asset-discovery 开源项目推荐（129 个）

redhuntlabs /Awesome-Asset-Discovery

List of Awesome Asset Discovery Resources

asaotomo /FofaMap

FofaMap v2.0 是一款基于 Python3 开发的全网首个 AI 驱动红队资产测绘智能体。在延续原有 FOFA 数据采集、存活检测、统计聚合、图标 Hash 及批量查询等核心功能的基础上，2.0 版本原生支持 MCP 协议，可无缝接入 Cursor、Claude 等 AI 平台。其核心内置了 AI 自我反思机制，能根据查询结果自动调优语法，并智能联动 Nuclei 推荐精准扫描策略，实现从“被动采集”到“主动智能决策”的红队作业进化。

yyhuni /xingrin

Open-source attack surface management and authorized security automation platform for asset discovery, service probing, scan orchestration, and security result management.

chrismaddalena /ODIN

Automated network asset, email, and social media profile discovery and cataloguing.

projectdiscovery /awesome-search-queries

Community curated list of search queries for various products across multiple search engines.

redhuntlabs /BurpSuite-Asset_Discover

Burp Suite extension to discover assets from HTTP response.

hueristiq /xsubfind3r

A command-line tool for discovering subdomains for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly available.

enenumxela /subdomains.sh

A wrapper around tools used for subdomain enumeration, to automate the workflow, on a given domain, written in bash.

yyhuni /lunafox

Open-source, self-hosted attack surface management platform with distributed agents for asset discovery, scan orchestration, and vulnerability management.

OsmanKandemir /web-wordlist-generator

WEB-Wordlist-Generator creates related wordlists after scanning your web applications.

yingfff123 /AtlasX

企业暴露面收集与持续监控（ASM）自托管系统：多源采集、存活与指纹富化、风险线索与变更对照。支持 Linux/Docker 一键部署。

Escape-Technologies /awesome-attack-surface-management

A curated collection of tools, techniques, frameworks, and learning resources focused on Attack Surface Management (ASM).

ronin-rb /ronin-recon

A micro-framework and tool for performing reconnaissance.

OsmanKandemir /associated-threat-analyzer

Associated-Threat-Analyzer detects malicious IPv4 addresses and domain names associated with your web application using local malicious domain and IPv4 lists.

tedmdelacruz /recon-scripts

A simple reconnaissance framework for bug bounty hunting

1337rokudenashi /Kowareta-Kiss

Kowareta-Kiss is a security workflow to discover real-world threats using open-source tools such as urlfinder, katana, httpx, nuclei, and glow, with findings mapped to CWE and CVE using matcher patterns.

n0mi1k /gosublister

An subdomain enumerator for web URLs using the power of Goroutines.

keyblues /fofatoto

fofatoto 是一款fofa工具，支持多次查询模式和批量查询模式

usdagfhjkda /srcradar

An SRC asset-mapping orchestration pipeline: a business and its scoped assets → the active mapping → the daily incremental diff → a local visual dashboard, joined by a single SQLite. Apache-2.0, for the authorized information-collection scenarios only.

whxitte /exact-surface

Open-source, self-hosted external attack-surface management (EASM). Continuous discovery + 28 detection modules, the exact request behind every finding, and a visual Playground. Detection only.