Tools directory
Every listed tool carries its cost tier, whether it's dual-use, and a privacy note where one is obvious. Listing a tool is not an endorsement of any specific use of it.
Two of the site's own tools also run right here, entirely in your browser: the EXIF & photo metadata viewer and the Google dork builder.
127 tools
BuiltWith
Technology profiler that reports the frameworks, analytics, hosting and other services a website is built with.
Censys
Search engine for internet-facing hosts, certs, and services.
Criminal IP
Search engine and threat-intelligence platform for internet-exposed assets, IP reputation and domain scans.
FOFA
Cyberspace search engine that indexes internet-exposed hosts, services and web fingerprints for querying.
GreyNoise
Labels internet background scan and attack traffic to separate noise from real threats.
IPinfo
IP address data service returning geolocation, ASN, company and privacy-detection details for any IP.
Masscan
Internet-scale TCP port scanner able to sweep huge address ranges very fast.
Netlas
Internet-wide scanning and attack-surface search platform.
Nmap
Free network scanner for host discovery, port scanning and service/OS detection.
OSINT.SH
All-in-one web toolkit: DNS history, reverse IP, WHOIS.
Photon
Fast crawler that extracts URLs, emails, files and other data points from a website.
PublicWWW
Search engine that finds websites by matching source-code snippets, IDs or scripts.
Shodan
Search engine for internet-connected devices, servers, and IoT.
SpiderFoot
Automates threat-intel and reconnaissance gathering.
Wappalyzer
Identifies the technology stack (CMS, frameworks, analytics) a website runs.
ZoomEye
Cyberspace search engine mapping internet-exposed devices, services and components.
theHarvester
Collects emails, subdomains, and names from public sources.
Blackbird
Fast username and email search across 600+ platforms.
Instaloader
Downloads Instagram photos, videos, captions and metadata from public profiles.
Maigret
Builds a dossier from a username, checking thousands of sites for matching accounts.
Namechk
Checks whether a username or domain is available or already taken across many sites.
OSINT Industries
Paid platform for reverse email/phone/username lookups across hundreds of services.
Osintgram
Open-source Instagram OSINT tool, run as a local web app, that gathers followers, posts, comments and locations from a public account by username.
Sherlock
Hunts a username across hundreds of sites.
Social Analyzer
API, CLI and web app that finds a person's profiles across 1000+ social sites.
Social Searcher
Free real-time search engine for public social-media posts and mentions.
TGStat
Analytics platform for searching and tracking Telegram channels and groups.
Telegago
Google Custom Search engine scoped to indexed Telegram channel content.
WhatsMyName
Enumerates a username's presence across sites.
snscrape
Scrapes posts and profiles from Twitter/X, Reddit, Telegram and other networks.
Aleph
OCCRP's platform for searching and cross-referencing leaked and public documents and data.
CyberChef
GCHQ's browser-based "Cyber Swiss Army Knife" for decoding, decrypting, transforming and analysing data.
Flare
Threat-exposure and dark-web monitoring: finds leaked credentials, stealer logs, and exposed data.
Gephi
Open-source platform for visualizing and analyzing large network graphs.
Lampyre
Data-analysis and OSINT tool pulling 100+ sources into graphs, maps and tables.
Maltego
Visual link-analysis mapping relationships between data points.
Neo4j
Graph database for storing and querying connected data and relationships.
Timesketch
Open-source collaborative forensic timeline analysis tool.
i2 Analyst's Notebook
Link-analysis and visualisation software for mapping relationships, timelines and networks in investigations.
Epieos
Reverse email lookup and digital-footprint tracing.
GHunt
Investigates Google accounts, extracting data tied to a Gmail address.
GetContact
Caller-ID and spam-blocking app with a web lookup that identifies who a phone number belongs to.
Holehe
Checks whether an email is registered on 120+ sites via password-reset flows.
Hunter.io
Finds and verifies professional email addresses associated with a domain.
