#OSINT

Public search engines by category.

Go CLI and Library for quickly mapping organization network ranges using ASN information.

You can use this subcommand in order to interact with an Amass graph database, either the default or the one specified with the '-dir' flag.

In-depth Attack Surface Mapping and Asset Discovery.

dnsx is a fast and multi-purpose DNS toolkit allow to run multiple probes using retryabledns library.

Amass enum allows you to perform DNS enumeration and mapping of the target to determine the attack surface exposed by organizations.

Find domains and subdomains potentially related to a given domain.

httpx is a fast and multi-purpose HTTP toolkit that allows running multiple probes using the retryablehttp library.

The Amass intel subcommand, or module if you want, can aid with collecting open source intelligence on the organization and allow you to find further root domain names associated with the organization.

OSINT automation for hackers.

This small utility retrieves from the CommonCrawl data set unique subdomains for a given domain name.

A tool to find origin servers of websites protected by CloudFlare who are publicly exposed and don't restrict network access to the CloudFlare IP ranges as they should.

Subfinder is a subdomain discovery tool that discovers subdomains for websites by using passive online sources.

Certificate Search.

Open Source Intelligence.

Find web directories without bruteforce.

DNS recon & research, find & lookup DNS records

DNS Enumeration and Scanning Tool.

Search emails through Search Engines.

European Commission Open Source Intelligence Suite .

Is a tool used mainly to find metadata and hidden information in the documents its scans.

An email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's Collection1 and the infamous Breach Compilation torrent.

Small, fast tool for performing reverse DNS lookups en masse.

Official Command Line Interface for the IPinfo API (IP geolocation and other types of IP data). The trusted source for IP address data. Accurate IP address data that keeps pace with secure, specific, and forward-looking use cases.

NetCraft DNS lookup, includes sub-domains.

OSINT framework focused on gathering information from free tools or resources.

Phonebook lists all domains, email addresses, or URLs for the given input domain. Wildcards such as *.gov.uk are allowed. You are searching 20 billion records.

PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches.

puredns description.

pwndb.py is a python command-line tool for searching leaked credentials using the Onion service with the same name.

Uses specially crafted search queries to identify and download the following file types (pdf, xls, xlsx, csv, doc, docx, ppt, pptx) from a given domain using Google and Bing scraping.

A full-featured reconnaissance framework designed with the goal of providing a powerful environment to conduct open source web-based reconnaissance quickly and thoroughly.

reconftw description.

Search Internet Assets Accurately & Instantly.

Hunt down social media accounts by username across social networks.

Shodan is the world's first search engine for Internet-connected devices.

Command-line interface for checking email address and username usage on online platforms: GitHub, GitLab, Instagram, Lastfm, Pinterest, Reddit, Snapchat, Spotify, Twitter, Tumblr, Yahoo, Firefox.

Crobat is a command line utility designed to allow easy querying of the Crobat API for DNS lookups.

SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.

Python tool designed to enumerate subdomains of websites using OSINT.

theHarvester is used to gather open source intelligence (OSINT) on a company or domain.

Twitter Words of Interest.

DNS lookup utility.