source
ASNmap

Go CLI and Library for quickly mapping organization network ranges using ASN information.

Amass

In-depth Attack Surface Mapping and Asset Discovery.

dnsx

dnsx is a fast and multi-purpose DNS toolkit allow to run multiple probes using retryabledns library.

assetfinder

Find domains and subdomains potentially related to a given domain.

httpx

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

CCrawlDNS

This small utility retrieves from the CommonCrawl data set unique subdomains for a given domain name.

Cloudflair

A tool to find origin servers of websites protected by CloudFlare who are publicly exposed and don't restrict network access to the CloudFlare IP ranges as they should.

Subfinder

Subfinder is a subdomain discovery tool that discovers subdomains for websites by using passive online sources.

crt.sh

Certificate Search.

OSINT

Open Source Intelligence.

DNSdumpster

DNS recon & research, find & lookup DNS records

DNSrecon

DNS Enumeration and Scanning Tool.

Hakrevdns

Small, fast tool for performing reverse DNS lookups en masse.

Netcraft DNS

NetCraft DNS lookup, includes sub-domains.

puredns

puredns description.

Sublist3r

Python tool designed to enumerate subdomains of websites using OSINT.

theHarvester

theHarvester is used to gather open source intelligence (OSINT) on a company or domain.

host

DNS lookup utility.