Network & IP
The full reference for domains, DNS, IP infrastructure, routing, certificates, geolocation, and the command builders — tool by tool, with inputs, outputs, and data source.
This category maps the infrastructure behind a domain or address: where it lives, how it routes, what names point at it, and how its certificates and transport are set up. It's the largest category in the library, so it's split into sub-groups below.
| Tool | Input | Returns | Data source |
|---|---|---|---|
| DNS Lookup | Domain, record type (A/AAAA/MX/NS/TXT/CNAME/SOA/CAA/TLSA/ALL) | The requested records, plus SPF/DMARC/DKIM checks, DNSSEC status, TTLs, and a Cloudflare-vs-Google cross-resolver diff | Network |
| DNS History | Domain | Passive/historical DNS resolutions on record for the domain | Network |
| Reverse DNS | IP address | The PTR record, forward-confirmed (FCrDNS) against the name it resolves back to | Network |
| Mail Auth | A pasted SPF, DMARC, or DKIM record | A field-by-field breakdown of what the record actually enforces | Local |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| WHOIS | Domain or IP | RDAP lookup (JSON), falling back to classic WHOIS — registrar, key dates, and published contacts | Network |
| Cert by Org/Email | Organisation name or email | Certificates issued to it, mined from Certificate Transparency logs | Network |
| Cert Parser | A certificate you already have (PEM/DER) | Its fields decoded — subject, issuer, SANs, validity, key info — without contacting anything | Local |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| ASN Lookup | IP, AS<number>, or a bare number | The announcing ASN and its routed prefixes | Network |
| BGP Intel | IP, ASN, or domain | Who is responsible for the network and how an abuse report reaches them | Network |
| Internet DB | IP address | Exposed services and known CVEs on the host, via Shodan's free InternetDB | Network |
| IP Reputation | IP address | A check against five free threat-intel feeds in one pass | Network |
| MAC OUI Lookup | MAC address | The hardware vendor, from the IEEE registry | Network |
| VPN Detector | — (inspects this machine) | Installed/running VPN clients detected on the local host | Local |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| Subdomain Enum | Base domain, wordlist size, concurrency, optional CT-log seeding | Resolved subdomains from a wordlist run against the base domain | Network |
| CT Subdomain | Domain | Subdomains mined from Certificate Transparency logs (crt.sh) | Network |
| Subdomain Takeover | Subdomain(s) | Whether a CNAME points at an unclaimed provider resource — a takeover risk flag per name | Live (resolves the target) |
| Subdomain Wordlist Generator | Seeds, affixes, options | A targeted wordlist for subdomain enumeration, built from the seeds you give it | Local |
| Bucket Finder | A name (company, product) | Cloud storage buckets matching it, and which are open | Live |
| Typosquat Finder | Domain | Typosquat candidate domains generated across 12 algorithms, optionally checked for registration | Mixed |
| Tool | Input | Returns | Data source |
|---|---|---|---|
| CIDR Calculator | A CIDR block (or a host address inside one) | Network/broadcast addresses, mask, host count, and range, normalized | Local |
| CIDR Aggregator | A list of addresses/blocks | The fewest CIDRs that cover them all | Local |
| IP in CIDR | An IP and one or more blocks | Whether the address falls inside each block | Local |
| IP Range Expander | A CIDR block or a dashed IPv4 range | Every individual address in the range | Local |
| IP Deobfuscator | An obfuscated IPv4 (decimal, hex, octal, etc.) | The normal dotted-quad form | Local |
| IPv6 Analyzer | IPv6 address | Its type, scope, and de-obfuscated form, classified offline | Local |
| IP Geolocation | IPv4 or IPv6 address | Approximate location and network details, via ip-api.com | Network |
| TLS Inspector | Host:port | The negotiated TLS version, cipher, and certificate chain from a real handshake, with optional alt-port probing | Mixed — contacts the target directly |
| Port Reference | A port number | The service conventionally bound to it, with related script/CVE notes, from a bundled offline reference | Local |
Chronolocation and geo-OSINT tools for placing a photo, coordinate, or clue set on the map.
| Tool | Input | Returns | Data source |
|---|---|---|---|
| Coord Convert | A coordinate | Converts between decimal, DMS, and DDM | Local |
| Geohash | A coordinate or a geohash string | Converts either direction | Local |
| Plus Code | A coordinate or a Plus Code (Open Location Code) | Converts either direction | Local |
| Geo Map View | Lat/lon/label data (CSV or JSON) | A structured pin list ready to plot | Live |
| Geo Clue Matcher | A set of observed visual clues (writing system, driving side, plate style, etc.) | Countries ranked by how well the clues match | Local |
| Geo Meta Reference | A description of a visual cue | Curated geographic reference cues (infrastructure, signage, landmarks) it matches | Local |
| Sun Position | A place and time | Sun position for offline chronolocation — estimating time-of-day from shadows in an image | Local |
| Horizon Matcher | A photograph and a search bounding box | Candidate vantage points, by matching the photo's skyline against terrain in the box | Mixed |
| OSM Feature Finder | A bounding box, an anchor feature, optional secondary features | Matching OpenStreetMap features inside the box | Network |
| Commons Geo Search | A coordinate or place name | Free-licensed images near it, from Wikimedia Commons | Network |
These don't look anything up themselves — they compose a correctly formed command line or query for you to run in your own environment. All local: building a command line makes no request of its own.
| Tool | Input | Returns |
|---|---|---|
| Nmap Builder | Target(s), scan type, timing, script, and output options | A ready nmap command line |
| Gobuster Builder | Target, mode, wordlist, and scan options | A ready gobuster command line |
| Sqlmap Builder | Target, request details, injection and technique options | A ready sqlmap command line |
| Sublister Builder | Domain and enumeration options | A ready subdomain-enumeration command line |
| Shodan Query Builder | Filters — port, hostname, org, product, and more | A composed Shodan search query and ready search URL |
| Google Dorks Builder | Operators (site, filetype, intitle, inurl, and more) | A composed Google dork query and ready search URL |