Attack surface management tools that list what the internet already sees (2026)

The asset list said 40 names. The resolver had 90. ASM is inventory of what is already public. It is not a pentest. It is not a SIEM. We will not publish a scan cookbook against a host you do not own.

Six inventories. Two open toolkits. Two search engines. One enterprise ASM. One DNS history. Public docs. Not a bake-off.

Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.

1

OWASP Amass

Best for open enumeration you run on names you own

OWASP · Apache-2.0

Amass enumerates names. OWASP hosts it. Run it on domains you own.

Key features

• Passive and active modes they document
• Apache-2.0
• OWASP project
• You operate it

Why we like it

Hidden gem. A CMDB that cannot lose a name still needs a second opinion you can run.

Limits

Active modes are a change on the wire. Only against assets you own. This page is not a how-to against strangers.

2

ProjectDiscovery

Best for open toolkit for assets you own

ProjectDiscovery · MIT

httpx, subfinder, and neighbors. Use them on your estate. We will not list exploit-shaped workflows.

Key features

• Subfinder and httpx
• MIT on many repos
• You run them
• Cloud product exists too

Why we like it

The toolkit is how a lot of teams actually inventory. Honesty over a brochure.

Limits

Nuclei is a template runner. This page does not publish a payload pack. Stay on discovery.

3

Censys

Best for search engine on certificates and ports

Censys · commercial tiers

Censys indexes the public internet. You query. You do not scan the target from your laptop.

Key features

• Cert and port index
• Attack surface product
• API
• Tiers

Why we like it

A search engine is the safe first look at what is already public.

Limits

A hit is not permission to test. Licensing applies. We did not buy enterprise.

4

Shodan

Best for the search engine operators already know

Shodan · commercial tiers

Shodan is the known banner search. Same rule: query, do not attack.

Key features

• Banner index
• Filters
• API
• Tiers

Why we like it

Known shelf. A list without Shodan would lie.

Limits

Same legal line as Censys. Not a pentest platform.

5

Cortex Xpanse

Best for enterprise ASM shelf

Palo Alto · commercial

Xpanse is the known enterprise ASM. Discovers assets attributed to you, in their story.

Key features

• Attribution they sell
• Enterprise integrations
• Same Cortex family
• Commercial

Why we like it

Steering-committee shelf.

Limits

Commercial. We did not run it. Still not a pentest.

6

SecurityTrails

Best for dNS history on names you own

SecurityTrails · commercial tiers

SecurityTrails keeps DNS history. Useful when the forgotten name is in the past.

Key features

• Historical DNS
• API
• Tiers
• Passive

Why we like it

A current scan misses the name you deleted from the registrar last year but not from a CNAME.

Limits

Passive. Not a scanner. Pricing tiers.

What the internet thinks about ASM tools

Amass threads treat enumeration as homework on names you are allowed to map. This page stays on inventory. No third-party scan cookbook.

lmeyerov on Hacker News, Jul 2020: “We’ve had a lot of fun doing web inventory mapping via OWASP Amass.”

Prove Amass still ships Apache-2.0

Confirm Amass still publishes Apache-2.0. Run it only against a domain you own.

curl -fsS https://raw.githubusercontent.com/owasp-amass/amass/master/LICENSE | head -n 5

FAQs

Is ASM a pentest?

No. ASM lists what is visible. A pentest is a scoped test. Different door.

Can I scan a vendor?

Not from this page. Only assets you own or have written permission to test.

Does this replace the SIEM?

No. The SOC may consume the list. Detection is another pillar.

Is this a scored bake-off?

No. Order is editorial. No exploit replay.