diff --git a/src/arsenal/adapter-tools.ts b/src/arsenal/adapter-tools.ts
index 0b3029d..c76fec2 100644
--- a/src/arsenal/adapter-tools.ts
+++ b/src/arsenal/adapter-tools.ts
@@ -355,6 +355,41 @@ const ARG_TEMPLATES: Record<string, ArgTemplate> = {
     defaultTimeoutMs: 180_000,
     build: (target, params) => ['--json', scanPath(target, params)],
   },
+
+  // ── Recon / OSINT adapters (networked) ─────────────────────────────────────────────────────────
+  whatweb: {
+    targetParam: 'url',
+    defaultTimeoutMs: 60_000,
+    // JSON straight to stdout; --no-errors keeps a single unreachable host from aborting the run.
+    build: (target) => ['--log-json=-', '--no-errors', target],
+  },
+  wafw00f: {
+    targetParam: 'url',
+    defaultTimeoutMs: 60_000,
+    build: (target) => [target, '-a', '-f', 'json', '-o', '-'],
+  },
+  amass: {
+    targetParam: 'domain',
+    defaultTimeoutMs: 300_000,
+    // `enum` subcommand is required; -passive keeps it to OSINT sources (no active resolution/brute).
+    build: (target) => ['enum', '-passive', '-d', target],
+  },
+  dnsx: {
+    targetParam: 'domain',
+    defaultTimeoutMs: 120_000,
+    // dnsx takes the domain via -d (comma-sep/stdin), never a bare positional.
+    build: (target) => ['-d', target, '-a', '-aaaa', '-cname', '-resp', '-json', '-silent'],
+  },
+  'testssl.sh': {
+    targetParam: 'url',
+    defaultTimeoutMs: 300_000,
+    build: (target) => ['--quiet', '--color', '0', target],
+  },
+  waybackurls: {
+    targetParam: 'domain',
+    defaultTimeoutMs: 60_000,
+    build: (target) => [target],
+  },
 };
 
 /** Fallback for any mintable adapter without a bespoke template: pass the target as a positional arg. */
diff --git a/src/arsenal/catalog.ts b/src/arsenal/catalog.ts
index a04178b..5f7c89b 100644
--- a/src/arsenal/catalog.ts
+++ b/src/arsenal/catalog.ts
@@ -1126,6 +1126,102 @@ export const TOOL_ADAPTERS: ToolAdapter[] = [
     parserStatus: 'planned',
     notes: 'Local artifact classification and malware-family matching.',
   },
+  {
+    id: 'whatweb',
+    binary: 'whatweb',
+    name: 'WhatWeb',
+    category: 'web',
+    families: ['web_api', 'social_osint', 'reporting_remediation'],
+    risk: 'active',
+    execution: 'receipt_required',
+    networked: true,
+    evidenceKinds: ['technology_fingerprint', 'http_service'],
+    outputFormats: ['json', 'text'],
+    installHint: 'brew install whatweb  # or: gem install whatweb',
+    commandHint: 'whatweb --log-json=- https://example.com',
+    parserStatus: 'text',
+    notes: 'Web stack fingerprinting (CMS, framework, server) to seed targeted follow-up.',
+  },
+  {
+    id: 'wafw00f',
+    binary: 'wafw00f',
+    name: 'wafw00f',
+    category: 'web',
+    families: WEB_FAMILIES,
+    risk: 'passive',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['waf_fingerprint'],
+    outputFormats: ['json', 'text'],
+    installHint: 'pipx install wafw00f',
+    commandHint: 'wafw00f https://example.com -f json -o -',
+    parserStatus: 'text',
+    notes: 'Detects and fingerprints the WAF in front of a target so probes can be tuned or throttled.',
+  },
+  {
+    id: 'amass',
+    binary: 'amass',
+    name: 'OWASP Amass',
+    category: 'osint',
+    families: ['web_api', 'cloud_infra', 'social_osint'],
+    risk: 'passive',
+    execution: 'receipt_required',
+    networked: true,
+    evidenceKinds: ['subdomain', 'asn', 'dns_record'],
+    outputFormats: ['jsonl', 'text'],
+    installHint: 'brew install amass',
+    commandHint: 'amass enum -passive -d example.com',
+    parserStatus: 'text',
+    notes: 'Deep passive attack-surface mapping; complements subfinder with ASN and infra correlation.',
+  },
+  {
+    id: 'dnsx',
+    binary: 'dnsx',
+    name: 'dnsx',
+    category: 'dns',
+    families: ['web_api', 'cloud_infra', 'social_osint'],
+    risk: 'passive',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['dns_record', 'subdomain'],
+    outputFormats: ['jsonl', 'text'],
+    installHint: 'brew install projectdiscovery/tap/dnsx',
+    commandHint: 'dnsx -d example.com -a -aaaa -cname -resp -json',
+    parserStatus: 'text',
+    notes: 'Fast DNS resolution/validation to confirm live records from discovered candidate hosts.',
+  },
+  {
+    id: 'testssl',
+    binary: 'testssl.sh',
+    name: 'testssl.sh',
+    category: 'crypto',
+    families: ['web_api', 'crypto_secrets', 'reporting_remediation'],
+    risk: 'active',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['tls_config', 'cipher_weakness', 'certificate_finding'],
+    outputFormats: ['json', 'text'],
+    installHint: 'brew install testssl',
+    commandHint: 'testssl.sh --jsonfile-pretty - https://example.com:443',
+    parserStatus: 'text',
+    notes: 'TLS/SSL posture check (protocols, ciphers, cert, known CVEs) against an authorized endpoint.',
+  },
+  {
+    id: 'waybackurls',
+    binary: 'waybackurls',
+    name: 'waybackurls',
+    category: 'osint',
+    families: ['web_api', 'social_osint', 'reporting_remediation'],
+    risk: 'passive',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['historical_url', 'endpoint'],
+    outputFormats: ['text'],
+    installHint: 'go install github.com/tomnomnom/waybackurls@latest',
+    commandHint: 'waybackurls example.com',
+    parserStatus: 'text',
+    notes: 'Pulls historical URLs from the Wayback Machine to surface forgotten endpoints and parameters.',
+  },
 ];
 
 export const SAFE_COMMANDS = [