link Analyzer
- Adsenseosint - REVERSE GOOGLE ADSENSE
- SourceWolf - finds all the variables, endpoints and social media links mentioned in the code in just a few seconds
- CSP Validator - service for checking the headers and meta tags of websites for compliance with security standards. It can help determine if a site is vulnerable to common vulnerabilities (XSS, clickjacking, etc)
- Sputnik - Chrome extension for quick gathering info about IP, domain, hash or URL in dozens of different services: Censys, GreyNoise, VirusTotal, Shodan, ThreatMiner,...
- Source - Research 400m+ root domain information and all associated data, including records, IP address, page metadata
- Host Hunter - simple OSINT techniques to map IP addresses with virtual hostnames
- dnstwiste - Command line anti-phishing domain name search engine and DNS monitoring service
- PulseDive - Collects detailed information about IP, whois, ssl, dns, ports, threats reports, geolocation, cookies, metadata (fb app id etc)
- OpenSQUAT - Search newly registered phishing domain by keywords; Check it with VirusTotal and Quad9 DNS
- Argus - DNS history search by IP-adress or by domain name
- IP Investigation - type ip-adress once and gather information about it with 13 tools
- Miteru - Experimental phishing kit detection tool. It collects phishy URLs from phishing info feeds and checks each phishy URL whether it enables directory listing and contains a phishing kit (compressed file) or not
- Amass - In-depth attack surface mapping and asset discovery
CLOUDFLARE
- Cloudmare - Simple tool to find origin servers of websites protected by #Cloudflare, #Sucuri or #Incapsula with a misconfiguration DNS
- CloudPeler - CrimeFlare is a useful tool for bypassing websites protected by CloudFlare WAF, with this tool you can easily see the real IP of websites that have been protected by CloudFlare. The resulting information is certainly very useful for conducting further penetration testing, and analyzing websites with the same server
- clquest3r - Uncover the true IP address of websites safeguarded by Cloudflare & Others
- CloudUnflair - Reconnaissance Real IP address for Cloudflare Bypass
Domain & IP
- CentralOps - IP and Domain search
- iplookup - whois, reverse, database lookup
- domainwhois - investigation, map infrastructure
- greyhatshort - search URLs exposed by Shortener services
- whoisology - reverse lookup
- Pentesttools - Discover subdomains and determine the attack surface of an organization
- bw - find out what websites are Built With
- netcraft - search infrastructure and technologies used by any site
- s3 buckets - from grey hat warfare
- similarweb - find similar website search
- AFRINIC - whois for AFRINIC
- APNIC - whois for APNIC
- ARIN - whois for ARIN
- betterwhois - simple unified WHOIS search
- completedns - Research domain nameserver changes and drops
- Danger Zone - Correlate data between domains, IPs and email addresses, present it as a graph and store everything into Elasticsearch and JSON files
- dns - dnssec analyzer
- nstools -Domain name or IP address audit tools
- dnsspy - Monitor, validate and verify your DNS configurations
- Anubis - Subdomain enumeration and information gathering tool
- DNSdumpster - domain research tool that can discover hosts related to a domain
- domaincrawl - help digital researchers and investigators monitor the entire Internet analyze data, and discover threats and opportunities
- dosyadom - reports from public records about domain names and IP addresses to help solve problems, investigate cybercrime, or just better understand how things are set up
- Hudson Rock - cybercrime intelligence toolkit to check exposure in Infostealer malware infection
- Intel Tamper - IntelliTamper is a tiny but very practical tool that you can use to scan a website in order to reveal all its files and folders, including the unlisted ones
- sdb - Registered Domain Names Search
- IPvoid - IP address toolset
- Robtex - IP address and domain name based researching websites that offers multiple services such as Reverse DNS Lookup, Whois, and AS Macros
- TinyScan - URL scan tool that provides comprehensive information about any given URL. Get insights into IP address, location, screenshots, technology stack, performance metrics,...
