Network Recon

Nmap

C/C++

Featured

The gold standard network scanner. Host discovery, port scanning, service/version detection, OS fingerprinting.

Masscan

C

Internet-scale port scanner. Transmits 10 million packets per second. Asynchronous, stateless scanning.

RustScan

Rust

Blazing fast port scanner that pipes into Nmap. Scans all 65k ports in 3 seconds flat.

Shodan CLI

Python

Command-line interface for Shodan, the search engine for internet-connected devices.

Wireshark

C/C++

Featured

The world's foremost network protocol analyzer. Deep packet inspection for hundreds of protocols.

Responder

Python

LLMNR/NBT-NS/mDNS poisoner and rogue authentication server. Captures NTLMv1/v2 hashes on the network.

Censys CLI

Python

Search engine for internet-connected devices. Alternative to Shodan with certificate and host search.

ZMap

C

Internet-wide single-packet scanner. Scans the entire IPv4 address space in under 5 minutes.

Ncat (Nmap)

C

Improved netcat with SSL support, IPv6, proxying, and connection brokering. The Swiss army knife of networking.

tcpdump

C

Command-line packet analyzer. The lightweight, scriptable alternative to Wireshark for capture and analysis.

enum4linux-ng

Python

Windows/Samba enumeration tool. Extracts user lists, share info, group policies, and OS details via SMB.

Unicornscan

C

Asynchronous UDP/TCP port scanner with advanced stimulus-response analysis and OS fingerprinting.

Netdiscover

C

Active/passive ARP reconnaissance tool for network discovery without DNS traffic.

arp-scan

C

Send ARP requests to discover and fingerprint hosts on the local network segment.

Fierce

Python

DNS reconnaissance tool for locating non-contiguous IP space and hostnames against specified domains.

Uncover

Go

Quickly discover exposed hosts on the internet using multiple search engines like Shodan, Censys, and Fofa.

tlsx

Go

Fast TLS probe tool for grabbing TLS certificates, versions, and cipher information at scale.

cdncheck

Go

Detect whether an IP belongs to a CDN, cloud provider, or WAF to identify origin servers.

hping3

C

Active network security tool for firewall testing, advanced port scanning, and manual TCP/IP packet crafting.

fping

C

High-performance parallel ping tool designed for sweeping large network ranges with minimal overhead.

Naabu

Go

Fast port scanner written in Go with SYN/CONNECT scan support, designed for integration with other ProjectDiscovery tools.

Scapy

Python

Interactive packet manipulation library. Craft, send, capture, and decode network packets with a powerful Python interface.

Zeek

C++

Network analysis framework (formerly Bro). Deep packet inspection, protocol analysis, and security monitoring at scale.

Arkime

JavaScript/C

Full packet capture and search system (formerly Moloch). Indexed network traffic with a web UI for hunting and forensics.

Suricata

C/Rust

High-performance IDS/IPS and network monitoring engine. Multi-threaded with Snort-compatible rules and protocol logging.

BBOT

Python

Recursive internet scanner for automated recon, bug bounties, and attack surface management with 100+ modules.

fscan

Go

Fast internal network scanner with service brute-forcing, vulnerability detection, and exploit modules.

Sn1per

Shell

Automated attack surface management platform integrating recon, vulnerability scanning, and exploit tools.

SMBMap

Python

Enumerate SMB shares across a domain with permissions and access checking.

ssh-audit

Python

SSH server and client configuration auditing tool with algorithm analysis.

scanless

Python

Perform port scans anonymously through third-party scanner websites.

Raccoon

Python

High-performance offensive reconnaissance and information gathering tool.

Yersinia

C

Framework for layer-2 attacks targeting STP, CDP, DHCP, and other protocols.

mitmproxy

Python

Interactive TLS-capable intercepting HTTP proxy with a console UI, web interface, and Python scripting API.

Tsunami

Java

Google's general-purpose network security scanner with a plugin system for detecting high-severity vulnerabilities at scale.

Dshell

Python

Network forensic analysis framework by US Army Research Lab. Extensible Python-based packet decoder with plugin architecture.

pwnat

C

Punches through NATs and firewalls to establish direct connections between two hosts without port forwarding.

IVRE

Python

Self-hosted network recon framework combining active scanning, passive traffic analysis, and flow analysis with a web interface.

Smap

Go

Passive port scanner using Shodan's database. Nmap-compatible syntax without sending a single packet to the target.

Sniffnet

Rust

Featured

Cross-platform network traffic monitor with real-time analysis, 6000+ protocol identification, PCAP export, and IP geolocation.