Under maintenance

Pricing

Pay per usage

Try for free

Go to Apify Store

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint

Under maintenance

Try for free

Map a domain's external attack surface. Passive subdomain enumeration with subfinder, HTTP fingerprint with httpx: status, title, server, technology stack, TLS issuer and IP. One dataset row per responding host. For recon, asset discovery and security audits.

Pricing

Pay per usage

Rating

0.0

(0)

Developer

Sevastian Z

Actor stats

Bookmarked

Total users

Monthly active users

3 days ago

Last modified

Attack Surface Recon: Subdomain & HTTP Tech Discovery API through CLI

The Apify CLI is the official tool that allows you to use Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint locally, providing convenience functions and automatic retries on errors.

Install Apify CLI

Using installation script (macOS/Linux):

$curl -fsSL https://apify.com/install-cli.sh | bash

Using installation script (Windows):

$irm https://apify.com/install-cli.ps1 | iex

Using Homebrew:

$brew install apify-cli

Using npm:

$npm install -g apify-cli

Other API clients include:

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint API in Python

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint API in JavaScript

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint OpenAPI definition

Attack Surface Recon: Subdomain Discovery + HTTP Fingerprint API

Subdomain Finder & Recon Tool

andok/subdomain-finder

Discover subdomains for any target via passive OSINT sources. Ideal for security bug bounties and attack surface mapping.

Andok

Certificate Transparency Subdomain Search (crt.sh alternative)

advx/ct-domain-lookup

Find subdomains and TLS certificates for any domain from Certificate Transparency logs. A fast, working crt.sh alternative for subdomain enumeration, recon and attack-surface mapping. Returns unique hostnames with first/last seen and issuers, or raw certificates.

Sevastian Z

Cyber Attack Surface — DNS, SSL & CVE Exposure

ryanclinton/cyber-attack-surface-report

Comprehensive external attack surface report that maps any domain's infrastructure, vulnerabilities, and exposure using 11 sub-actors in parallel.

Ryan Clinton

Subdomain Discovery API

crawland/subdomain-discovery-api

Paginated subdomain enumeration for any registered domain — DNS records, registrar, WHOIS, vendor reputation, and category labels per subdomain, served from the Crawland threat-intelligence backend.

Crawland

Entity Attack Surface MCP Server

ryanclinton/entity-attack-surface-mcp

Corporate cyber exposure intelligence via the Model Context Protocol. This MCP server orchestrates 11 data sources to discover and score an organization's digital attack surface -- from DNS and SSL infrastructure to technology vulnerabilities and CISA Known Exploited Vulnerabilities.

Ryan Clinton

Real Subdomain Finder

onescales/real-subdomain-finder

Discover every subdomain for any domain. Queries 40+ OSINT sources including cert transparency, DNS archives & web scanners. Results enriched with DNS validation, HTTP probing, and subdomain takeover detection. Simple Subdomain Lookup that works!

One Scales

5.0

Subdomain Finder - Discover Every Subdomain Of A Domain

thirdwatch/subdomain-finder

Discover every subdomain for any apex domain. Merges 4 sources: certificate transparency (crt.sh), HackerTarget, RapidDNS, plus DNS bruteforcing of common names. Verifies each is live via DNS + HTTP probe.

Thirdwatch

LinkedIn Scraper

sabania/linkedin-scraper

All-in-one LinkedIn scraper: profiles, jobs, posts, and companies. No cookies, no login required. Rich data: experience, skills, job descriptions, salary, reactions. Chrome TLS fingerprint + residential proxy. Lightweight HTTP-only, 256MB.

Arben Sabani

BuiltIn.com Tech Companies & Tech Stack Scraper

haketa/builtin-tech-companies-scraper

Scrape Built In company profiles — name, industry, location, recent jobs, full tech stack with category labels (LANGUAGES / FRAMEWORKS / DATABASES / etc.). Unique technology-fingerprint data for B2B SaaS prospecting, recruiter intel and competitive analysis. HTTP-only.