> osint tools
OSINT tools directory
Free and free-tier open source intelligence tools, built by other people and worth knowing. Start here, end up anywhere.
> starting points
Starting points
-
OSINT Framework
A categorized map of OSINT tools and resources. If you only bookmark one link from this page, make it this one.
Free Open -
Bellingcat Online Investigation Toolkit
Bellingcat's curated toolkit of investigation resources, maintained by the people behind some of the best open source investigations published.
Free Open -
Google Hacking Database
A library of advanced search queries (dorks) that show how much a plain search engine can surface.
Free Open -
Trace Labs
Crowdsourced OSINT competitions that help find missing persons. A good place to practice with purpose.
Free Open
> search engines
Search engines
-
Shodan
The search engine for internet-connected devices: servers, webcams, industrial systems, anything with an open port.
Free tier Open -
Censys
Internet-wide scans of hosts and certificates. Strong for finding exposed services and infrastructure.
Free tier Open -
Intelligence X
Searches leaks, paste sites, the dark web and historical captures by email, domain, IP or keyword.
Free tier Open
> domains and websites
Domains and websites
-
crt.sh
Certificate transparency search. Reveals subdomains and infrastructure through the certificates a domain has issued.
Free Open -
DNSDumpster
DNS reconnaissance and domain mapping with a visual graph of what it finds.
Free Open -
SecurityTrails
Current and historical DNS records, WHOIS history and subdomain data.
Free tier Open -
ViewDNS.info
A big collection of one-click DNS, WHOIS and reverse lookup tools on a single page.
Free Open -
BuiltWith
Shows the technology stack behind any website, and how it has changed over time.
Free tier Open -
Wayback Machine
Historical snapshots of websites going back decades. What a page said before it was edited.
Free Open -
archive.today
On-demand page snapshots that preserve a page exactly as you saw it, useful as evidence.
Free Open
> ips and networks
IPs and networks
-
AbuseIPDB
Community-reported abuse history for any IP address.
Free tier Open -
GreyNoise
Tells you whether an IP is targeting you or just scanning the whole internet. Great noise filter.
Free tier Open -
BGPView
ASN, prefix and peering lookups. Who owns a network and what else they announce.
Free Open -
IPinfo
IP geolocation, ASN and hosting details with a clean lookup page.
Free tier Open -
Robtex
Cross-references IPs, DNS records and networks in one graph view.
Free Open
> threat intelligence
Threat intelligence
-
VirusTotal
Analyzes files, URLs, domains and IPs against dozens of engines. The first stop for a suspicious anything.
Free tier Open -
urlscan.io
Scans and screenshots a URL in a sandbox so you never have to open it yourself.
Free tier Open -
AlienVault OTX
Open threat exchange with community pulses on indicators, campaigns and malware.
Free Open -
URLhaus
abuse.ch feed of URLs actively distributing malware.
Free Open
> email addresses
Email addresses
-
Have I Been Pwned
Checks whether an email address has appeared in known data breaches. Run it on your own addresses first.
Free Open -
Hunter
Finds and verifies the email pattern a company uses.
Free tier Open -
Epieos
Pivots from an email address to the accounts and services registered with it.
Free tier Open -
EmailRep
Reputation and risk signals for an email address.
Free Open -
MXToolbox
Mail server, blacklist and DNS diagnostics for any domain.
Free Open
> usernames and social
Usernames and social
-
WhatsMyName
Checks a username across hundreds of sites, maintained by the OSINT community.
Free Open -
Sherlock
Command-line username hunter covering hundreds of platforms.
Open source Open -
Maigret
Collects a full profile dossier from a single username, with reports.
Open source Open -
Namechk
Quick username availability check across major platforms, which doubles as presence discovery.
Free Open -
Social Searcher
Searches public social media posts and mentions without needing accounts.
Free tier Open
> images and media
Images and media
-
TinEye
Reverse image search that tells you where an image appeared first.
Free Open -
Yandex Images
The reverse image search that regularly beats the others on faces and places.
Free Open -
FotoForensics
Error level analysis that helps spot edited regions in a photo.
Free Open -
ExifTool
The definitive metadata extractor for images and media files.
Open source Open -
Jimpl
Drag and drop EXIF viewer in the browser for a quick metadata look.
Free Open -
InVID WeVerify
Browser plugin for verifying images and video, built for fact-checkers.
Free Open
> geolocation and maps
Geolocation and maps
-
Google Earth
Satellite imagery with historical layers, the backbone of most geolocation work.
Free Open -
SunCalc
Sun position and shadow angles for any place and time. Dates and times photos from their shadows.
Free Open -
Overpass Turbo
Queries OpenStreetMap data: find every water tower near a railway in a region, that kind of thing.
Free Open -
Mapillary
Crowdsourced street-level imagery for places Street View does not cover.
Free Open -
GeoHints
Visual reference for license plates, signs, poles and other clues that give away a country.
Free Open
> toolkits and frameworks
Toolkits and frameworks
-
SpiderFoot
Automated OSINT scanner that correlates hundreds of data sources from one seed.
Open source Open -
theHarvester
Classic recon tool that gathers emails, subdomains and hosts from public sources.
Open source Open -
Recon-ng
Modular reconnaissance framework with a Metasploit-style workflow.
Open source Open -
Maltego CE
Visual link analysis that maps relationships between people, domains and infrastructure. Community edition is free.
Free tier Open -
Mitaka
Browser extension that looks up any selected indicator across dozens of OSINT services.
Open source Open
Every tool above belongs to its creator. Listing here is a recommendation, not an affiliation, and free tiers change over time. Use these responsibly and only against targets you are authorized to research. Found a great free OSINT tool that belongs here, or a dead link? Tell me about it.