Offensive-OSINT-Tools
OffSec OSINT Pentest/RedTeam Tools
https://github.com/wddadk/Offensive-OSINT-Tools
Last synced: 5 days ago
JSON representation
-
[](#-table-of-contents) Certifications
-
[↑](#-table-of-contents) Cloud
-
Tools
-
-
[↑](#-table-of-contents) Dark web
-
Tools
-
-
[↑](#-table-of-contents) DnsHistory
-
[↑](#-table-of-contents) Email addresses
- Hunter.io
- Snov.io
- Email-format - Analyses the company's mail format.
- Anymailfinder - Find Verified Emails
- Omail
- Skymem
- Signalhire
- Rocketreach
- findemail.io
- Eyes - Email osint tool
- Infoga
- Poastal - Tool that provides valuable information on any email address
- h8mail - Email OSINT & Password breach hunting tool
- EmailFinder - Search emails from a domain through search engines
- Prospeo.io
- tomba.io - email finder
- contactout.com - person finder
-
[↑](#-table-of-contents) FTP servers
-
Tools
-
-
[↑](#-table-of-contents) Google Dorks
-
Tools
- Google hacking database
- Recruitin - Compiles Google dorks to search on LinkedIn, Dribbble, GitHub, Xing, StackOverflow, Twitter
- Pagodo
- Search - Custom queries in Google
-
-
[↑](#-table-of-contents) Information gathering tools
-
Tools
-
-
[↑](#-table-of-contents) Intelligence
-
Tools
- TI.defender.microsoft
- Securitytrails
- Pulsedive
- ThreatBook
- Alienvault
- Hudson Rock - Cybercrime Intelligence Tools
- LeakRadar
- ThreatBook
- DomScan - Domain intelligence for DNS, WHOIS/RDAP, TLS, subdomains, reputation, redirects, and typosquatting.
- LeakRadar
-
-
[↑](#-table-of-contents) Microsoft Exchange
-
Tools
-
-
[↑](#-table-of-contents) Network Info
-
[↑](#-table-of-contents) Nickname search
-
[↑](#-table-of-contents) Passive Infrastructure scanner
-
Tools
-
-
[↑](#-table-of-contents) Phone number
-
Tools
- Osint.industries
- Emobiletracker
- Castrick
- PhoneInfoga
- GhostTrack
- Predicta Search
- BuscaPaginasBlancas - Python tool for automated lookups on Spanish white pages (PaginasBlancas.es) to find phone numbers and addresses
- Osint.industries
-
-
[↑](#-table-of-contents) Search Engines
-
[↑](#-table-of-contents) Source code
-
Tools
-
-
[↑](#-table-of-contents) SubDomain collector
-
Tools
-
-
[↑](#-table-of-contents) SubDomain's
-
Tools
- Phonebook
- Shrewdeye
- Bbot
- sub.Monitor - Passive subdomain continous monitoring tool
- Sudomy
- subchase - Chase subdomains by parsing the results of Google and Yandex search results
- SubGPT - SubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to find more.
- alterx - Fast and customizable subdomain wordlist generator using DSL.
- Photon - Incredibly fast crawler designed for OSINT.
- subdomain-enum - securitytrails api
- subdomainfinder.c99. - A subdomain finder is a tool used to find the subdomains of a given domain.
- Subdominator
- SubDomainRadar.io - Discover hidden subdomains with unparalleled accuracy and speed
- Amass
- dash.pugrecon.celes.in
- subchase - Chase subdomains by parsing the results of Google and Yandex search results
- dash.pugrecon.celes.in
- Nmmapper
-
-
[↑](#-table-of-contents) Telegram
-
[↑](#-table-of-contents) URLs
-
Tools
- Rextracter.streamlit - Gathers links and analyses content
- theHarvester
- ronin-recon - Recursive recon engine and framework that can enumerate subdomains, DNS records, port scan, grab TLS certs, spider websites, and collect email addresses.
- Spiderfoot
- GooFuzz - Enumerate directories, files, subdomains or parameters without leaving evidence on the target's serve
- Gau
- Xurlfind3r
- Unja
- urlhunter - a recon tool that allows searching on URLs that are exposed via shortener services
- Waymore
- Uscrapper - Tool that allows users to extract various personal information from a website.
- Ominis-Osint - The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
- Urlfinder
-
-
[↑](-table-of-contents) Usefull links
-
Tools
- WhereToGo - list of popular services that might be used in organizations. By having an account of the user - you can try to find entry points to the organization data. #semiosint
- Cloud OSINT - Repository with information related to Cloud Osint
- Information Disclosure Write-Ups And PoCs
-
-
[↑](#-table-of-contents) Wifi
-
Tools
- 3Wifi - free base of access points
-
Categories
[↑](#-table-of-contents) Search Engines
19
[↑](#-table-of-contents) SubDomain's
18
[↑](#-table-of-contents) Email addresses
17
[↑](#-table-of-contents) Nickname search
17
[↑](#-table-of-contents) URLs
13
[↑](#-table-of-contents) Intelligence
10
[↑](#-table-of-contents) Network Info
9
[↑](#-table-of-contents) Phone number
8
[↑](#-table-of-contents) Google Dorks
4
[↑](#-table-of-contents) Source code
4
[↑](#-table-of-contents) DnsHistory
4
[↑](#-table-of-contents) Information gathering tools
3
[↑](-table-of-contents) Usefull links
3
[↑](#-table-of-contents) Passive Infrastructure scanner
2
[↑](#-table-of-contents) Telegram
2
[](#-table-of-contents) Certifications
2
[↑](#-table-of-contents) FTP servers
1
[↑](#-table-of-contents) Wifi
1
[↑](#-table-of-contents) Dark web
1
[↑](#-table-of-contents) Cloud
1
[↑](#-table-of-contents) Microsoft Exchange
1
[↑](#-table-of-contents) SubDomain collector
1
Sub Categories
Keywords
osint
31
python
16
information-gathering
15
reconnaissance
14
recon
10
subdomain-enumeration
8
osint-python
7
pentesting
7
infosec
7
cybersecurity
7
bugbounty
7
username
7
cli
6
osint-tool
6
subdomain-scanner
5
email
5
scanner
5
hacking
5
redteam
5
security
5
subdomain-finder
4
osint-framework
4
username-checker
4
golang
3
osint-tools
3
scraping
3
subdomain
3
enumeration
3
bug-bounty
3
linux
3
python3
3
sherlock
3
blueteam
3
security-tools
3
osint-resources
2
information
2
pentest
2
port-scanner
2
subdomains
2
penetration-testing
2
social-media
2
go
2
web-scraping
2
termux
2
socmint
2
discovery
2
username-search
2
kali
2
investigation
2
open-source-intelligence
2