A curated list of tools, resources, and best practices for Attack Surface Management (ASM), External Attack Surface Management (EASM), and continuous security monitoring.
Attack Surface Management is the continuous discovery, analysis, classification, and monitoring of an organization's external-facing digital assets to identify vulnerabilities and reduce cyber risk exposure.
- Reconnaissance & Discovery
- Fingerprinting & Technology Detection
- Cloud Attack Surface Management
- Open Source ASM Platforms
- Commercial ASM Platforms
- Automation & Orchestration
- Resources
- Subfinder - Fast passive subdomain enumeration tool using multiple sources.
- Knock - Subdomain scanner with wordlist and zone transfer support.
- Findomain - Cross-platform subdomain enumerator with monitoring capabilities.
- chaos-client - Client to query ProjectDiscovery's Chaos dataset API.
- Sudomy - Subdomain enumeration with analysis and reporting.
- alterx - Subdomain wordlist generator using DSL.
- MassDNS - High-performance DNS stub resolver for bulk lookups.
- dnsx - Fast DNS toolkit with multiple DNS queries support.
- dnsgen - Generate combinations and permutations of domains for DNS discovery.
- altdns - Subdomain discovery through alterations and permutations.
- dnsrecon - DNS enumeration script supporting multiple types of DNS records.
- fierce - DNS reconnaissance tool for locating non-contiguous IP space.
- shuffledns - Wrapper around massdns for DNS enumeration with active bruteforce.
- asnmap - Quickly mapping organization network ranges using ASN information.
- crt.sh - Certificate search web interface for CT logs.
- Cert-Stream - Real-time certificate transparency log monitoring.
- CertSpotter - Certificate transparency log monitor.
- Censys - Internet-wide scanning and certificate transparency search.
- Nmap - Network discovery and security auditing with extensive scripting capabilities.
- Masscan - TCP port scanner capable of scanning the entire Internet.
- RustScan - Modern port scanner with speed and automation focus.
- Naabu - Fast port scanner written in Go with focus on reliability.
- ZGrab2 - Fast application layer scanner for large-scale studies.
- Shodan - Search engine for Internet-connected devices.
- Onyphe - Cyber defense search engine for open-source intelligence gathering.
- Katana - A next-generation crawling and spidering framework.
- Uncover - Quickly discover exposed hosts on the internet using multiple search engines.
- Goctopus - Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce.
- httpx - Fast and multi-purpose HTTP toolkit for probing web services and API endpoints.
- SecLists API - A wordlist of API names used for fuzzing web application APIs.
- theHarvester - E-mails, subdomains, and names harvester from public sources.
- SpiderFoot - Automated OSINT reconnaissance tool with web UI.
- OWASP Maryam - Modular OSINT framework for web searching and information gathering.
- Maltego - Interactive data mining tool with link analysis.
- Wappalyzer - Technology profiler identifying CMS, frameworks, analytics tools.
- WhatWeb - Next generation web scanner identifying technologies, versions, and more.
- Webanalyze - Port of Wappalyzer written in Go for bulk website analysis.
- retire.js - Scanner detecting use of JavaScript libraries with known vulnerabilities.
- wappalyzergo - Go implementation of Wappalyzer Technology Detection Library.
- Nmap NSE Scripts - Extensive scripting engine for service and version detection.
- wafw00f - Web Application Firewall fingerprinting tool.
- CMSeeK - CMS detection and exploitation suite.
- Cloudfinder - Detect the cloud / hosting provider of a given host.
- CloudFlair - Tool to find origin servers of websites behind CloudFlare.
- cloud_enum - Multi-cloud OSINT tool for finding public resources.
- CloudMapper - Analyze AWS environments for security posture.
- ScoutSuite - Multi-cloud security auditing tool.
- Prowler - AWS/Azure/GCP security assessments and compliance.
- Cartography - Consolidates infrastructure assets and relationships in a graph.
- Cloudsploit - Cloud security configuration scanner.
- Pacu - AWS exploitation framework for testing security.
- CloudSplaining - AWS IAM security assessment tool.
- CloudCustodian - Rules engine for cloud security and governance.
- Steampipe - Use SQL to query cloud infrastructure.
- Cloudlist - Multi-cloud asset listing tool.
- OWASP Amass - In-depth attack surface mapping and asset discovery using multiple techniques.
- ArcherySec - ASOC, ASPM, DevSecOps, Vulnerability Management platform.
- AttackSurfaceMapper - Tool that aims to automate the reconnaissance process.
- Attaxion - Agentless EASM platform with attack surface discovery, vulnerability assessment, and continuous monitoring.
- BitSight - Security ratings and risk monitoring platform.
- Censys ASM - Internet intelligence platform for ASM.
- CyCognito - External attack surface management with autonomous testing.
- Escape ASM - Attack surface management with continuous discovery and automated security testing.
- JupiterOne - Cyber asset attack surface management platform.
- Qualys CSAM - CyberSecurity Asset Management platform.
- Recon Wave - Agentless infrastructure monitoring platform with DNS dataset, port scanning, and vulnerability detection.
- RiskIQ (Microsoft Defender EASM) - External attack surface discovery and monitoring.
- SecurityScorecard - Security ratings and continuous monitoring.
- Tenable.asm - External attack surface management solution.
- Axiom - Dynamic infrastructure framework for distributed security testing.
- Sn1per - Automated pentesting framework with reconnaissance capabilities.
- ReconFTW - Automated recon wrapper for multiple tools.
- Escape - Why context is king in Attack Surface Management
- ProjectDiscovery - What is attack surface management?
Your contributions are always welcome! Please take a look at the contribution guidelines first.
If you have any question about this opinionated list, do not hesitate to contact us @escapetechHQ on Twitter or open an issue on GitHub.
We believe it's time to bring more AI-driven innovation to cybersecurity, and we'd love your help in building this dream! Want to join our adventure? Check out our Careers page!