Command-line tools for finding what an organisation exposes. They map its hosts, probe what answers on them, crawl the endpoints behind those and detect vulnerabilities across the result. The scanners read targets on stdin and write one result per line, so they chain with a pipe. We run them in our own research and products, so they stay maintained.
go install -v github.com/projectdiscovery/pdtm/cmd/pdtm@latest && pdtm -install-all
Mapping starts from an organisation or a domain and ends with a resolved list of the hosts under it. No single source is complete, so query several and take the union.
subfinder queries passive sources: certificate transparency, passive DNS, search engines and the APIs you hold keys for. API keys go in provider-config.yaml. -all queries every source, not only the fast ones; -recursive keeps only the sources that can enumerate under a subdomain.
chaos-client returns subdomains from our DNS dataset of public bug bounty programs. uncover runs one query across Shodan, Censys, FOFA and a dozen other engines and returns host:port.
alterx guesses subdomains no source lists. It reads the subdomains found so far and writes permutations of them, dev-api and api-staging from api; -enrich adds the words it sees in the input to its pattern list. shuffledns guesses from a wordlist instead: -mode bruteforce resolves every word under a domain over massdns and discards the wildcard answers.
asnmap turns an organisation name, ASN, IP or domain into its announced ranges and mapcidr expands them to addresses; -shuffle-ip randomises the order so a scan does not walk a range sequentially. cdncheck marks the addresses that belong to a CDN, WAF or cloud provider rather than an origin; -resp prints the provider beside each and -exclude drops them so a scan reaches only origins.
Pipe the union into dnsx to resolve it. -a asks for A records and -cname or -mx for another type, -r takes your own resolvers, -resp prints the answer beside the subdomain, and -silent keeps stdout to results only.
subfinder -d acme.com -all -silent | alterx -silent | dnsx -silent -a -resp
host:port.Probing takes the resolved hosts and records which ports are open, what service answers on each and what its certificate says.
naabu scans with CONNECT by default; -s s switches to SYN, which needs root. -top-ports 100 scans the hundred most common ports, -top-ports 1000 the thousand, and -p - all of them. -rate caps packets per second.
httpx probes each host over HTTPS and HTTP. -sc, -title, -cl and -location add the status code, title, content length and redirect target; -tech-detect adds the technologies it recognises, -screenshot saves a headless capture, and -json emits every field per host.
tlsx reads the certificate on each host. -san and -cn print the names in it, including hosts the DNS sources missed. -ex, -ss and -mm flag expired, self-signed and mismatched certificates. -ce lists the ciphers the server accepts.