Pius banner
praetorian-inc praetorian-inc

Pius

Development community

Description

Organizational asset discovery tool with 20+ plugins covering certificate transparency, passive DNS, and all 5 Regional Internet Registries.

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

README

Pius - Open-source attack surface discovery and OSINT reconnaissance tool for enumerating domains, subdomains, and IP ranges

Pius - Attack Surface Discovery & OSINT Reconnaissance Tool

Discover domains, subdomains, and IP ranges (CIDRs) owned by any organization using certificate transparency, RIR registries, passive DNS, and 24 extensible plugins.

[![CI](https://github.com/praetorian-inc/pius/actions/workflows/ci.yaml/badge.svg)](https://github.com/praetorian-inc/pius/actions/workflows/ci.yaml) [![Go Version](https://img.shields.io/github/go-mod/go-version/praetorian-inc/pius)](go.mod) [![License](https://img.shields.io/github/license/praetorian-inc/pius)](LICENSE) [![Go Report Card](https://goreportcard.com/badge/github.com/praetorian-inc/pius)](https://goreportcard.com/report/github.com/praetorian-inc/pius) [![GitHub Release](https://img.shields.io/github/v/release/praetorian-inc/pius?include_prereleases&sort=semver)](https://github.com/praetorian-inc/pius/releases)

**Pius** is an open-source attack surface discovery tool written in Go. Given a company name, it maps the complete external attack surface: domains, subdomains, and IP ranges (CIDRs). Pius queries certificate transparency logs, all five regional Internet registries (ARIN, RIPE, APNIC, AFRINIC, LACNIC), passive DNS databases, WHOIS/RDAP, BGP tables, and more through 24 discovery plugins.

Built for penetration testers, bug bounty hunters, and security teams who need reliable, repeatable asset discovery. Unlike ad-hoc reconnaissance scripts, Pius is production-grade: concurrent plugin execution, a three-phase discovery pipeline, multi-tier caching, confidence scoring for ambiguous results, graceful degradation, and passive-first OSINT defaults.

Table of Contents