Populate Domain Name enrichment fields for batch 2 (THE-128)

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
s0lray
2026-03-27 09:57:27 -04:00
co-authored by Paperclip
parent 569e5189b8
commit a2e25099bf
+366 -36
View File
@@ -718,35 +718,95 @@
{
"name": "Gobuster (T)",
"type": "url",
"url": "https://github.com/OJ/gobuster"
"url": "https://github.com/OJ/gobuster",
"description": "Multi-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.",
"status": "live",
"pricing": "free",
"bestFor": "Fast DNS and vhost brute-force enumeration",
"input": "Domain, wordlist, and optional resolver/thread settings",
"output": "Discovered subdomains, vhosts, or directories with response details",
"opsec": "active",
"opsecNote": "Sends direct DNS/HTTP probes and can generate noisy traffic patterns.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Fierce Domain Scanner (T)",
"type": "url",
"url": "https://github.com/davidpepper/fierce-domain-scanner"
"url": "https://github.com/davidpepper/fierce-domain-scanner",
"description": "DNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.",
"status": "live",
"pricing": "free",
"bestFor": "DNS recon and subdomain-to-IP mapping",
"input": "Domain, DNS server options, and optional wordlist/range parameters",
"output": "Subdomains, resolved IPs, and DNS reconnaissance findings",
"opsec": "active",
"opsecNote": "Performs direct DNS lookups and optional scans that can be logged by infrastructure.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Bluto (T)",
"type": "url",
"url": "https://github.com/darryllane/Bluto"
"url": "https://github.com/darryllane/Bluto",
"description": "Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.",
"status": "live",
"pricing": "free",
"bestFor": "Initial domain footprinting and asset discovery",
"input": "Target domain and optional scan switches",
"output": "Aggregated recon output including DNS and related domain artifacts",
"opsec": "active",
"opsecNote": "Runs active lookups against target-related infrastructure and third-party services.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "OWASP Maryam (T)",
"type": "url",
"url": "https://github.com/saeeddhqan/Maryam"
"url": "https://github.com/saeeddhqan/Maryam",
"description": "Modular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.",
"status": "live",
"pricing": "free",
"bestFor": "Scriptable multi-module OSINT reconnaissance workflows",
"input": "Domain, IP, email, username, or module-specific query terms",
"output": "Module-based findings such as subdomains, metadata, and related intelligence",
"opsec": "active",
"opsecNote": "Can issue direct queries and module-driven probes depending on selected workflow.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "theHarvester (T)",
"type": "url",
"url": "https://github.com/laramies/theHarvester",
"description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.",
"description": "Command-line tool for harvesting emails, subdomains, hosts, and URLs from public data sources.",
"status": "live",
"pricing": "free",
"bestFor": "Email harvesting, subdomain enumeration, passive recon",
"input": "Domain name",
"output": "Email addresses, subdomains, IPs, URLs",
"bestFor": "Passive email and subdomain collection from indexed sources",
"input": "Domain and selected data source(s)",
"output": "Email addresses, subdomains, hostnames, IPs, and related metadata",
"opsec": "passive",
"opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.",
"opsecNote": "Queries third-party sources instead of directly interacting with the target host.",
"localInstall": true,
"googleDork": false,
"registration": false,
@@ -758,37 +818,142 @@
{
"name": "Pentest-tools.com Subdomains",
"type": "url",
"url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain"
"url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain",
"description": "Web-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.",
"status": "live",
"pricing": "freemium",
"bestFor": "Quick browser-based subdomain discovery without local setup",
"input": "Domain name",
"output": "List of discovered subdomains and related DNS intelligence",
"opsec": "passive",
"opsecNote": "Scanning is performed by Pentest-Tools infrastructure, not directly from your host.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "SecLists DNS Subdomains (T)",
"type": "url",
"url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS"
"url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS",
"description": "Community-maintained DNS wordlist collection used to power subdomain brute-force workflows.",
"status": "live",
"pricing": "free",
"bestFor": "Supplying high-quality DNS wordlists for enumeration tools",
"input": "Domain and chosen wordlist file used in external tooling",
"output": "Wordlist candidates for subdomain brute-force and permutation attacks",
"opsec": "passive",
"opsecNote": "Repository itself is passive; OPSEC impact depends on how the lists are used.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "dnspop (T)",
"type": "url",
"url": "https://github.com/bitquark/dnspop"
"url": "https://github.com/bitquark/dnspop",
"description": "DNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.",
"status": "live",
"pricing": "free",
"bestFor": "Command-line DNS recon and record analysis",
"input": "Domain and optional scan parameters",
"output": "DNS records, discovered hosts, and recon findings",
"opsec": "active",
"opsecNote": "Performs direct DNS queries against resolvers and target-associated records.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "gdns (T)",
"type": "url",
"url": "https://github.com/hrbrmstr/gdns"
"url": "https://github.com/hrbrmstr/gdns",
"description": "Google DNS-focused command-line tool for DNS lookup and domain record exploration.",
"status": "live",
"pricing": "free",
