License & Deployment Mix: 17 tools – 13 OSS, 4 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition; in this category Nmap is OSS under the NPSL but not OSI-listed.)
What Is Reconnaissance & Asset Discovery?
Reconnaissance is the systematic enumeration of an organization’s externally-exposed assets: subdomains, IP addresses, open ports, running services, web endpoints, and the data points that tie them together. The output is an external attack-surface map – the same map an adversary would draw, used by the defender to find what they don’t know they have.
Distinct from neighbouring categories:
- Vulnerability management (Vulnerability Management) takes a known asset and looks for CVEs, misconfigurations, and weaknesses. Recon finds the asset in the first place.
- Network monitoring (Network Monitoring / NPM) watches authenticated, owned infrastructure for health. Recon enumerates what is publicly exposed – often without authentication.
- IDS / IPS (IDS / IPS) detects active attack traffic. Recon is the proactive mapping phase.
The category captures both OSS toolchains (ProjectDiscovery’s subfinder/httpx/naabu/katana, OWASP Amass, theHarvester, recon-ng, SpiderFoot, gowitness, waybackurls, nmap, masscan) and SaaS attack-surface-management platforms (Detectify, runZero, Shodan).
Capabilities typically present in this category:
- Subdomain enumeration – passive (cert transparency, DNS aggregators, search engines) and active (DNS brute-force, zone walking, permutation)
- Host & port discovery – TCP/UDP port scanning at internet scale; service fingerprinting; SSL/TLS inspection
- HTTP probing – crawl, status-code triage, technology fingerprinting, screenshotting, response analysis
- OSINT – email harvesting, breach data, Git forges, social media, archived URLs, code search
- Cloud asset enumeration – exposed S3 buckets, Azure blobs, GCP buckets, public ECS/IAM principals, CDN edge endpoints
- Continuous monitoring – track new assets over time; alert on changes; integrate findings with vulnerability management
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
Coverage Matrix
What each tool actually does at a glance.
| Tool | Subdomain | DNS | Port | HTTP Probe | URL Discovery | Screenshot | OSINT | Cloud |
|---|---|---|---|---|---|---|---|---|
| subfinder | passive | – | – | – | – | – | – | – |
| httpx | – | – | – | yes | – | yes | – | – |
| naabu | – | – | yes | – | – | – | – | – |
| katana | – | – | – | – | yes | – | – | – |
| dnsx | – | yes | – | – | – | – | – | – |
| OWASP Amass | passive + brute | yes | – | – | – | – | partial | – |
| assetfinder | passive | – | – | – | – | – | – | – |
| theHarvester | passive | – | (Shodan) | – | – | yes | yes | – |
| recon-ng | yes | yes | (modules) | (modules) | – | – | yes | – |
| SpiderFoot | yes | yes | yes | yes | yes | yes | yes | partial |
| Nmap | – | – | yes | – | – | – | – | – |
| masscan | – | – | yes | (banners) | – | – | – | – |
| gowitness | – | – | – | – | – | yes | – | – |
| waybackurls | – | – | – | – | yes | – | – | – |
| Detectify | yes | yes | yes | yes | yes | yes | partial | partial |
| runZero | (internal) | yes | yes | yes | – | – | – | partial |
| Shodan | yes | yes | yes | banners | – | – | – | – |
Legend: passive = no traffic to target; brute = active DNS brute-force; yes = first- class feature; partial = supported via modules or limited; -- = not the tool’s job.
Licence Comparison
| Tool | Licence | OSI | Type |
|---|---|---|---|
| subfinder | MIT | yes | OSS CLI |
| httpx | MIT | yes | OSS CLI |
| naabu | MIT | yes | OSS CLI |
| katana | MIT | yes | OSS CLI |
| dnsx | MIT | yes | OSS CLI |
| OWASP Amass | Apache-2.0 | yes | OSS CLI / framework |
| assetfinder | MIT | yes | OSS CLI |
| theHarvester | GPL-2.0-only | yes | OSS Python CLI |
| recon-ng | GPL-3.0-only | yes | OSS Python framework |
| SpiderFoot | MIT (OSS) / proprietary HX | yes | OSS web + CLI |
| Nmap | NPSL | no | OSS-by-practice CLI |
| masscan | AGPL-3.0-only | yes | OSS CLI |
| gowitness | GPL-3.0-only | yes | OSS CLI |
| waybackurls | MIT | yes | OSS CLI |
| Detectify | Proprietary | – | Commercial SaaS |
| runZero | Proprietary | – | Commercial SaaS + agent |
| Shodan | Proprietary | – | Commercial SaaS |
Nmap’s Nmap Public Source Licence (NPSL) is GPL-derived but adds use restrictions that prevent OSI listing. For most users it is OSS by every practical measure; for the targets.md demo-list filter (OSI-only) it is excluded.
