Everything the team reaches for — CTF, red team, blue team, OSINT, forensics, wireless and living-off-the-land, plus the one-liners we retype every engagement. Search, filter by tag, and click any code block to copy it.
Search engine for Tor hidden services that filters out abuse content, one of the few indexing engines that actually crawls .onion sites in a structured way.
OWASP in-depth attack-surface mapping tool: DNS enumeration, subdomain discovery via dozens of passive sources, and network-mapping graph output.
amass enum -passive -d example.com -o subdomains.txt
Extracts every thumbnail and the exact upload timestamp from a YouTube video, used to verify when a video was actually first published.
On-demand webpage archiving service that snapshots a page instantly, useful for preserving content that blocks the Wayback Machine's crawler or that changes quickly.
Small Go tool that finds domains and subdomains related to a given domain from a handful of free sources — a lightweight complement to heavier enumerators.
assetfinder --subs-only example.com
Bellingcat's public, community-maintained spreadsheet of OSINT tools and resources spanning geolocation, archives, social media and satellite imagery, used in their open-source investigations.
An internet-wide scanning platform and search engine similar in purpose to Shodan/Censys — exposed services, vulnerabilities and threat intelligence indexed from continuous global scans.
Free breach-data search engine with hash-based password lookups alongside email and username exposure checks.
Web technology profiler — identifies the CMS, analytics, ad networks, frameworks and hosting stack behind a site, plus historical technology-adoption lookups.
Email OSINT tool that checks an address against breach data, social-media registration and domain information in one pass.
buster -e [email protected] -b
Quick lookup tool for a page's Google cache and Wayback Machine snapshot from one search box, useful when a page has just gone offline or been edited.
An internet-wide device and certificate search engine built from continuous internet scanning — heavily used for attack-surface discovery and certificate-based host enumeration.
Dataset and API of continuously-crawled subdomain data for public bug-bounty-in-scope domains, maintained by ProjectDiscovery and queryable via their CLI.
chaos -d example.com -silent
Queries Have I Been Pwned's Pwned Passwords range API with only a 5-character SHA-1 prefix, so the full password/hash never leaves your machine, and greps the response for the suffix.
hash=$(printf %s 'password123' | sha1sum | tr 'a-z' 'A-Z' | cut -c1-40)
curl -s "https://api.pwnedpasswords.com/range/${hash:0:5}" | grep -i "${hash:5}"
The UK's official company registry — filings, officers, ownership and accounts for every UK-registered company, free to search and download.
Free US business and officer relationship search, useful for mapping which people sit on multiple company registrations.
Geolocation OSINT tool that aggregates geotagged social-media posts for a target into a mapped timeline, a historically significant project in this space.
Threat-intel-flavoured internet asset search engine combining Shodan-like banner search with IP risk scoring, phishing/malicious-URL lookups and domain intel.
Enumerates a company's LinkedIn employees via search-engine scraping (no LinkedIn login needed) and outputs plausible email addresses from the naming pattern.
python3 crosslinked.py -f "{first}.{last}@example.com" example.com
A free, searchable front-end over Certificate Transparency logs — the fastest way to enumerate every subdomain that has ever had a public TLS certificate issued for it.
curl -s 'https://crt.sh/?q=%.target.tld&output=json' | jq -r '.[].name_value' | sort -u
Certificate transparency search engine indexing CT logs for domain and subdomain discovery, with a faster/more filterable UI than crt.sh for large result sets.
Common User Passwords Profiler — interviews you about a target's personal details (name, pet, birthdate) and generates a targeted candidate password list from the answers.
cupp -i
OSINT framework that aggregates information about domains, emails, usernames and phone numbers from multiple public sources into one report.
Paid breach-data search engine indexing leaked credential dumps, searchable by email, username, IP, name or password hash — used for credential-exposure investigations.
Free web-based domain research tool that maps a domain's DNS records, subdomains and hosting relationships, with a graphical network map.
