Open-source osint software
248 open-source libraries, tools and applications tagged osint, ranked by how closely osint is their primary purpose, then by adoption and maintenance health. Each entry links to a page with sources, use cases and when to choose or avoid it.
248 products, primary matches first, then adoption-weighted; health v2 shown.
| Product | Health v2 | Stars | Maturity |
|---|---|---|---|
| Sherlock Sherlock is a Python CLI tool that hunts down social media accounts by username across 400+ social networks. It is widely used for OSINT re… | 85 | 92935 | active |
| Z4nzu/hackingtool An all-in-one, menu-driven Python toolkit that aggregates 215 curated security testing tools across 21 categories such as recon, OSINT, web… | 73 | 80077 | active |
| mukul975/Anthropic-Cybersecurity-Skills A large open-source library of structured cybersecurity skills (Markdown files with YAML frontmatter) for AI coding agents, mapped to frame… | 73 | 33126 | active |
| qeeqbox/social-analyzer Social Analyzer is an OSINT tool available as a Web App, CLI, and API that finds and analyzes a person's profile across 1000+ social media … | 57 | 24114 | active |
| smicallef/spiderfoot SpiderFoot is an open-source OSINT automation tool that integrates with over 200 data sources to gather and analyze intelligence about targ… | 54 | 22608 | active |
| mxrch/GHunt GHunt is an offensive Google framework focused on OSINT, usable both as a CLI tool and as a Python library. It can gather information about… | 53 | 19586 | active |
| HunxByts/GhostTrack GhostTrack is a Python-based OSINT CLI tool for gathering information about IP addresses, phone numbers, and usernames across social media.… | 30 | 19087 | active |
| laramies/theHarvester theHarvester is a Python CLI tool that gathers open-source intelligence (emails, subdomains, hostnames, IPs, names, URLs, ASNs) about a dom… | 89 | 18003 | active |
| Amass OWASP Amass is a Go-based framework for in-depth attack surface mapping and external asset discovery using OSINT gathering and active recon… | 75 | 15211 | active |
| Holehe Holehe is an OSINT tool that checks whether an email address is registered on 120+ sites (Twitter, Instagram, Snapchat, etc.) by abusing th… | 32 | 14958 | active |
| Datalux/Osintgram Osintgram is a Python-based OSINT tool for Instagram that provides an interactive shell to collect and analyze information about Instagram … | 86 | 14936 | active |
| projectdiscovery/subfinder Subfinder is a fast, passive subdomain discovery tool written in Go that enumerates valid subdomains for target domains using online passiv… | 91 | 14500 | active |
| calesthio/Crucix Crucix is a self-hosted OSINT intelligence terminal that aggregates 27 open-source data feeds (satellite fire detection, flight tracking, r… | 49 | 12090 | active |
| 1N3/Sn1per Sn1per is an open-source automated penetration testing and attack surface management platform that chains reconnaissance, scanning, exploit… | 60 | 11373 | active |
| BigBodyCobain/Shadowbroker ShadowBroker is a self-hosted OSINT platform that aggregates 60+ real-time public intelligence feeds—aircraft, ships, satellites, CCTV, GPS… | 79 | 11325 | active |
| BBOT BBOT is a recursive, multipurpose internet scanner built in Python for automating OSINT reconnaissance, bug bounty hunting, and attack surf… | 97 | 10709 | active |
| shmilylty/OneForAll OneForAll is a powerful Python-based subdomain collection and enumeration tool for reconnaissance. It gathers subdomains via brute forcing,… | 56 | 10094 | active |
| p1ngul1n0/blackbird Blackbird is a Python CLI OSINT tool that searches for user accounts by username or email across 600+ social networks and platforms, levera… | 43 | 8982 | active |
| reconurge/flowsint Flowsint is an open-source, self-hosted OSINT platform for visual, graph-based investigations, providing entity relationship visualization … | 84 | 8937 | active |
| yogeshojha/rengine reNgine is a self-hosted automated web reconnaissance and vulnerability scanning framework with configurable recon engines, data correlatio… | 66 | 8869 | active |
| six2dez/reconftw reconFTW is an open-source (MIT) automated reconnaissance framework written in Shell that orchestrates 80+ security tools to perform full r… | 82 | 8155 | active |
| apurvsinghgautam/robin Robin is an AI-powered dark web OSINT investigation tool that uses LLMs to refine queries, filter results from dark web search engines, and… | 86 | 7440 | active |
| j3ssie/osmedeus Osmedeus is a security-focused declarative orchestration engine that lets users define reconnaissance and vulnerability-scanning pipelines … | 94 | 6602 | active |
| alpkeskin/mosint Mosint is an automated email OSINT tool written in Go that investigates target email addresses by consolidating multiple services. It check… | 23 | 6048 | active |