NumLookup
Reverse phone lookup for US numbers that shows basic results instantly, with fuller background reports on a paid subscription.
PhoneInfoga
Scans and footprints international phone numbers using OSINT sources.
Truecaller
Caller-ID and reverse phone lookup service that shows a name and spam label for a phone number.
h8mail
Email OSINT and breach-hunting tool that pulls exposures for an address.
FaceCheck.ID
FaceCheck ID — sometimes searched as face check id — is a freemium facial-recognition search engine that finds where a face appears across the web. It is a dual-use OSINT tool: used responsibly, treat it like PimEyes and check what a face search reveals about you before running it on anyone else.
Google Lens
Google's visual search to identify objects, places and text in images.
Picarta
AI tool that predicts where a photo was taken from its visual content.
PimEyes
Facial-recognition search engine that finds where a face appears online.
Search4faces
Reverse face search that matches a photo against profile pictures collected from VK, Odnoklassniki, TikTok and ClubHouse.
SunCalc
Shows sun position and shadow direction for any place and time, used to verify photo timing.
TinEye
Reverse image search that finds where an image appears and its earliest known use.
Yandex Images
Reverse image search noted for strong face and location matching.
Amass
In-depth attack-surface mapping and asset discovery via DNS enumeration and network recon.
DNSDumpster
Free domain research tool that maps a domain's subdomains and hosts.
DomainTools
Domain intelligence platform with WHOIS history, reverse WHOIS and DNS pivoting for investigating who is behind a domain.
MxToolbox
Web diagnostics for DNS, MX, SPF/DKIM/DMARC, blacklist and SMTP checks on a domain or IP.
SecurityTrails
Historical DNS, WHOIS and subdomain data for domains and IP addresses.
Subfinder
Fast passive subdomain discovery tool that enumerates valid subdomains for a domain.
ViewDNS.info
Collection of free DNS, WHOIS, reverse-IP and network lookup tools.
Waymore
Pulls a domain's archived URLs from the Wayback Machine and other sources for recon.
Whoxy
WHOIS lookup and reverse-WHOIS history, including registrant-name search.
crt.sh
Searches Certificate Transparency logs to enumerate a domain's certificates and subdomains.
dnstwist
Generates and checks domain permutations to detect typosquatting and phishing lookalikes.
BreachDirectory
BreachDirectory is a free breach-search tool for OSINT investigations: enter an email address or username to check whether it appears in known public data breaches, so you can spot exposed accounts and know which passwords to rotate.
DeHashed
Search engine over billions of breached credentials and personal records.
Have I Been Pwned
Checks emails/accounts against known breaches.
Hudson Rock
Infostealer-intelligence platform for finding devices and credentials compromised by stealer malware.
Intelligence X
Search engine over leaks, pastes, darknet and historical web data.
LeakCheck
Data-breach search engine for exposed emails, usernames and passwords.
Snusbase
Paid breach-search database indexing leaked credentials and personal data.
SpyCloud
Enterprise identity-threat platform built on credentials and data recaptured from breaches and infostealer malware.
Companies House
UK government register for searching company filings, officers and persons with significant control.
Crunchbase
Company and investor database covering funding rounds, leadership and acquisitions for startups and private companies.
FastPeopleSearch
Free US people lookup by name, phone or address.
ICIJ Offshore Leaks Database
ICIJ's searchable database of offshore entities and officers from the Panama, Paradise and Pandora Papers and other leaks.
LittleSis
Free database mapping relationships between powerful people and organizations.
OpenCorporates
Largest open database of companies and their officers from official registries.
OpenSanctions
Open database of sanctioned entities, politically exposed persons and other watchlists.
Pipl
Enterprise identity-data service that links names, emails, phones and addresses for fraud and verification teams.
SEC EDGAR Full-Text Search
Full-text search across SEC filings back to 2001 by company, filer name, form type and keyword.
