Mapping Tools

Attack surface mapping tools help security teams and ethical hackers discover everything an organization exposes to the internet: domains and subdomains, IP ranges, open ports, cloud assets, login portals and forgotten services. Mapping this external attack surface is a key step in OSINT reconnaissance and the first phase of any penetration test.

Commonly used tools include Amass, Subfinder, theHarvester, Shodan, Censys and SpiderFoot, often combined with DNS enumeration and certificate transparency searches. Learn how to use them in our complete guide to OSINT and attack surface mapping. Map only organizations you own or are authorized to assess.