- DNA - Unleash website insights! urldna.io analyzes url, monitors brands and track phishing sites
- urlQuery - domain analysis
- Validin - Website and API to search current and historical DNS records
- dnsinfo - analysis dns
- Web check - All-in-one tool for viewing website and server meta data
- laundromatinfo - Information Laundromat is a lead generation tool used to determine if and how websites share architecture and content. It provides two core functions: content similarity and domain forensics matching
- thingful - search engine for IoT
- crt - cert fingerprinting
- iana - The Root Zone Database represents the delegation details of top-level domains
- Internet Census 2012 - Port scanning /0 using insecure embedded devices, MAP
- techlookup - website built with
- ipleak - ip analyses
- shdn - domain ip analysis
- rse - RSECloud search engine
- scrap - web scarping for web crawling
- octo - web scarp
- dnsx - A fast and multi-purpose DNS toolkit designed for running DNS queries
- massdns - A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
- reconftw - perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
- gau - Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl
- sublist3r - Fast subdomains enumeration tool for penetration testers
Web History and Website Capture
- stored.website
- Wayback Machine - Explore the history of a website.
- Wayback Machine Archiver
- waybackpy - Python package & CLI tool that interfaces the Wayback Machine APIs
- waybackurls - Fetch all the URLs that the Wayback Machine knows about for a domain
Malware and Exploits & Investigation
- Malpedia - Malpedia is to provide a resource for rapid identification and actionable context when investigating malware
- anyrun - online malware analysis sandbox
- hybrid - hybrid analysis sandbox
- maltiverse - Intel IoC search
- jotti m - malware scan
- iobit - IObit Cloud is an advanced automated threat analysis system
- zoo - A repository of LIVE malwares for your own joy and pleasure. the Zoo is a project created to make the possibility of malware analysis open and available to the public
- vxug - malware collections, investigation papers/resources
- exploit DB papers - Exploit Database's Papers
- bin-exp - Exploit Database's Binary Exploits
- Sploitus - Space to identify Newest Exploits!
- ra7 - vuln & exploit database from rapid 7
- vulmon - Vulnerability and exploit search engine
- packetstorm - Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers
- 0day today - Ultimate database of exploits and vulnerabilities
- LOLBAS - Living Off The Land Binaries, Scripts and Libraries
- GTFOBins - GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems
- SWISSrepo - A list of useful payloads and bypasses for Web Application Security
- h1 - see latest disclosed/undisclosed activity in h1
- bugcrowd - Showcase of accepted and disclosed submissions on Bugcrowd programs / CrowdStream
- GTFOArgs - GTFOArgs is a curated list of Unix binaries that can be manipulated for argument injection, possibly resulting in security vulnerabilities
- shell-stormi - Shellcodes database for study cases
- LOLDrivers - Living Off The Land Drivers is a curated list of Windows drivers used by adversaries to bypass security controls and carry out attacks. The project helps security professionals stay informed and mitigate potential threats
- CVExploits - Your comprehensive database for CVE exploits from across the internet
- VARIoT - IoT exploits database
- LOOBins - Detailed information on various built-in macOS binaries and how they can be used by threat actors for malicious purposes
Coalition ExploitScoring System - Model that dynamically scores new and existing vulnerabilities to reflect their exploit likelihood
LOLAPPS - Compendium of applications that can be used to carry out day-to-day exploitation
LOTHardware - Resource collection that provides guidance on identifying and utilizing malicious hardware and malicious devices
LOTP - How development tools commonly used in CI/CD pipelines can be used to achieve arbitrary code execution
HACKYX - The aim of this project is to easily find any resource related to IT security like CTF writeups, articles or Bug Bounty reports
expobserver - The World's Largest Exploit & Vulnerability Intelligence Database and is freely accessible to all
vulnXDB - An index of exploit proof-of-concept code in Git repositories!
ARP Syndicate - Automated Reconnaissance & Pwning Syndicate
Thank you for everyone. These resources I collected/tested/used(not all) years and was very helpful. I hope these resources will be help you also, and saves your time 
planning part II or not...
Ref (not full)as I don't have Refs from these resources, so If I will see reference that I used in the future, I will update and add here links
Moderatör tarafında düzenlendi:
)