Spokeo
People-search service aggregating public records and social profiles.
ThatsThem
Free people search aggregating names, addresses, emails and phone numbers.
TruePeopleSearch
Free US people search returning addresses, phone numbers and relatives.
Datashare
ICIJ's tool for indexing, searching and extracting entities from large document sets.
ExifTool
Extracts hidden metadata from images, documents, and media.
FOCA
Extracts hidden metadata and info from Office, PDF and image files.
Forensically
Free in-browser image-forensics toolkit (error-level analysis, clone detection, noise analysis, metadata) that never uploads your images.
FotoForensics
Online error-level analysis and metadata inspection to detect edited images.
InVID WeVerify
Browser plugin for verifying and analyzing images and videos found on social media.
Jimpl
Online EXIF viewer showing a photo's hidden camera, GPS and timestamp data.
Metagoofil
Harvests public documents from a domain and extracts their metadata.
ADS-B Exchange
Live and historical aircraft tracking built from crowdsourced, unfiltered ADS-B receiver data.
FlightAware
Live and historical flight tracking with aircraft, airport and tail-number lookups; deeper history on paid plans.
Flightradar24
Live and historical aircraft flight tracking.
Google Earth
Google Earth is not a live satellite feed — its imagery is periodically updated historical and aerial photography, not real-time video. For OSINT work it still offers a global historical-imagery timeline, 3D terrain views, distance and area measurement tools, and KML/KMZ support for mapping and geolocation research.
MarineTraffic
Live and historical ship and vessel tracking via AIS.
NASA FIRMS
NASA's Fire Information for Resource Management System, mapping near-real-time satellite fire and thermal-anomaly detections.
OpenStreetMap
Free, editable world map with rich open geographic data.
Overpass Turbo
Query and visualize OpenStreetMap data by feature and area.
VesselFinder
Live AIS ship-tracking map with vessel details, ports and voyage history; extended data on paid plans.
WiGLE
Crowdsourced map and database of Wi-Fi networks and cell towers by location.
ANY.RUN
Interactive online malware sandbox that runs suspicious files and URLs and records their behaviour.
AbuseIPDB
Community-maintained database of reported malicious IP addresses, with reputation lookups and a free API tier.
Ahmia
Search engine for Tor hidden services (.onion), excluding abuse material.
AlienVault OTX
Open Threat Exchange sharing community indicators of compromise.
MISP
Open-source platform for sharing and correlating threat intelligence.
Tor Browser
Privacy-focused browser that routes traffic through the Tor network and can open .onion hidden services.
VirusTotal
Scans files and URLs against many engines and aggregates threat intel.
urlscan.io
Sandboxes and analyzes websites, capturing requests, screenshots and tech.
Bellingcat Online Investigation Toolkit
Curated, maintained directory of open-source investigation tools.
Google Hacking Database
Exploit-DB's curated archive of Google search queries ("dorks") that surface exposed data.
Hunchly
Browser capture tool that automatically logs and timestamps webpages visited during research.
IntelTechniques
Michael Bazzell's OSINT search tools, books and training resources.
OSINT Framework
Web directory categorizing hundreds of OSINT tools and data sources.
Obsidian
Local markdown note-taking app used by investigators to organize and link case notes.
Recon-ng
Modular web-recon framework with a Metasploit-like workflow.
ShadowDragon
Commercial OSINT suite (SocialNet) for collecting and linking social-media and open-source data in investigations.
Skopenow
Commercial OSINT platform that compiles social-media and public-record profiles for investigations and threat assessment.
Social Links
Commercial OSINT investigation platform that gathers social-media, messenger and open-source data on a target.
Wayback Machine
Internet Archive's index of historical snapshots of web pages.
archive.today
Web archiving service that saves and serves permanent snapshots of pages on demand.
grep.app
Search engine for source code across public GitHub repositories.
sn0int
Semi-automatic OSINT framework and package manager for entity recon.