Reverse-lookup service for Google Analytics/AdSense IDs, nameservers and shared IPs — surfaces other domains run by the same operator even when WHOIS is hidden.
Generates and checks likely typosquatted, homoglyph and bit-flipped variations of a domain name — the standard tool for detecting phishing/brand-impersonation domains registered against a company before a takedown is needed.
dnstwist --registered example.com
WHOIS lookup and historical WHOIS record database, widely used for domain ownership research and infrastructure attribution even after WHOIS privacy became the default.
Runs a set of search-engine dork queries and feeds the resulting URLs into a scanning module, chaining discovery and light vulnerability checks in one tool.
dorkbot -i google -q "inurl:admin" -s xss_scanner
Lists historical URLs archived under a domain via the CDX API, useful for finding old parameters, endpoints or files that were later removed from the live site.
curl -s "http://web.archive.org/cdx/search/cdx?url=*.example.com/*&output=text&fl=original&collapse=urlkey"
Pulls every certificate-transparency-logged hostname for a domain straight from crt.sh's JSON API, no browser needed.
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r ".[].name_value" | sort -u
Email OSINT tool that checks a target address against Google, Skype, Amazon and other services to reveal linked account names, profile photos and registration status.
Reads, writes and edits metadata across an enormous range of file formats — the standard tool for pulling (or stripping) EXIF, GPS and authorship data out of files.
exiftool suspicious.jpg
Free genealogy-oriented people search that surfaces relatives, associates and address history from public genealogical and property records.
Free US people-search aggregator similar in scope to TruePeopleSearch, drawing on the same class of public-record data brokers.
Internet asset search engine (Huawei/Baimaohui-affiliated) with its own query syntax for finding hosts by banner, title, certificate or icon hash.
Browser-based image forensics toolkit (29a.ch) offering ELA, clone detection, noise analysis and metadata extraction without uploading the image anywhere.
Error Level Analysis and metadata forensics for a submitted photo, used to spot edited/composited regions and inconsistent compression history.
Fetches known URLs for a domain from the Wayback Machine, Common Crawl, AlienVault OTX and urlscan.io — a broader net than waybackurls alone.
echo target.tld | gau
AI-assisted geolocation tool that estimates where a photo was taken from visual cues alone (terrain, signage, architecture) — a modern automation of manual geolocation OSINT.
Google account OSINT tool that resolves a Gmail address to its Google ID, name, profile photo and exposure across Google services (Maps reviews, calendar, photos).
ghunt email [email protected]
Scan a git repository's full history for accidentally committed secrets (API keys, tokens, credentials) rather than just the current checkout.
pip install trufflehog3 trufflehog3 https://github.com/org/repo.git # or the Go rewrite, scanning a local clone including history: trufflehog git file://./repo
Global registry of Legal Entity Identifiers, ties a company name to a verified, internationally standardised legal identity record.
Free monitoring service that emails you whenever a new page matching a search term is indexed, used for ongoing passive monitoring of a target or brand.
Exploit-DB's long-running, categorised archive of Google dorks for finding exposed files, login portals, error messages and vulnerable systems via search-engine indexing.
Fast full-text code search engine across half a million public Git repositories, useful for finding leaked secrets, specific library usage or vulnerable code patterns at scale.
Email OSINT and breach-hunting tool that aggregates results from Have I Been Pwned, breach-directory APIs and local dump files against a target address.
h8mail -t [email protected]
Troy Hunt's free breach-notification service — checks whether an email or password has appeared in a known data breach, with a domain-level API for organisations.
CLI tool that checks whether an email address is registered on 120+ websites (via password-reset/registration timing leaks), without ever notifying the target.
holehe [email protected]
Fast, multi-purpose HTTP toolkit for probing a large list of hosts/subdomains — status codes, titles, tech fingerprints and TLS data — as a recon pipeline stage.
cat subs.txt | httpx -title -tech-detect -status-code
Finds and verifies professional email addresses tied to a domain, including the naming pattern a company uses — a staple for recon during phishing-simulation and social-engineering engagements.
