Tools directory
Every listed tool carries its cost tier, whether it's dual-use, and a privacy note where one is obvious. Listing a tool is not an endorsement of any specific use of it.
Censys
Search engine for internet-facing hosts, certs, and services.
GreyNoise
Labels internet background scan and attack traffic to separate noise from real threats.
Masscan
Internet-scale TCP port scanner able to sweep huge address ranges very fast.
Netlas
Internet-wide scanning and attack-surface search platform.
Nmap
Free network scanner for host discovery, port scanning and service/OS detection.
OSINT.SH
All-in-one web toolkit: DNS history, reverse IP, WHOIS.
Shodan
Search engine for internet-connected devices, servers, and IoT.
SpiderFoot
Automates threat-intel and reconnaissance gathering.
Wappalyzer
Identifies the technology stack (CMS, frameworks, analytics) a website runs.
ZoomEye
Cyberspace search engine mapping internet-exposed devices, services and components.
theHarvester
Collects emails, subdomains, and names from public sources.
Blackbird
Fast username and email search across 600+ platforms.
Epieos
Reverse email lookup and digital-footprint tracing.
Instaloader
Downloads Instagram photos, videos, captions and metadata from public profiles.
Maigret
Builds a dossier from a username, checking thousands of sites for matching accounts.
Max Intel
Browser platform with a large set of free utilities for email, phone, and username pivots.
OSINT Industries
Paid platform for reverse email/phone/username lookups across hundreds of services.
Sherlock
Hunts a username across hundreds of sites.
Social Analyzer
API, CLI and web app that finds a person's profiles across 1000+ social sites.
Social Searcher
Free real-time search engine for public social-media posts and mentions.
WhatsMyName
Enumerates a username's presence across sites.
snscrape
Scrapes posts and profiles from Twitter/X, Reddit, Telegram and other networks.
ExifTool
Extracts hidden metadata from images, documents, and media.
Flare
Threat-exposure and dark-web monitoring: finds leaked credentials, stealer logs, and exposed data.
Gephi
Open-source platform for visualizing and analyzing large network graphs.
Have I Been Pwned
Checks emails/accounts against known breaches.
Lampyre
Data-analysis and OSINT tool pulling 100+ sources into graphs, maps and tables.
Maltego
Visual link-analysis mapping relationships between data points.
Neo4j
Graph database for storing and querying connected data and relationships.
Timesketch
Open-source collaborative forensic timeline analysis tool.
GHunt
Investigates Google accounts, extracting data tied to a Gmail address.
Holehe
Checks whether an email is registered on 120+ sites via password-reset flows.
Hunter.io
Finds and verifies professional email addresses associated with a domain.
PhoneInfoga
Scans and footprints international phone numbers using OSINT sources.
h8mail
Email OSINT and breach-hunting tool that pulls exposures for an address.
Google Lens
Google's visual search to identify objects, places and text in images.
Picarta
AI tool that predicts where a photo was taken from its visual content.
PimEyes
Facial-recognition search engine that finds where a face appears online.
SunCalc
Shows sun position and shadow direction for any place and time, used to verify photo timing.
TinEye
Reverse image search that finds where an image appears and its earliest known use.
Yandex Images
Reverse image search noted for strong face and location matching.
DNSDumpster
Free domain research tool that maps a domain's subdomains and hosts.
SecurityTrails
Historical DNS, WHOIS and subdomain data for domains and IP addresses.
ViewDNS.info
Collection of free DNS, WHOIS, reverse-IP and network lookup tools.
Whoxy
WHOIS lookup and reverse-WHOIS history, including registrant-name search.
crt.sh
Searches Certificate Transparency logs to enumerate a domain's certificates and subdomains.
BreachDirectory
Free lookup to see if an email or username appears in public breaches.
DeHashed
Search engine over billions of breached credentials and personal records.
Intelligence X
Search engine over leaks, pastes, darknet and historical web data.
LeakCheck
Data-breach search engine for exposed emails, usernames and passwords.
Snusbase
Paid breach-search database indexing leaked credentials and personal data.
FastPeopleSearch
Free US people lookup by name, phone or address.
OpenCorporates
Largest open database of companies and their officers from official registries.
Spokeo
People-search service aggregating public records and social profiles.
ThatsThem
Free people search aggregating names, addresses, emails and phone numbers.
TruePeopleSearch
Free US people search returning addresses, phone numbers and relatives.
FOCA
Extracts hidden metadata and info from Office, PDF and image files.
FotoForensics
Online error-level analysis and metadata inspection to detect edited images.
Jimpl
Online EXIF viewer showing a photo's hidden camera, GPS and timestamp data.
Metagoofil
Harvests public documents from a domain and extracts their metadata.
Flightradar24
Live and historical aircraft flight tracking.
Google Earth
Satellite imagery and 3D globe for exploring and measuring locations.
MarineTraffic
Live and historical ship and vessel tracking via AIS.
OpenStreetMap
Free, editable world map with rich open geographic data.
Overpass Turbo
Query and visualize OpenStreetMap data by feature and area.
WiGLE
Crowdsourced map and database of Wi-Fi networks and cell towers by location.
Ahmia
Search engine for Tor hidden services (.onion), excluding abuse material.
AlienVault OTX
Open Threat Exchange sharing community indicators of compromise.
MISP
Open-source platform for sharing and correlating threat intelligence.
VirusTotal
Scans files and URLs against many engines and aggregates threat intel.
urlscan.io
Sandboxes and analyzes websites, capturing requests, screenshots and tech.
Bellingcat Online Investigation Toolkit
Curated, maintained directory of open-source investigation tools.
IntelTechniques
Michael Bazzell's OSINT search tools, books and training resources.
OSINT Framework
Web directory categorizing hundreds of OSINT tools and data sources.
Recon-ng
Modular web-recon framework with a Metasploit-like workflow.
Wayback Machine
Internet Archive's index of historical snapshots of web pages.
sn0int
Semi-automatic OSINT framework and package manager for entity recon.