"bestFor": "Quick DNS enumeration via Google DNS services",
"input": "Domain and query options",
"output": "Resolved DNS records and related lookup results",
"opsec": "active",
"opsecNote": "Issues active DNS lookup requests that may be observable at resolver level.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Sublist3r",
"type": "url",
"url": "https://github.com/aboul3la/Sublist3r"
"url": "https://github.com/aboul3la/Sublist3r",
"description": "Python tool for subdomain enumeration using search engines, passive sources, and optional brute-force.",
"status": "live",
"pricing": "free",
"bestFor": "Combining passive and active subdomain discovery in one tool",
"input": "Domain and optional brute-force/thread settings",
"output": "Consolidated list of discovered subdomains",
"opsec": "active",
"opsecNote": "Uses multiple external sources and optional brute-force that can generate detectable traffic.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "AltDNS (T)",
"type": "url",
"url": "https://github.com/infosec-au/altdns"
"url": "https://github.com/infosec-au/altdns",
"description": "Permutation-based DNS tool that generates and resolves alternative subdomains from known names.",
"status": "live",
"pricing": "free",
"bestFor": "Discovering likely subdomain variants through permutations",
"input": "Known subdomains, wordlist, and target domain",
"output": "Resolved alternative subdomains and permutation results",
"opsec": "active",
"opsecNote": "Performs direct DNS resolution on generated permutations, creating active query footprints.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Netlas.io",
"type": "url",
"url": "https://app.netlas.io/domains/"
"url": "https://app.netlas.io/domains/",
"description": "Search platform for internet-exposed assets, domains, certificates, and web technologies.",
"status": "live",
"pricing": "freemium",
"bestFor": "Passive domain and infrastructure intelligence from indexed data",
"input": "Domain, IP, certificate fingerprint, or search query syntax",
"output": "Indexed assets, service metadata, certificates, and historical records",
"opsec": "passive",
"opsecNote": "Queries Netlas indexed datasets instead of scanning targets directly from your host.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
}
]
},
@@ -800,14 +965,14 @@
"name": "Shodan",
"type": "url",
"url": "https://www.shodan.io/",
"description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.",
"description": "Search engine for internet-exposed devices, services, and security-relevant banners.",
"status": "live",
"pricing": "freemium",
"bestFor": "Port scanning, banner grabbing, IoT discovery",
"input": "IP address, domain",
"output": "Open ports, services, banners, CVEs",
"bestFor": "Finding exposed services and infrastructure risk indicators",
"input": "IP, domain, ASN, organization, or filter-based search query",
"output": "Service banners, open ports, geolocation, vulnerabilities, and host metadata",
"opsec": "passive",
"opsecNote": "Queries cached scan data. Does not directly probe the target.",
"opsecNote": "Uses Shodan indexed scan data; target systems are not probed from your local host.",
"localInstall": false,
"googleDork": false,
"registration": true,
@@ -819,50 +984,155 @@
{
"name": "Netlas.io",
"type": "url",
"url": "https://app.netlas.io/"
"url": "https://app.netlas.io/",
"description": "Search platform for internet-exposed assets, domains, certificates, and web technologies.",
"status": "live",
"pricing": "freemium",
"bestFor": "Passive domain and infrastructure intelligence from indexed data",
"input": "Domain, IP, certificate fingerprint, or search query syntax",
"output": "Indexed assets, service metadata, certificates, and historical records",
"opsec": "passive",
"opsecNote": "Queries Netlas indexed datasets instead of scanning targets directly from your host.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Kraken (T)",
"type": "url",
"url": "https://github.com/Sw4mpf0x/Kraken"
"url": "https://github.com/Sw4mpf0x/Kraken",
"description": "Open-source reconnaissance utility for domain and network intelligence gathering workflows.",
"status": "live",
"pricing": "free",
"bestFor": "CLI-driven reconnaissance against domain and host assets",
"input": "Domain, host, or target parameters supported by selected module",
"output": "Recon findings across DNS, host intelligence, and related artifacts",
"opsec": "active",
"opsecNote": "Runs active collection modules that can generate requests visible to target infrastructure.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Online Nikto scanner",
"type": "url",
"url": "https://nikto.online/"
"url": "https://nikto.online/",
"description": "Hosted web interface for Nikto-based web server misconfiguration and vulnerability checks.",
"status": "live",
"pricing": "free",
"bestFor": "Quick remote Nikto scans from a browser",
"input": "Target URL or host",
"output": "Nikto-style findings on server headers, files, and common web weaknesses",
"opsec": "active",
"opsecNote": "Performs active vulnerability probing against the target web server.",
"localInstall": false,
"googleDork": false,
"registration": false,
"editUrl": true,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "urlscan.io",
"type": "url",
"url": "https://urlscan.io/search/#*"
"url": "https://urlscan.io/search/#*",
"description": "URL and domain analysis service that captures page loads, requests, and security-relevant artifacts.",
"status": "live",
"pricing": "freemium",
"bestFor": "Investigating suspicious URLs with scan snapshots and indicators",
"input": "URL or domain",
"output": "Scan reports including redirects, requests, domains, IPs, and screenshots",
"opsec": "passive",