Searchable database of entities named in the ICIJ's cross-border investigations (Panama Papers, Paradise Papers, Pandora Papers and others).
Free people- and username-search engine that aggregates social profiles, images and public records for a name or handle into one results page.
Checks whether a phone number is registered on services such as Instagram, Snapchat and Amazon by abusing account-recovery flows, without alerting the target.
ignorant 33 612345678
Gathers email account information (source, validity, associated hostname) from public search engines and PGP key servers for a target domain.
python3 infoga.py --domain example.com --source all -v 2
Directory of publicly reachable IP cameras with no or default authentication, browsable by country and manufacturer — an oft-cited example of what exposed device search finds.
Search engine and data archive covering leaks, breaches, darknet content, WHOIS history and document dumps, searchable by selector (email, domain, IP, hash, Bitcoin address).
A companion search-tool page (distinct from the methodology site above) that auto-builds search-engine and social-media queries for a target across many services from one form.
Full-text search across the Internet Archive's millions of archived books, documents and software — distinct from the Wayback Machine's URL-based page snapshots.
Browser-extension verification toolkit for images and video: keyframe extraction, reverse image search shortcuts and metadata inspection in one panel.
Long-running EXIF/GPS metadata viewer for an image URL or upload — a quick, no-signup way to check what a photo leaks before ExifTool is available.
Gathers and visualises passive intelligence about a set of IP addresses (geolocation, org, historical activity) without touching the hosts themselves.
Builds interactive maps and screenshot galleries of internet-connected cameras and ICS devices discovered via internet scan-search-engine APIs.
Breach-data search engine checking whether an email, username or password has surfaced in a known leak, with a public API for programmatic checks.
Open-data search engine that indexes misconfigured/exposed services and leaked data found on the public internet, including open databases and plaintext credential leaks.
Crowd-sourced database mapping relationships between powerful people, companies and organisations — board seats, donations, family ties.
Username OSINT tool that collects a person's accounts across thousands of sites and can generate an HTML/PDF report, going further than a simple existence check by pulling profile data.
maigret target_username --html
A graphical link-analysis platform for OSINT — runs "transforms" against an entity (domain, email, person) and draws the results as an explorable graph rather than a flat list.
Crowd-sourced street-level imagery platform, used in geolocation OSINT to visually corroborate a building, sign or landmark against a claimed location.
Browser-based metadata viewer for images, office documents, audio and video — a quick no-install alternative when ExifTool isn't available on the box you're using.
Extracts metadata (author names, software versions, paths) from public documents discovered via search engines for a target domain.
metagoofil -d example.com -t pdf,doc,xls -l 50 -n 20 -o results -f results.html
Search engine that lets you strip out the top N most popular results, surfacing the obscure long tail a normal search buries — handy in dorking when the top results are all noise.
Web service that checks username and domain availability across a large set of social networks and platforms simultaneously.
Internet-scanning search engine covering hosts, domains, certificates and WHOIS, positioned as a cheaper alternative to Shodan/Censys with a similar dork syntax.
Fast asynchronous username-existence checker that verifies a handle across a large curated site list, positioned as a quicker alternative to sequential checkers.
nexfil -u target_username
Cross-border investigative search engine over leaked documents, corporate registries and sanctions data, built by the Organized Crime and Corruption Reporting Project.
Scrapes multiple dark-web search engines at once for a search term and consolidates the .onion results into one list.
onionsearch --search "keyword" --output results.txt
Cyber defense search engine that collects internet-wide scan, passive DNS and threat data and exposes it via a query language and API for attack-surface discovery.
The largest open database of company registration records worldwide, aggregating official company-registry data from dozens of jurisdictions.
Consolidated, searchable database of global sanctions lists, politically exposed persons and watchlists, free for non-commercial use.
Not a tool but a curated, clickable index of OSINT tools and resources organised by category — the map most people start from before they know which specific tool they need.