| Recon-ng Recon-ng is a full-featured, modular reconnaissance framework for conducting web-based open source intelligence (OSINT) gathering. It offer… | 76 | 6003 | active |
| kaifcodec/user-scanner A 2-in-1 Python CLI OSINT suite that performs email and username intelligence across 440+ scan vectors (170+ email sites, 270+ username pla… | 83 | 5425 | active |
| DedSecInside/TorBot TorBot is a Python CLI tool for OSINT on the dark web, crawling .onion sites over the Tor network and building link trees. It can save craw… | 95 | 5045 | active |
| IntelOwl IntelOwl is an open-source, self-hosted application for managing threat intelligence at scale, querying many online analyzers and malware a… | 93 | 4759 | active |
| arxhr007/Aliens_eye Aliens Eye is an AI-powered OSINT CLI tool that scans 840+ social media and web platforms to find accounts associated with a given username… | 99 | 4344 | active |
| Lucksi/Mr.Holmes Mr.Holmes is a Python-based OSINT (open-source intelligence) CLI tool that gathers information about usernames, domains, phone numbers, and… | 50 | 4314 | active |
| megadose/toutatis Toutatis is a Python CLI tool that extracts public information from Instagram accounts, such as emails, phone numbers, follower counts, and… | 32 | 4298 | active |
| jasonxtn/Argus Argus is a Python-based all-in-one information gathering and reconnaissance toolkit with an interactive console and modular architecture. I… | 44 | 4264 | active |
| sundowndev/phoneinfoga PhoneInfoga is an information gathering framework for scanning international phone numbers, built in Go. It collects basic data like countr… | 64 | 18004 | maintenance |
| alexandreborges/malwoverview Malwoverview is a Python command-line first-response tool for threat hunting that queries many threat intelligence sources such as VirusTot… | 97 | 4120 | active |
| snooppr/snoop Snoop is a Python-based OSINT CLI tool that searches for a given username/nickname across ~5400+ websites, with a focus on the CIS region. … | 70 | 4036 | active |
| leebaird/discover A collection of custom Bash and Python scripts that automate penetration testing tasks including reconnaissance, scanning, enumeration, and… | 77 | 3944 | active |
| Findomain/Findomain Findomain is a fast subdomain enumeration tool written in Rust that discovers subdomains via Certificate Transparency logs and APIs without… | 78 | 3793 | active |
| ibnaleem/gosearch GoSearch is a Go-based CLI OSINT tool that searches a username across 300+ websites to find a person's digital footprint, serving as a Sher… | 82 | 3775 | active |
| BloodHound Community Edition BloodHound Community Edition is a free, open-source application that uses graph theory to reveal hidden relationships and attack paths in A… | 91 | 3487 | active |
| opsdisk/pagodo pagodo is a Python CLI tool that automates passive Google dork searches by scraping the Google Hacking Database (GHDB) and running those qu… | 68 | 3412 | active |
| s0md3v/Photon Photon is a fast Python-based web crawler designed for OSINT (open-source intelligence) tasks. It extracts URLs, emails, social media accou… | 65 | 13243 | maintenance |
| projectdiscovery/uncover uncover is a Go CLI tool that queries multiple internet search engines (Shodan, Censys, FOFA, ZoomEye, and others) via their APIs to quickl… | 80 | 3064 | active |
| Alfredredbird/tookie-osint Tookie-OSINT is an open-source Python OSINT tool that finds social media accounts and gathers information based on user inputs. It offers a… | 81 | 3046 | active |
| v0id4real/Void-Tools Void-Tools is a Python terminal multitool with a Rich TUI dashboard bundling 150+ utilities for OSINT research, network diagnostics, and Di… | 51 | 2979 | active |
| xnl-h4ck3r/waymore waymore is a Python CLI tool that retrieves URLs from multiple web archive and intelligence sources (Wayback Machine, Common Crawl, Alien V… | 84 | 2762 | active |
| aboul3la/Sublist3r Sublist3r is a Python command-line tool that enumerates subdomains of a target domain using OSINT sources such as Google, Bing, Yahoo, Baid… | 23 | 11051 | maintenance |
| TermuxHackz/X-osint X-osint is an open-source Python-based OSINT framework for gathering information about phone numbers, email addresses, IP addresses, VINs, … | 69 | 2701 | active |
| samugit83/redamon RedAmon is an AI-powered agentic red team framework that automates offensive security operations end-to-end, chaining reconnaissance, explo… | 81 | 2681 | active |
| Moham3dRiahi/Th3inspector Th3inspector is an all-in-one Perl CLI tool for information gathering (OSINT reconnaissance). It bundles lookups such as website info, whoi… | 36 | 2668 | active |
