[](#-table-of-contents) Certifications

Tools

• Crt.sh
• Web-check - check.as93.net/)

[↑](#-table-of-contents) Cloud

Tools

• Cloud_sherlock

[↑](#-table-of-contents) Dark web

Tools

• Ahmia

[↑](#-table-of-contents) DnsHistory

Tools

• Dnshistory
• Viewdns
• Bigdomaindata

[↑](#-table-of-contents) Email addresses

• Hunter.io
• Snov.io
• Email-format - Analyses the company's mail format.
• Anymailfinder - Find Verified Emails
• Omail
• Skymem
• Signalhire
• Rocketreach
• findemail.io
• Eyes - Email osint tool
• Infoga
• Poastal - Tool that provides valuable information on any email address
• h8mail - Email OSINT & Password breach hunting tool
• EmailFinder - Search emails from a domain through search engines
• Prospeo.io
• tomba.io - email finder
• contactout.com - person finder

[↑](#-table-of-contents) FTP servers

Tools

• Searchftps

[↑](#-table-of-contents) Google Dorks

Tools

• Google hacking database
• Recruitin - Compiles Google dorks to search on LinkedIn, Dribbble, GitHub, Xing, StackOverflow, Twitter
• Pagodo
• Search - Custom queries in Google

[↑](#-table-of-contents) Information gathering tools

Tools

• Cylect.io
• Gasmask
• Th3inspector

[↑](#-table-of-contents) Intelligence

Tools

• TI.defender.microsoft
• Securitytrails
• Pulsedive
• ThreatBook
• Alienvault
• Hudson Rock - Cybercrime Intelligence Tools
• LeakRadar
• ThreatBook
• DomScan - Domain intelligence for DNS, WHOIS/RDAP, TLS, subdomains, reputation, redirects, and typosquatting.

[↑](#-table-of-contents) Microsoft Exchange

Tools

• ExchangeFinder

[↑](#-table-of-contents) Network Info

Tools

• Bgp.he
• whoistory
• Asnlookup
• Bgp.tools
• Myip
• IpInfo
• Whoisxmlapi
• whoistory
• Bgp.tools

[↑](#-table-of-contents) Nickname search

Tools

• maigret
• Sherlock
• Social analyzer
• nexfil
• whatsmyname
• snoop
• userrecon
• NicknameFinder
• gideon
• Arina-OSINT
• netizenship
• socialscan
• Sherlock
• SocialPath

[↑](#-table-of-contents) Passive Infrastructure scanner

Tools

• