All Search Engines
Public search engines by category.
Amass
In-depth Attack Surface Mapping and Asset Discovery.
assetfinder
Find domains and subdomains potentially related to a given domain.
BBOT
OSINT automation for hackers.
CCrawlDNS
This small utility retrieves from the CommonCrawl data set unique subdomains for a given domain name.
Cloudflair
A tool to find origin servers of websites protected by CloudFlare who are publicly exposed and don't restrict network access to the CloudFlare IP ranges as they should.
Crosslinked
Simplifies the processes of searching LinkedIn to collect valid employee names.
crt.sh
Certificate Search.
Dirhunt
Find web directories without bruteforce.
DNSdumpster
DNS recon & research, find & lookup DNS records
DNSrecon
DNS Enumeration and Scanning Tool.
Emailfinder
Search emails through Search Engines.
EMM OSINT Suite
European Commission Open Source Intelligence Suite .
FOCA
Is a tool used mainly to find metadata and hidden information in the documents its scans.
H8mail
An email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's Collection1 and the infamous Breach Compilation torrent.
Hakrevdns
Small, fast tool for performing reverse DNS lookups en masse.
ipinfo-cli
Official Command Line Interface for the IPinfo API (IP geolocation and other types of IP data). The trusted source for IP address data. Accurate IP address data that keeps pace with secure, specific, and forward-looking use cases.
L333tlinked
Modified version of CrossLinked.
Netcraft DNS
NetCraft DNS lookup, includes sub-domains.
OSINT Framework
OSINT framework focused on gathering information from free tools or resources.
Phonebook.cz
Phonebook lists all domains, email addresses, or URLs for the given input domain. Wildcards such as *.gov.uk are allowed. You are searching 20 billion records.
PowerMeta
PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches.
puredns
puredns description.
Pwndb
pwndb.py is a python command-line tool for searching leaked credentials using the Onion service with the same name.
Pymeta
Uses specially crafted search queries to identify and download the following file types (pdf, xls, xlsx, csv, doc, docx, ppt, pptx) from a given domain using Google and Bing scraping.
recon-ng
A full-featured reconnaissance framework designed with the goal of providing a powerful environment to conduct open source web-based reconnaissance quickly and thoroughly.
ReconFTW
reconftw description.
Securitytrails
Search Internet Assets Accurately & Instantly.
Sherlock
Hunt down social media accounts by username across social networks.
Shodan.io
Shodan is the world's first search engine for Internet-connected devices.
Socialscan
Command-line interface for checking email address and username usage on online platforms: GitHub, GitLab, Instagram, Lastfm, Pinterest, Reddit, Snapchat, Spotify, Twitter, Tumblr, Yahoo, Firefox.
SonarSearch Crobat
Crobat is a command line utility designed to allow easy querying of the Crobat API for DNS lookups.
SpiderFoot
SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.
Sublist3r
Python tool designed to enumerate subdomains of websites using OSINT.
theHarvester
theHarvester is used to gather open source intelligence (OSINT) on a company or domain.
Twofi
Twitter Words of Interest.