All Search Engines
Public search engines by category.
In-depth Attack Surface Mapping and Asset Discovery.
Go CLI and Library for quickly mapping organization network ranges using ASN information.
Find domains and subdomains potentially related to a given domain.
OSINT automation for hackers.
This small utility retrieves from the CommonCrawl data set unique subdomains for a given domain name.
A tool to find origin servers of websites protected by CloudFlare who are publicly exposed and don't restrict network access to the CloudFlare IP ranges as they should.
Simplifies the processes of searching LinkedIn to collect valid employee names.
Find web directories without bruteforce.
DNS recon & research, find & lookup DNS records
DNS Enumeration and Scanning Tool.
dnsx is a fast and multi-purpose DNS toolkit allow to run multiple probes using retryabledns library.
Search emails through Search Engines.
EMM OSINT Suite
European Commission Open Source Intelligence Suite .
Is a tool used mainly to find metadata and hidden information in the documents its scans.
An email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's Collection1 and the infamous Breach Compilation torrent.
Small, fast tool for performing reverse DNS lookups en masse.
Official Command Line Interface for the IPinfo API (IP geolocation and other types of IP data). The trusted source for IP address data. Accurate IP address data that keeps pace with secure, specific, and forward-looking use cases.
Modified version of CrossLinked.
NetCraft DNS lookup, includes sub-domains.
OSINT framework focused on gathering information from free tools or resources.
Phonebook lists all domains, email addresses, or URLs for the given input domain. Wildcards such as *.gov.uk are allowed. You are searching 20 billion records.
PowerMeta searches for publicly available files hosted on various websites for a particular domain by using specially crafted Google, and Bing searches.
pwndb.py is a python command-line tool for searching leaked credentials using the Onion service with the same name.
Uses specially crafted search queries to identify and download the following file types (pdf, xls, xlsx, csv, doc, docx, ppt, pptx) from a given domain using Google and Bing scraping.
A full-featured reconnaissance framework designed with the goal of providing a powerful environment to conduct open source web-based reconnaissance quickly and thoroughly.
Search Internet Assets Accurately & Instantly.
Hunt down social media accounts by username across social networks.
Shodan is the world's first search engine for Internet-connected devices.
Command-line interface for checking email address and username usage on online platforms: GitHub, GitLab, Instagram, Lastfm, Pinterest, Reddit, Snapchat, Spotify, Twitter, Tumblr, Yahoo, Firefox.
Crobat is a command line utility designed to allow easy querying of the Crobat API for DNS lookups.
SpiderFoot is an open source intelligence (OSINT) automation tool. It integrates with just about every data source available and utilises a range of methods for data analysis, making that data easy to navigate.
Fast passive subdomain enumeration tool.
Python tool designed to enumerate subdomains of websites using OSINT.
theHarvester is used to gather open source intelligence (OSINT) on a company or domain.
Twitter Words of Interest.