SSO / OIDC Comparison
Assume an Authentik-class OIDC provider. None of the CLI recon tools have an SSO surface of their own – they are headless binaries that read a target list and produce a results list. The SaaS / web entries are where SSO matters.
| Tool | OIDC | SAML | LDAP | SCIM | Authentik Notes |
|---|---|---|---|---|---|
| CLI tools (12 of 17) | n/a | n/a | n/a | n/a | No accounts; agent host’s identity gates execution |
| SpiderFoot OSS | no | no | no | no | Local Flask auth only; reverse-proxy auth via Traefik + Authentik forward-auth |
| SpiderFoot HX | yes* | yes* | – | – | Enterprise auth in the commercial edition |
| Detectify | paid | paid | – | paid | SAML SSO + SCIM on Enterprise tiers |
| runZero | paid | paid | – | paid | SAML + OIDC + SCIM on Enterprise tier |
| Shodan | paid | paid | – | paid | SAML / OIDC / SCIM on Enterprise plan; API-key access at every tier |
* Available on higher tiers of the commercial product line.
Deployment Comparison
| Tool | Deployment | Resources | Privileges |
|---|---|---|---|
| subfinder | binary, Docker, brew | trivial | none |
| httpx | binary, Docker, brew | trivial | none |
| naabu | binary, Docker, brew | trivial | CAP_NET_RAW for SYN; none for CONNECT |
| katana | binary, Docker | ~500 MB (headless mode) | Chromium for -headless |
| dnsx | binary, Docker, brew | trivial | none |
| OWASP Amass | binary, Docker, brew, snap | ~500 MB | BoltDB or Postgres for the graph |
| assetfinder | binary | trivial | none |
| theHarvester | pip / Docker / Kali | ~200 MB | none |
| recon-ng | pip / Docker / Kali | ~250 MB | none |
| SpiderFoot | Docker / pip / Windows | ~500 MB + DB | none (Flask local auth) |
| Nmap | every distro / brew | trivial | root or CAP_NET_RAW for SYN/OS-detect |
| masscan | apt / brew / Docker | ~50 MB | root or CAP_NET_RAW for SYN |
| gowitness | binary / Docker | ~500 MB+ (Chromium) | Chromium runtime |
| waybackurls | binary | trivial | none |
| Detectify | SaaS | – | – |
| runZero | SaaS + on-prem Explorer agents | – | Explorer agent on each scanned subnet |
| Shodan | SaaS | – | – |
Composition Patterns
Three canonical recon pipelines built from these tools:
1. Fast asset sweep
subfinder -d example.com -silent |
httpx -title -tech-detect -status-code |
naabu -p 80,443,8080,8443 |
gowitness file -f -Output: list of live web targets with screenshots, port info, and tech-stack fingerprints.
2. Deep mapping
amass enum -d example.com -active |
dnsx -resp -a -cname -mx -txt |
httpx -json |
jq -r '.url' |
katana -silent -json > urls.jsonlOutput: graph database of all discoverable infrastructure plus a complete URL inventory.
3. Continuous monitoring
# scheduled action on the agent host masscan <customer-cidr> -p1-65535 --rate 10000 -oX scan.xml nmap -iL <new-ips> -sV -sC -oX deep.xml # diff against last week's output, alert on changes
Output: continuous attack-surface monitoring with service-level fingerprints for any new exposure.
