Skip to main content
Manual enumeration finds what a wordlist and a human eye catch, automated scanners trade precision for coverage, running thousands of known-vulnerability checks or OSINT lookups in the time it’d take to try a handful by hand. They’re best used early to triage a target fast, not as a replacement for the manual work on the rest of this site.
These tools are noisy by nature (high request volume, known signatures), expect them to show up in logs and trip WAF rules well before any manual testing would. Confirm scope accordingly.

​
Nuclei

Nuclei runs a huge, community maintained library of YAML templates against a target, each template checking for one specific CVE, misconfiguration, or exposure. It’s less a single scanner than a template engine, the value is almost entirely in keeping the template set current.
A basic scan against a single target, writing results to a file.
Running every template against every target wastes time. Filter by severity when you only care about actionable findings, or by tag when you already know the stack (e.g. only WordPress-related templates on a WordPress site).
Scanning a whole list of targets, with the request rate capped to stay under a WAF’s radar.

​
Nikto

Nikto checks a web server itself for thousands of known-bad files, outdated software versions, and generic misconfigurations, closer to a vulnerability scanner for the server than for the application logic.
-Tuning narrows the scan to specific test categories instead of running everything, useful for a faster, more targeted pass.
Tuning code 5 is remote file retrieval inside the webroot, not local file inclusion specifically, LFI findings fall more generally under information disclosure (3) or the file-retrieval categories. Pick codes based on what you actually want tested rather than assuming a one-to-one mapping to a named vuln class.

​
Amass

Amass is OWASP’s subdomain and attack-surface mapping tool, it goes further than a simple subdomain brute-forcer by correlating DNS, certificate, scraping, and API-based data sources together.
Active enumeration adds DNS resolution, reverse lookups, and brute forcing on top of the passive sources, louder but more complete.

​
Automated Recon Frameworks

Beyond single-purpose scanners, several frameworks chain multiple recon steps (DNS, subdomains, screenshots, port scans, vuln checks) into one run.
FrameworkWhat it does
FinalReconPython-based recon tool with modules for SSL checks, WHOIS, header analysis, and crawling, runs everything in one pass with --full
Recon-ngModular Python framework, closest in spirit to Metasploit but for OSINT/recon: DNS enum, subdomain discovery, port scanning, web crawling
theHarvesterEmail, subdomain, host, and employee-name gathering from search engines, PGP servers, and Shodan (see Passive Information Gathering for usage)
SpiderFootOSINT automation platform correlating IPs, domains, emails, and social profiles across many data sources, with DNS/web crawling/port scanning built in
DiscoverBash-based recon menu wrapping several of the above tools into guided workflows
Recon-ng and SpiderFoot are both interactive/menu-driven rather than single-shot commands, expect to spend a few minutes picking modules and setting the workspace rather than a one-liner.

​
Quick Reference Tools

Nuclei

Template-driven vulnerability scanner, the de facto standard for fast CVE/misconfig checks.

Nikto

Web server vulnerability and misconfiguration scanner.

Amass

OWASP’s attack-surface and subdomain mapping tool.

Discover

Menu-driven wrapper around several recon tools.

SpiderFoot

OSINT automation platform, see also the OSINT cheatsheet.

Recon-ng

Modular Python recon framework.
Automated scanners generate significant traffic and are easy to attribute back to a single source IP. Only run them against explicitly authorized targets, and throttle rate limits (-rl, -c) on anything shared or production-adjacent.