KUMO
Open-source domain reconnaissance and OSINT framework that runs 26 parallel scanning modules against a target domain.
ToolVulnerability ManagementSelf-hosted, Open source
Pricing: Free (Open Source)
Reviewed by the Cyber Vendor Guide editorial team against the public sources cited below · Last reviewed July 2026 · How we review listings
What is KUMO?
KUMO is an open-source (MIT-licensed) domain reconnaissance and OSINT framework, run from the command line or a local web UI. Given a domain, it runs 26 parallel modules covering DNS enumeration, subdomain discovery (passive and active), port scanning across 70+ ports, SSL/TLS certificate inspection, HTTP security header grading, sensitive endpoint discovery, vulnerability checks (150+ built-in signatures, CVE matching), leaked-credential and breach-data lookups, and JavaScript secret scanning. It pulls from free OSINT sources (crt.sh, Shodan InternetDB, HaveIBeenPwned, Wayback Machine, AlienVault OTX, and others) out of the box, with optional paid API keys (Shodan, Censys, Chiasmodon) for deeper coverage.
Best for: Security researchers and pentesters who want fast, free domain reconnaissance from the command line.
Key Features
Do you work at KUMO? to confirm the details or send us a correction.
Add the Cyber Vendor Guide badge to your site
Sources & references
Where the information on this listing comes from. Always verify pricing and capabilities against the vendor before a purchasing decision.
Spot an error, or do you represent KUMO? Request a correction.
Key facts
- Pricing
- Free (Open Source)
- Model
- Open Source
- Cloud
- No
- Self-hosted
- Yes
- Open source
- Yes