owasp-amass/amass
Reconnaissance framework that enumerates DNS, IP space, and web infrastructure to build a complete picture of a target's attack surface. Pulls data from passive sources, APIs, and active probing. Built for red teamers and pentesters who need systematic asset discovery before diving into testing.