CLI
Tools that are operated from a command-line interface rather than a graphical app.
Amass
In-depth attack-surface mapping and asset discovery via DNS enumeration and network recon.
Blackbird
Fast username and email search across 600+ platforms.
ExifTool
Extracts hidden metadata from images, documents, and media.
GHunt
Investigates Google accounts, extracting data tied to a Gmail address.
Holehe
Checks whether an email is registered on 120+ sites via password-reset flows.
Instaloader
Downloads Instagram photos, videos, captions and metadata from public profiles.
Maigret
Builds a dossier from a username, checking thousands of sites for matching accounts.
Masscan
Internet-scale TCP port scanner able to sweep huge address ranges very fast.
Metagoofil
Harvests public documents from a domain and extracts their metadata.
Nmap
Free network scanner for host discovery, port scanning and service/OS detection.
PhoneInfoga
Scans and footprints international phone numbers using OSINT sources.
Photon
Fast crawler that extracts URLs, emails, files and other data points from a website.
Recon-ng
Modular web-recon framework with a Metasploit-like workflow.
Sherlock
Hunts a username across hundreds of sites.
Social Analyzer
API, CLI and web app that finds a person's profiles across 1000+ social sites.
Subfinder
Fast passive subdomain discovery tool that enumerates valid subdomains for a domain.
Waymore
Pulls a domain's archived URLs from the Wayback Machine and other sources for recon.
dnstwist
Generates and checks domain permutations to detect typosquatting and phishing lookalikes.
h8mail
Email OSINT and breach-hunting tool that pulls exposures for an address.
sn0int
Semi-automatic OSINT framework and package manager for entity recon.
snscrape
Scrapes posts and profiles from Twitter/X, Reddit, Telegram and other networks.
theHarvester
Collects emails, subdomains, and names from public sources.