| thewhiteh4t/pwnedOrNot pwnedOrNot is a Python command-line OSINT tool that checks email addresses against the HaveIBeenPwned v3 API for past breaches and then sea… | 62 | 2656 | active |
| musana/CF-Hero CF-Hero is a Go-based reconnaissance CLI tool that discovers the real origin IP addresses of Cloudflare-protected web applications. It aggr… | 63 | 2640 | active |
| kpcyrd/sn0int sn0int is a semi-automatic OSINT framework and package manager written in Rust that enumerates attack surface by processing public informat… | 66 | 2553 | active |
| h9zdev/WireTapper WireTapper is a wireless OSINT tool that passively detects and maps nearby radio-emitting devices such as Wi-Fi access points, Bluetooth de… | 56 | 2504 | active |
| hisxo/gitGraber gitGraber is a Python3 command-line tool that monitors GitHub search results in real time to find leaked sensitive data such as API keys an… | 62 | 2452 | active |
| NetSPI/MicroBurst MicroBurst is a PowerShell toolkit for assessing Microsoft Azure security, including service discovery, weak configuration auditing, and po… | 69 | 2442 | active |
| jofpin/trape Trape is an OSINT analysis and research tool for tracking people online and executing real-time social engineering attacks, built in Python… | 32 | 9055 | maintenance |
| spyboy-productions/CloakQuest3r CloakQuest3r is a Python-based open-source security research tool that identifies potential origin IP exposure of websites protected by Clo… | 52 | 2269 | active |
| kkbo8005/mitan Mitan (密探) is an all-in-one penetration testing and security assessment desktop application integrating asset mapping, subdomain brute-forc… | 92 | 2111 | active |
| AzizKpln/Moriarty-Project Moriarty Project is a web-based phone number investigation tool written in Python that gathers information about a given phone number. It a… | 65 | 2110 | active |
| hanc00l/nemo_go Nemo is an automated information-gathering platform for penetration testing that integrates common recon tools (Masscan, Nmap, Subfinder, H… | 82 | 2098 | active |
| megadose/ignorant Ignorant is a Python CLI tool and library that checks whether a phone number is registered on sites like Instagram, Snapchat, and Amazon wi… | 32 | 2070 | active |
| HackUnderway/SearchPhone SearchPhone is a Python CLI OSINT toolkit for investigating phone numbers across multiple sources, including Google (SerpAPI), DuckDuckGo, … | 63 | 2037 | active |
| nitefood/asn A Bash-based command-line tool and self-hostable server for looking up ASN, RPKI validity, BGP stats, IP prefixes, AS paths, IP reputation,… | 96 | 1936 | active |
| evildevill/instahack Instahack is a Bash and Python-based brute-force tool for testing Instagram account password strength, routing traffic through Tor for anon… | 59 | 1913 | active |
| bellingcat/octosuite Octosuite is a terminal-based toolkit for analyzing GitHub data, usable as an interactive TUI, a CLI, or a Python library. It queries user,… | 85 | 1895 | active |
| nsonaniya2010/SubDomainizer SubDomainizer is a Python CLI tool that discovers hidden subdomains and secrets in webpages, external JavaScript files, GitHub, and local f… | 65 | 1893 | active |
| initstring/linkedin2username A Python OSINT tool that scrapes LinkedIn employee lists for a target company and generates multiple probable username formats (e.g., first… | 70 | 1876 | active |
| ninoseki/mitaka Mitaka is a browser extension for Chrome and Firefox that simplifies OSINT (Open Source Intelligence) searches. It automatically detects an… | 91 | 1864 | active |
| iojw/socialscan socialscan is a Python library and CLI tool that checks whether usernames and email addresses are taken, available, or invalid across onlin… | 62 | 1856 | active |
| j3ssie/metabigor Metabigor is a Go-based command-line OSINT tool that maps a target's infrastructure—IP ranges, subdomains, related domains, open ports, and… | 80 | 1853 | active |
| unicodeveloper/globalthreatmap A real-time global threat and event intelligence map that plots security events, conflicts, military bases, and geopolitical developments o… | 53 | 1842 | active |
| pirxthepilot/wtfis wtfis is a Python command-line tool that performs passive lookups of hostnames, domains, and IP addresses using OSINT services like VirusTo… | 72 | 1836 | active |
| 1N3/BlackWidow BlackWidow is a Python-based web application spider that crawls a target site to collect URLs, dynamic parameters, subdomains, email addres… | 54 | 1824 | active |
| josh0xA/darkdump Darkdump is an open-source OSINT tool for querying multiple dark web search engines and scraping onion site results for emails, metadata, k… | 64 | 1798 | active |
| bellingcat/telegram-phone-number-checker A Python CLI tool by Bellingcat that checks whether phone numbers are registered with Telegram accounts, retrieving usernames, names, and I… | 81 | 1797 | active |
