Asset Discovery & Identification

Tools for mapping digital infrastructure, identifying exposed services, and assessing security posture from an external perspective.

Common Use Cases:

Cybersecurity reconnaissanceAttack surface mappingNetwork analysisInfrastructure discovery

10 Tools Available

Nmap

A powerful utility for network discovery and security auditing that identifies active hosts, open ports, and running services.

Key Features:

  • Network discovery and host detection
  • Port scanning (TCP/UDP)
  • Service and version detection
Intermediate
Guide

OWASP Amass

In-depth attack surface mapping and asset discovery tool with extensive subdomain enumeration capabilities.

Key Features:

  • Extensive subdomain enumeration
  • Passive and active reconnaissance
  • Integration with 55+ data sources
Advanced
Guide

Recon-ng

Modular web reconnaissance framework with powerful command-line interface for gathering web data.

Key Features:

  • Modular architecture
  • Database integration
  • Multiple data sources
Advanced

Shodan

Search engine for connected devices that scans the internet and indexes metadata from servers, webcams, routers, and IoT devices.

Key Features:

  • Internet-wide device scanning
  • Banner grabbing and metadata collection
  • Advanced search filters (port, country, OS)
Beginner
Guide

theHarvester

Classic passive reconnaissance tool for gathering emails, subdomains, and employee names from public sources.

Key Features:

  • Email harvesting
  • Subdomain discovery
  • Employee name collection
Beginner

BuiltWith

Web technology profiler identifying frameworks, CMS, analytics tools, and technologies used to build websites.

Key Features:

  • Technology stack detection
  • Framework identification
  • Analytics tracking
Beginner

Censys

Internet-wide scanning platform with high-quality data and in-depth SSL/TLS certificate analysis.

Key Features:

  • Internet scanning
  • Certificate analysis
  • Infrastructure mapping
Beginner

DNSDumpster

Web-based tool providing visual maps of DNS infrastructure including servers, MX records, and subdomains.

Key Features:

  • DNS mapping
  • Visual infrastructure diagrams
  • Subdomain discovery
Beginner

Spiderfoot

Open-source automation tool that collects and analyzes data from over 100 public sources.

Key Features:

  • Automated data collection
  • 100+ data sources
  • Correlation analysis
Intermediate

Subfinder

Highly efficient subdomain discovery tool using passive online sources.

Key Features:

  • Fast subdomain enumeration
  • Passive reconnaissance
  • Multiple sources
Intermediate