Roadmap Status
The most natural next additions:
- Censys ASM – closest SaaS competitor to Shodan; better for cert-transparency-driven discovery
- zmap – alternative to masscan with a different threading model
- gau / gospider – alternatives to waybackurls and katana
- sherlock – popular OSINT username enumeration
- cloud_enum – the cloud-asset gap
Tools
17 tools.
assetfinder
Tiny Go CLI from tomnomnom that finds subdomains and domains related to a given domain; favoured for its simplicity in shell pipelines.
License: MIT (OSS) · Kind: cli · Deploy: native, package · SSO: none
Detectify
Swedish SaaS external attack-surface-management platform; continuous subdomain monitoring, surface inventory, vulnerability scanning powered by Crowdsource bug-bounty researchers.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
dnsx
Fast DNS toolkit from ProjectDiscovery for resolving, filtering, and probing DNS records at scale; commonly used to verify subdomain lists from subfinder and collect A/CNAME/MX/TXT/NS records.
License: MIT (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
gowitness
Web-page screenshotter built on headless Chromium; takes a URL list, captures screenshots and HTML responses, generates a browsable HTML report or searchable SQLite database.
License: GPL-3.0-only (OSS) · Kind: cli · Deploy: native, docker · SSO: none
httpx
Fast multi-purpose HTTP toolkit from ProjectDiscovery; probes a list of hosts and reports status codes, technologies, titles, response hashes, and more for asset-discovery pipelines.
License: MIT (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
katana
Fast web crawler / spider from ProjectDiscovery, with both standard and headless (Chromium) modes; collects URLs, JavaScript, forms, and parameters for downstream recon.
License: MIT (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
masscan
Asynchronous TCP/UDP/SCTP port scanner that can scan the entire internet in under five minutes from a single machine; nmap-compatible XML output.
License: AGPL-3.0-only (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
naabu
Fast SYN / CONNECT port scanner from ProjectDiscovery; uses raw sockets where privileges allow, falls back to TCP connect; designed for piping into httpx and nuclei.
License: MIT (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
Nmap
The canonical network scanner. Host discovery, port scanning, version detection, OS fingerprinting, and Nmap Scripting Engine (NSE) checks; nearly three decades of refinement.
License: LicenseRef-NPSL (source-available) · Kind: cli · Deploy: native, docker, package · SSO: none
OWASP Amass
OWASP’s flagship attack-surface mapping framework; combines passive DNS, brute-force, alterations, ASN/CIDR lookups, and graph storage to build comprehensive infrastructure maps.
License: Apache-2.0 (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
recon-ng
Modular Python OSINT framework with a Metasploit- style console; 100+ community modules for subdomain, host, contact, vulnerability, and social-media reconnaissance.
License: GPL-3.0-only (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
runZero
Active CAASM / EASM platform from HD Moore (Rapid7 / Metasploit founder); proprietary scanner builds unmanaged-asset inventories on internal and external networks.
License: Proprietary (proprietary) · Kind: web · Deploy: saas, native · SSO: OIDC, SAML
Shodan
The original internet-scanning service; continuously scans the public IPv4/v6 space and indexes banners, certificates, and metadata for query by IP, port, service, country, organisation, or arbitrary fingerprint.
License: Proprietary (proprietary) · Kind: web · Deploy: saas · SSO: OIDC, SAML
SpiderFoot
Best-in-class open-source OSINT automation platform; 200+ modules covering domains, IPs, emails, names, Bitcoin addresses, phone numbers, leaked credentials, and dark-web mentions; web UI plus CLI.
License: MIT (OSS) · Kind: web · Deploy: docker, native, saas · SSO: none
subfinder
Fast passive subdomain enumeration CLI from ProjectDiscovery; queries 35+ public sources (cert-transparency logs, search engines, DNS aggregators) and writes verified subdomains.
License: MIT (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
theHarvester
Classic Python OSINT tool for harvesting emails, subdomains, hosts, employee names, ports, and banners from public sources during the early phases of an engagement.
License: GPL-2.0-only (OSS) · Kind: cli · Deploy: native, docker, package · SSO: none
waybackurls
Tiny tomnomnom Go CLI that queries the Internet Archive Wayback Machine for every URL ever observed under a target apex; surfaces forgotten endpoints, parameter names, and dev / staging hosts.
License: MIT (OSS) · Kind: cli · Deploy: native, package · SSO: none
