Topics / #recon

Recon projects on GitHub

Reconnaissance frameworks that map attack surfaces by discovering domains, subdomains, and assets.

As of , the most-starred Recon projects on GitHub are spiderfoot (23.5K stars), theHarvester (18K stars) and amass (15.4K stars). GitHub.Locker tracks 13 Recon repositories with 158.2K stars combined. The fastest-growing on October 16 was wifit3, with +26 stars in a day.

13Projects
158.2KStars in total
+120Stars in a day
Browse in the catalog →github.com/topics/recon ↗

Hot right now

Most stars gained in a day · Oct 16

+26

wifit3

derv82/wifit3 · ★ 2.4K

wifit3 is a standalone Wi-Fi security auditing tool that scans networks, captures WPA/WPA2 handshakes, and exploits WPS/WEP weaknesses using a supported USB Wi-Fi adapter, without relying on aircrack-ng or OS kernel drivers.

+20

flowsint

reconurge/flowsint · ★ 9.8K

Flowsint is an open-source, graph-based OSINT investigation tool that lets analysts explore relationships between people, domains, IPs, organizations and more through a visual graph interface with automated enrichers.

+19

spiderfoot

smicallef/spiderfoot · ★ 23.5K

Open source OSINT automation — it collects intelligence on a target for threat intel and attack surface mapping, whether you are doing red team recon or checking what your organisation has exposed.

+11

theHarvester

laramies/theHarvester · ★ 18K

An open-source OSINT tool that gathers emails, subdomains and names about a domain or organization from public sources: search engines, certificate transparency logs, DNS datasets, code repositories and threat-intel platforms, normalizing hostnames, emails, IPs, URLs, ASNs, people and breach names.

The all-time top

13 projects · by stars

  1. #1 · smicallef/spiderfoot

    spiderfoot

    Open source OSINT automation — it collects intelligence on a target for threat intel and attack surface mapping, whether you are doing red team recon or checking what your organisation has exposed.

    23.5K
  2. #2 · laramies/theHarvester

    theHarvester

    An open-source OSINT tool that gathers emails, subdomains and names about a domain or organization from public sources: search engines, certificate transparency logs, DNS datasets, code repositories and threat-intel platforms, normalizing hostnames, emails, IPs, URLs, ASNs, people and breach names.

    18K
  3. #3 · owasp-amass/amass

    amass

    Amass is an OWASP project that maps attack surfaces and discovers external assets (like subdomains, IPs, and infrastructure) using open source intelligence gathering and active reconnaissance.

    15.4K
  1. 4

    PENTESTING-BIBLE

    14KblaCCkHatHacEEkr/PENTESTING-BIBLE

    A curated catalog of over 200 numbered links to pentesting articles, bug bounty write-ups, cheat sheets and other security lists — a reading collection, not software.

  2. 5

    awesome-web-security

    13.9Kqazbnm456/awesome-web-security · Python

    A curated list of web security materials and resources, organized by vulnerability class and attack type (XSS, SQL injection, CSRF, SSRF, XXE, deserialization, OAuth, JWT, and more), plus cheatsheets, tools, and write-ups for penetration testing.

  3. 6

    hacktricks

    12.6KHackTricks-wiki/hacktricks · JavaScript

    A free, open wiki of hacking tricks and techniques — everything the author has learnt from CTFs, real-world apps and security research, organized into a browsable reference with 12.5k+ GitHub stars.

  4. 7

    Sn1per

    11.5K1N3/Sn1per · Shell

    Sn1per is an offensive-security platform that bundles reconnaissance, vulnerability scanning, exploitation and reporting into one workspace, orchestrating 600+ exploits and 90+ third-party tools for pentesters and attack-surface-management teams.

  5. 8

    Sublist3r

    11.1Kaboul3la/Sublist3r · Python

    Sublist3r is a Python tool that enumerates subdomains of a target website using OSINT, helping penetration testers and bug hunters gather subdomains for a domain they are targeting.

  6. 9

    bbot

    10.7Kblacklanternsecurity/bbot · Python

    BBOT is a recursive internet scanner for hackers — it automates recon, bug bounty work and attack surface management (ASM), inspired by Spiderfoot.

  7. 10

    OneForAll

    10.1Kshmilylty/OneForAll · Python

    OneForAll is a powerful subdomain collection tool: point it at a target domain and it gathers subdomains from many sources — a core reconnaissance step in penetration testing, which is why the author built it.

  8. 11

    flowsint

    9.8Kreconurge/flowsint · TypeScript

    Flowsint is an open-source, graph-based OSINT investigation tool that lets analysts explore relationships between people, domains, IPs, organizations and more through a visual graph interface with automated enrichers.

  9. 12

    Agentic-Bug-Hunter

    5.4Kawarexone/Agentic-Bug-Hunter · Python

    Agentic Bug Hunter is an AI-powered bug bounty toolkit that runs recon, tests for vulnerabilities, validates findings against a strict gate, and writes submission-ready reports for HackerOne, Bugcrowd, Intigriti, or Immunefi, right from your terminal.

  10. 13

    wifit3

    2.4Kderv82/wifit3 · Python

    wifit3 is a standalone Wi-Fi security auditing tool that scans networks, captures WPA/WPA2 handshakes, and exploits WPS/WEP weaknesses using a supported USB Wi-Fi adapter, without relying on aircrack-ng or OS kernel drivers.

Often tagged together