> For the complete documentation index, see [llms.txt](https://davidtancredi.gitbook.io/pentesting-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon.md).

# Attack Surface Recon

- [Subdomain-enum](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/subdomain-enum.md): All things subdomain enum
- [Scilla](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/subdomain-enum/scilla.md): Subdomain enumeration
- [Amass](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/subdomain-enum/amass.md)
- [Sublist3r](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/subdomain-enum/sublist3r.md)
- [Assetfinder](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/subdomain-enum/assetfinder.md)
- [Subfinder](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/subdomain-enum/subfinder.md): OG tool
- [DNS permutations](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations.md)
- [PureDNS](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations/puredns.md): Puredns is a fast domain resolver and subdomain bruteforcing tool that can accurately filter out wildcard subdomains and DNS poisoned entries. Alternative to ShuffleDNS from Project Discovery
- [TLSx](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations/tlsx.md): A fast and configurable TLS grabber focused on TLS based data collection and analysis.
- [MassDNS](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations/massdns.md): Simple high-performance DNS stub resolver
- [AltDNS](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations/altdns.md)
- [shuffleDNS](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations/shuffledns.md): Project Discovery Wrapper on MassDNS
- [DNSValidator](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/dns-permutations/dnsvalidator.md): Maintains a list of IPv4 DNS servers by verifying them against baseline servers, and ensuring accurate responses.
- [Legacy tools](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/legacy-tools.md)
- [Fierce](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/legacy-tools/fierce.md)
- [DNS Recon](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/legacy-tools/dns-recon.md)
- [Dig](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/legacy-tools/dig.md)
- [DNSAudit](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/legacy-tools/dnsaudit.md): Only works on large targets
- [Hakluke](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/hakluke.md): DNS tools from Hakluke
- [Hakrevdns](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/hakluke/hakrevdns.md): perform reverse DNS lookups en masse.
- [hakip2host](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/hakluke/hakip2host.md): hakip2host takes a list of IP addresses via stdin, then does a series of checks to return associated domain names.
- [Hakoriginfinder](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/hakluke/hakoriginfinder.md): Tool for discovering the origin host behind a reverse proxy. Useful for bypassing WAFs and other reverse proxies.
- [ffuf](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/ffuf.md): one-liner for subdomain enum, need to provide a dns.txt wordlist (seclists is a good match)
- [One liners](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/one-liners.md)
- [Wordlists and Resolvers](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/wordlists-and-resolvers.md)
- [IPinfo](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/ipinfo.md): Modern alternative to Whois
- [Scripts](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/scripts.md)
- [TLD enum Script](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/scripts/tld-enum-script.md): Check for all possible TLDs of a target domain,saves valid domains in a result.txt file, useful for bug bounties and Webapp pentest enum
- [Bugbounty Subdomain enum script](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/scripts/bugbounty-subdomain-enum-script.md): Github-subdomains requires multiple tokens in the current directory to avoid rate limiting, edit  Seclists subdomains wordlists if needed.
- [gungnir](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/gungnir.md): Gungnir is a command-line tool written in Go that continuously monitors certificate transparency (CT) logs for newly issued SSL/TLS certificates.
- [NMAP](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/nmap.md): NSE script for subdomain enum
- [Hednsextractor](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/hednsextractor.md): A suite for hunting suspicious targets, expose domains and phishing discovery
- [Caduceus](https://davidtancredi.gitbook.io/pentesting-notes/r3dcl1ff/webapp-pentest/attack-surface-recon/caduceus.md): Better option than  hakrevdns or hakip2host, allows to specify target ports