Michael Bazzell's long-running OSINT resource site, companion to the "OSINT Techniques" book, with categorised tool links and methodology notes kept current as sites change.
OSINT tool for gathering information (followers, tagged photos, comments, likely-related accounts) from a public Instagram profile.
osintgram target_username
Query tool for raw OpenStreetMap data — e.g. find every building matching a roof shape or every fuel station within a radius, useful for geolocation candidates.
Automates passive Google Hacking Database dork queries against a target domain and saves the matching results, rather than running each dork by hand.
python3 pagodo.py -d example.com -g dorks.txt -l 100 -s
Mines URLs with parameters straight out of the Wayback Machine for a target domain — a fast way to build an attack surface list without touching the live site at all.
paramspider -d target.tld
Search-engine dork pattern for finding leaked credentials or source snippets accidentally posted to public paste sites for a target domain.
site:pastebin.com "example.com" (password OR api_key OR secret) # repeat against site:ghostbin.com, site:paste.ee, site:rentry.co for broader paste-site coverage
Renders the mountain skyline visible from any point on Earth and names each peak, used to geolocate a photo by matching its visible ridgeline.
Phone-number OSINT tool that gathers carrier, line type and geolocation data, then cross-references OSINT sources and search-engine footprints for a number.
phoneinfoga scan -n "+15551234567"
Fast OSINT-focused web crawler that extracts URLs, emails, social-media handles, subdomains and files (with metadata) from a target site as it crawls.
python3 photon.py -u https://example.com -l 3 --wayback
Facial-recognition reverse image search that finds other photos of the same face across the indexed web — widely used and widely criticised; know your legal/ethical footing before using it on a person.
Commercial people-search API aggregating public records, social profiles and contact data for identity-resolution and investigative use cases.
Searchable archive of pastebin.com dumps going back years, letting you search historical paste content by keyword after the original paste has been deleted.
Source-code search engine that lets you grep the indexed web for a snippet — a tracking ID, a JS library string or a signature left by a specific web shell/skimmer.
People-search and public-records aggregator producing background-check-style profiles from court, property and social data.
A full reconnaissance framework with a Metasploit-like module system — dozens of OSINT modules for domains, hosts, contacts and credentials, chained through one console.
Finds netblocks and ASNs registered to a company name before subdomain enumeration even starts, using Amass's intel gathering rather than its enum mode.
amass intel -org "Example Inc"
Free tier of Microsoft's threat-intel platform (formerly RiskIQ PassiveTotal) offering passive DNS, WHOIS history and certificate data for infrastructure investigations.
Self-hostable, privacy-respecting metasearch engine that aggregates results from many search backends without tracking the querier — useful for dorking without one engine seeing every query.
Searches the full text of every filing submitted to the US SEC (10-K, 8-K, proxy statements, etc), useful for corporate due-diligence and executive research.
Historical and current DNS/WHOIS intelligence platform — passive DNS history, IP neighbor lists and subdomain data, popular for infrastructure attribution.
Hunts for a given username across hundreds of social media and web platforms at once, reporting back exactly where an account with that handle exists.
sherlock username
Username/email OSINT tool searching hundreds of sites in parallel with browser-based verification, aiming for fewer false positives than a plain HTTP-status username checker.
blackbird -u target_username
The original internet-wide device search engine — indexes banners from scanning the whole IPv4 space, so you can search for exposed services, devices and misconfigurations by product, port or CVE.
shodan search "apache" country:DK
Shodan's own reference for its search filter syntax (product, port, org, ssl.cert, etc.) — essential for turning a vague "find exposed X" into a precise query.
OSINT scraping framework that aggregates public-record and people-search sites (courts, social media, phone directories) against a target name.
skiptracer -m full -q "Jane Doe"
Semi-automated OSINT framework and local recon database for correlating people, phone numbers, domains and subdomains across a long-running investigation.
sn0int
Subscription database-breach search engine used in credential and account-exposure investigations, searchable by email, username, IP or password hash.