| IvanGlinkin/Fast-Google-Dorks-Scan A shell-based OSINT tool that automates Google dork searches against a target website to uncover admin panels, exposed file types, and path… | 43 | 1745 | active |
| utkusen/urlhunter urlhunter is a Go-based recon CLI tool that searches URLs exposed via shortener services like bit.ly and goo.gl. It downloads daily URLTeam… | 23 | 1701 | active |
| michenriksen/gitrob Gitrob is a Go-based reconnaissance tool that scans GitHub users' and organizations' public repositories for potentially sensitive files by… | 10 | 6198 | maintenance |
| 4lbH4cker/ALHacking ALHacking is a shell-script-based toolkit bundling a menu of so-called ethical hacking utilities, including social media account attacks, p… | 32 | 1648 | active |
| OpenOSINT/OpenOSINT OpenOSINT is an AI-powered OSINT framework offering 19 investigation tools behind a natural-language agent, usable as an interactive REPL, … | 79 | 1631 | active |
| michenriksen/aquatone Aquatone is a Go CLI tool for visual inspection of websites across many hosts, taking screenshots via headless Chrome/Chromium and generati… | 10 | 5962 | maintenance |
| m8sec/CrossLinked CrossLinked is a Python CLI tool that enumerates LinkedIn employee names for an organization by scraping search engine results, without nee… | 23 | 1611 | active |
| Clats97/ClatScope ClatScope Info Tool is a Python-based OSINT utility offering 70+ reconnaissance features including geolocation, DNS, WHOIS, phone, email, a… | 43 | 1598 | active |
| m3n0sd0n4ld/GooFuzz GooFuzz is a Bash-based CLI tool that performs fuzzing-style reconnaissance using advanced Google searches (Google Dorking) via the Google … | 50 | 1591 | active |
| jasperan/whatsapp-osint A Python CLI tool that uses Selenium to track when WhatsApp contacts go online/offline, logging presence sessions to SQLite. It exports dat… | 77 | 1580 | active |
| GONZOsint/geowifi A Python command-line tool that queries multiple public WiFi geolocation databases (Wigle, Apple, Google, Mylnikov, WiFiDB, Combain, Freifu… | 75 | 1514 | active |
| urbanadventurer/username-anarchy Username Anarchy is a Ruby command-line tool that generates lists of likely usernames from people's first and last names for use in penetra… | 23 | 1480 | stable |
| v4lkyr0/Buildware-Tools Buildware-Tools is a Python-based terminal multitool combining OSINT reconnaissance, network diagnostics, Discord automation, cryptography … | 73 | 1479 | active |
| khast3x/h8mail h8mail is a Python CLI tool for email OSINT and password breach hunting. It queries breach services like HaveIBeenPwned and Hunter.io, or s… | 23 | 5348 | maintenance |
| OUI-SPY Flock-You is ESP32-S3 firmware that turns a Seeed XIAO ESP32-S3 into a passive 2.4 GHz promiscuous-mode WiFi sniffer for detecting Flock su… | 61 | 1470 | active |
| momosecurity/FindSomething FindSomething is a passive browser extension for Chrome and Firefox that extracts potentially sensitive information (like emails, API keys,… | 32 | 1470 | active |
| tillson/git-hound GitHound is a Go-based CLI tool that hunts for exposed API keys, secrets, and credentials across all of GitHub using GitHub dorks, pattern … | 64 | 1468 | active |
| Flangvik/TeamFiltration TeamFiltration is a cross-platform penetration testing framework for enumerating, password spraying, exfiltrating data from, and backdoorin… | 51 | 1413 | active |
| superhedgy/AttackSurfaceMapper AttackSurfaceMapper is a Python CLI reconnaissance tool that expands a target's attack surface using OSINT and active techniques like subdo… | 32 | 1412 | active |
| fasnow/fine Fine is a Chinese-language cyberspace asset mapping and reconnaissance tool integrating FOFA, Hunter, Quake, ZoomEye, and Shodan APIs, plus… | 77 | 1383 | active |
| BullsEye0/shodan-eye Shodan Eye is a Python command-line tool that queries the Shodan search engine to collect information about all devices directly connected … | 76 | 1373 | active |
| mishakorzik/UserFinder UserFinder is a shell-based OSINT tool that searches for user profiles across social networks and other sites by username. It runs as a sim… | 52 | 1360 | active |
| sockysec/Telerecon Telerecon is a Python-based OSINT reconnaissance framework for researching and investigating Telegram. It scrapes user profiles, messages, … | 28 | 1331 | active |
| MrTuxx/SocialPwned SocialPwned is a Python-based OSINT tool that harvests emails published on Instagram, LinkedIn, and Twitter to find credential leaks via Pw… | 10 | 1324 | active |
| freelabz/secator secator is a task and workflow runner for security assessments that unifies dozens of well-known security tools (subfinder, httpx, ffuf, nm… | 94 | 1316 | active |
page 1 / 3 next →