Guide
Each tool below now has its own page with practical context: what the tool is for, how to use it safely, and when it makes sense in a defensive workflow.
OSINT
Collects public emails, subdomains, hostnames, and names from open sources.
A defensive OSINT tool for building an initial external asset picture from public sources such as search engines, certificate data, and public datasets.
Read guideAttack Surface Mapping
Performs external attack surface mapping and subdomain discovery from multiple data sources.
OWASP Amass helps teams discover internet-facing assets, correlate data from many sources, and build a more complete view of an organization's external footprint.
Read guideExposure Search
Searches internet-exposed services, banners, and device metadata.
Shodan provides internet-wide visibility into exposed systems and service banners, helping defenders understand how their public services appear to outsiders.
Read guideExposure Search
Indexes hosts, certificates, and internet-wide service data for external visibility analysis.
Censys helps security teams pivot across certificates, hosts, and service fingerprints to identify infrastructure associated with an organization.
Read guideOSINT Automation
Automates multi-source OSINT collection and helps correlate findings across entities.
SpiderFoot aggregates public intelligence from many sources and is useful for building a fast, connected view of domains, infrastructure, identities, and metadata.
Read guideWeb Application Testing
A web security testing platform for analyzing requests, responses, and application behavior.
Burp Suite helps defenders inspect web application traffic, understand application behavior, and identify weaknesses during authorized testing and secure development reviews.
Read guideNetwork Discovery
A network discovery and service identification tool for approved infrastructure assessment.
Nmap helps defenders understand which hosts and services are reachable within authorized scope, making it a foundational tool for asset validation and exposure review.
Read guideSecurity Validation
A framework for controlled security validation, exploit verification, and lab-based testing.
Metasploit is used by authorized security teams to validate exposure, reproduce known weaknesses in controlled conditions, and confirm whether defensive controls detect or block realistic techniques.
Read guideUse these tools only for assets you own, explicitly manage, or are authorized to assess.