_ ReconLab
Commands  /  Information Gathering

Information Gathering

Reconnaissance, OSINT, DNS, network discovery and fingerprinting. · 45 commands

Nmap

medium
The de-facto network mapper and port/service scanner.
KaliParrotLinux

Masscan

high
Internet-scale asynchronous TCP port scanner.
KaliParrotLinux

whois

passive
Query domain/IP registration records.
KaliParrotLinux

dig

passive
Flexible DNS lookup utility.
KaliParrotLinux

dnsenum

low
DNS enumeration: records, zone transfers, brute force.
KaliParrot

dnsrecon

low
Scriptable DNS reconnaissance and enumeration.
KaliParrot

theHarvester

passive
Gather emails, subdomains and hosts from public sources.
KaliParrot

Recon-ng

passive
Modular OSINT reconnaissance framework.
KaliParrot

OWASP Amass

low
In-depth attack-surface mapping & subdomain enumeration.
KaliParrot

subfinder

passive
Fast passive subdomain discovery.
KaliParrot

Sublist3r

passive
Subdomain enumeration via search engines.
KaliParrot

netdiscover

medium
Active/passive ARP host discovery on a LAN.
KaliParrot

arp-scan

medium
Fast ARP-based host discovery and MAC fingerprinting.
KaliParrotLinux

enum4linux

medium
Enumerate information from Windows/Samba (SMB) hosts.
KaliParrot

smbclient

low
FTP-like client for SMB/CIFS shares.
KaliParrotLinux

snmpwalk

low
Walk an SNMP tree to extract device data.
KaliParrotLinux

WhatWeb

low
Identify web technologies behind a site.
KaliParrot

wafw00f

low
Detect and fingerprint web application firewalls.
KaliParrot

fierce

low
DNS reconnaissance to locate non-contiguous IP space.
KaliParrot

fping

low
Fast, parallel ICMP host sweeping.
KaliParrotLinux

DMitry

low
Deepmagic information gathering tool.
KaliParrot

SpiderFoot

low
Automated OSINT collection with 200+ modules.
KaliParrot

Maltego

passive
Visual link-analysis OSINT platform.
KaliParrot

Sherlock

passive
Hunt usernames across social networks.
KaliParrot

assetfinder

passive
Find domains/subdomains related to a target.
KaliParrot

gau (getallurls)

passive
Fetch known URLs from web archives.
KaliParrot

waybackurls

passive
Pull a domain’s URLs from the Wayback Machine.
KaliParrot

gowitness

low
Headless-Chrome web screenshotting.
KaliParrot

EyeWitness

low
Screenshot sites and group by similarity.
KaliParrot

onesixtyone

low
Fast SNMP community-string scanner.
KaliParrotLinux

snmp-check

low
Human-readable SNMP enumeration.
KaliParrot

smtp-user-enum

low
Enumerate valid users via SMTP.
KaliParrot

Swaks

low
Swiss-army knife for SMTP testing.
KaliParrotLinux

nbtscan

low
Scan NetBIOS name information.
KaliParrotLinux

rpcclient

low
Query MS-RPC on Windows/Samba hosts.
KaliParrotLinux

ldapsearch

low
Query LDAP / Active Directory.
KaliParrotLinux

hping3

medium
Custom TCP/IP packet crafter & scanner.
KaliParrotLinux

p0f

passive
Passive OS/network fingerprinting.
KaliParrotLinux

wig

low
WebApp Information Gatherer (CMS detect).
KaliParrot

Metagoofil

passive
Harvest metadata from public documents.
KaliParrot

httpx

low
Fast, multi-purpose HTTP probing toolkit.
KaliParrot

naabu

medium
Fast SYN/CONNECT port scanner in Go.
KaliParrot

dnsx

passive
Fast, multi-purpose DNS toolkit.
KaliParrot

Shodan CLI

passive
Query the Shodan internet-scan database.
KaliParrot

Knockpy

low
Subdomain scanner via brute force + sources.
KaliParrot