Network Recon
21 tools indexed
Network reconnaissance tools for port scanning, host discovery, service enumeration, and network mapping. These tools form the foundation of any security assessment, helping identify live hosts, open ports, running services, and potential attack surfaces across local networks and the internet.
Nmap
The gold standard network scanner. Host discovery, port scanning, service/version detection, OS fingerprinting.
Masscan
Internet-scale port scanner. Transmits 10 million packets per second. Asynchronous, stateless scanning.
RustScan
Blazing fast port scanner that pipes into Nmap. Scans all 65k ports in 3 seconds flat.
Shodan CLI
Command-line interface for Shodan, the search engine for internet-connected devices.
Wireshark
The world's foremost network protocol analyzer. Deep packet inspection for hundreds of protocols.
Responder
LLMNR/NBT-NS/mDNS poisoner and rogue authentication server. Captures NTLMv1/v2 hashes on the network.
Censys CLI
Search engine for internet-connected devices. Alternative to Shodan with certificate and host search.
ZMap
Internet-wide single-packet scanner. Scans the entire IPv4 address space in under 5 minutes.
Ncat (Nmap)
Improved netcat with SSL support, IPv6, proxying, and connection brokering. The Swiss army knife of networking.
tcpdump
Command-line packet analyzer. The lightweight, scriptable alternative to Wireshark for capture and analysis.
enum4linux-ng
Windows/Samba enumeration tool. Extracts user lists, share info, group policies, and OS details via SMB.
Unicornscan
Asynchronous UDP/TCP port scanner with advanced stimulus-response analysis and OS fingerprinting.
Netdiscover
Active/passive ARP reconnaissance tool for network discovery without DNS traffic.
arp-scan
Send ARP requests to discover and fingerprint hosts on the local network segment.
Fierce
DNS reconnaissance tool for locating non-contiguous IP space and hostnames against specified domains.
Uncover
Quickly discover exposed hosts on the internet using multiple search engines like Shodan, Censys, and Fofa.
tlsx
Fast TLS probe tool for grabbing TLS certificates, versions, and cipher information at scale.
cdncheck
Detect whether an IP belongs to a CDN, cloud provider, or WAF to identify origin servers.
hping3
Active network security tool for firewall testing, advanced port scanning, and manual TCP/IP packet crafting.
fping
High-performance parallel ping tool designed for sweeping large network ranges with minimal overhead.
Naabu
Fast port scanner written in Go with SYN/CONNECT scan support, designed for integration with other ProjectDiscovery tools.