"opsecNote": "Analysis runs on urlscan infrastructure; target contact is performed from their scanners.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": true,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Daily DNS Changes",
"type": "url",
"url": "https://dailychanges.domaintools.com/"
"url": "https://dailychanges.domaintools.com/",
"description": "DomainTools feed that tracks daily DNS record changes and newly observed domain configurations.",
"status": "live",
"pricing": "free",
"bestFor": "Monitoring DNS change activity and domain churn patterns",
"input": "Domain-centric lookup or feed browsing",
"output": "Recent DNS record changes and domain update observations",
"opsec": "passive",
"opsecNote": "Provides pre-collected change intelligence without direct target interaction by the user.",
"localInstall": false,
"googleDork": false,
"registration": false,
"editUrl": false,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Redirect Detective",
"type": "url",
"url": "https://redirectdetective.com/"
"url": "https://redirectdetective.com/",
"description": "Web tool that traces URL redirect chains and final destinations across multi-hop redirects.",
"status": "live",
"pricing": "free",
"bestFor": "Understanding redirect paths and affiliate or cloaking behavior",
"input": "URL",
"output": "Redirect chain, intermediate hops, and final destination URL",
"opsec": "passive",
"opsecNote": "Redirect checks are initiated through the service, limiting direct local target interaction.",
"localInstall": false,
"googleDork": false,
"registration": false,
"editUrl": true,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Sitediff (T)",
"type": "url",
"url": "https://github.com/digininja/sitediff"
"url": "https://github.com/digininja/sitediff",
"description": "Command-line utility for comparing website versions to detect content and structural changes.",
"status": "live",
"pricing": "free",
"bestFor": "Tracking site changes between snapshots for monitoring and QA",
"input": "Two URLs or snapshots to compare",
"output": "Diff output highlighting content and structural deltas",
"opsec": "passive",
"opsecNote": "Primarily compares fetched content; does not perform intrusive probing by design.",
"localInstall": true,
"googleDork": false,
"registration": false,
"editUrl": true,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "BuiltWith",
"type": "url",
"url": "https://builtwith.com/",
"description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.",
"description": "Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.",
"status": "live",
"pricing": "freemium",
"bestFor": "Technology stack identification, competitor analysis",
"bestFor": "Website technology stack fingerprinting and ecosystem mapping",
"input": "Domain or URL",
"output": "Technology list, analytics IDs, hosting info, historical tech changes",
"output": "Detected technologies, hosting/CDN indicators, and related site intelligence",
"opsec": "passive",
"opsecNote": "Queries cached technology profiles. Does not contact the target.",
"opsecNote": "Returns platform-collected intelligence and does not require direct target probing by the user.",
"localInstall": false,
"googleDork": false,
"registration": true,
@@ -874,22 +1144,82 @@
{
"name": "Wappalyzer",
"type": "url",
"url": "https://www.wappalyzer.com/"
"url": "https://www.wappalyzer.com/",
"description": "Technology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.",
"status": "live",
"pricing": "freemium",
"bestFor": "Detecting web technologies and software dependencies at scale",
"input": "Domain, URL, or browsed webpage",
"output": "Detected technologies by category with confidence indicators",
"opsec": "passive",
"opsecNote": "Uses extension/service analysis of page resources; minimal direct probing behavior.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "AnalyzeID",
"type": "url",
"url": "https://analyzeid.com/"
"url": "https://analyzeid.com/",
"description": "Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.",
"status": "live",
"pricing": "free",
"bestFor": "Pivoting from shared tracking IDs to related domains",
"input": "Tracking ID (analytics, ads, affiliate, or publisher ID)",
"output": "Associated domains and identifier reuse relationships",
"opsec": "passive",
"opsecNote": "Operates on indexed identifier-to-domain mappings without active target interaction.",
"localInstall": false,
"googleDork": false,
"registration": false,
"editUrl": true,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "Criminal IP Search",
"type": "url",
"url": "https://www.criminalip.io/"
"url": "https://www.criminalip.io/",
"description": "Cyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.",
"status": "live",
"pricing": "freemium",
"bestFor": "Threat-focused lookup of internet-facing assets and exposures",
"input": "IP, domain, ASN, CVE, or filter-based threat query",
"output": "Asset details, risk scores, service fingerprints, and vulnerability context",
"opsec": "passive",
"opsecNote": "Searches provider datasets rather than scanning targets directly from analyst infrastructure.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": false,
"api": true,
"invitationOnly": false,
"deprecated": false
},
{
"name": "urlDNA",
"type": "url",
"url": "https://urldna.io"
"url": "https://urldna.io",
"description": "URL intelligence service for investigating domains, redirects, and related reputation indicators.",
"status": "live",
"pricing": "freemium",
"bestFor": "Quick URL/domain triage and intelligence pivoting",
"input": "URL or domain",
"output": "URL analysis details, related domains, and risk-relevant metadata",
"opsec": "passive",
"opsecNote": "Uses service-side analysis and historical datasets instead of direct local probing.",
"localInstall": false,
"googleDork": false,
"registration": true,
"editUrl": true,
"api": false,
"invitationOnly": false,
"deprecated": false
},
{
"name": "ZoomEye.ai",