API/CLI/web tool that analyzes and finds a person's profiles across 1000+ social platforms, using detection modules beyond simple username-exists checks.
python3 app.py --username johndoe --metadata --output web
Reverse search service built for verifying an online identity — cross-references a photo, email, phone or username to flag likely catfishing/romance-scam profiles.
An OSINT automation engine — point it at a domain, IP, email or name and it fans out across 200+ data-source modules to map the external attack surface and threat exposure.
spiderfoot -s target.tld -u all
An automation engine for OSINT, but used heavily on the offensive side too: point it at a domain and it fans out across dozens of data sources to map the whole external attack surface.
spiderfoot -s target.tld -u all
US people-search aggregator pulling address history, relatives, phone numbers and social profiles from public records into one profile.
Privacy-focused search engine that proxies Google's index without forwarding the searcher's identity to Google, useful for dorking without linking queries to an account.
ProjectDiscovery's fast passive subdomain enumeration tool, pulling from dozens of public sources and APIs; built to pipe cleanly into the rest of their toolchain.
subfinder -d example.com -all -o subs.txt
Sun position/shadow-length calculator for any place and date, used in manual image geolocation to narrow down time-of-day and time-of-year from shadows in a photo.
Free web-mention monitoring service similar to Google Alerts, useful as a second source since the two crawl and rank differently.
Free reverse phone, address and email lookup service pulling matches from US public records.
Gathers emails, subdomains, hosts and employee names for a target domain from a wide range of public sources — usually the first command run in the OSINT phase of an engagement.
theHarvester -d target.tld -b all
Full-featured web reconnaissance framework with a modular, Metasploit-style console — API-backed modules for domains, hosts, contacts and credentials pulled into one workspace.
recon-ng -w workspace
One of the oldest reverse image search engines, strong at tracing where an image first appeared online and how it has been reused since.
Resolves an Instagram username or numeric user ID to hashed email, hashed phone number and account-creation date via the platform's own API responses.
toutatis -u target_username
Kali-based virtual machine pre-loaded with the OSINT tooling Trace Labs uses in its missing-persons CTFs, a ready-made environment rather than a single tool.
Free US people-search site returning address history, phone numbers and named relatives from public records without a paywall.
Advanced Twitter/X scraping tool that historically worked without API keys or rate limits; the project is archived/broken against the current X platform but still referenced in OSINT methodology write-ups.
Checks a website's reputation against multiple blacklist and reputation engines at once, a quick sanity check before visiting an unfamiliar link.
Free suite of small DNS/network lookup tools — reverse WHOIS, reverse IP, DNS history, port scan — useful when you need one quick answer without standing up your own tooling.
Browser extension and API that fingerprints the technology stack of a website (CMS, JS frameworks, server software, analytics) from passive page signals.
Internet Archive's historical web snapshot service — recovers deleted pages, old site structure, past staff/contact pages and prior versions of JS/robots.txt for recon.
Pulls every URL the Wayback Machine has ever archived for a domain — a quick, passive way to surface old endpoints, parameters and forgotten paths that are still live.
echo target.tld | waybackurls
Username-enumeration project (web UI and open JSON data set) that checks a handle across hundreds of sites, maintained as a community-curated alternative to Sherlock's site list.
CLI website fingerprinting tool with 1800+ plugins identifying CMS, JS libraries, web servers and embedded devices from HTTP responses.
whatweb -a 3 https://example.com
Crowd-sourced database and search engine of wireless networks (Wi-Fi, Bluetooth, cellular) mapped by GPS location, built from years of wardriving submissions.
User-annotated satellite map where buildings and points of interest carry free-text descriptions, useful for identifying an unnamed structure in a photo.
Reverse image search engine with notably better face and landmark matching than Google/Bing for OSINT work, especially outside the US/EU.
Free US people-search engine returning addresses and phone numbers, one of the older sites in this space and still commonly cited in OSINT methodology.
Chinese-run internet device/service search engine indexing banners, ports and web components, comparable in scope to Shodan/Censys with different vantage points.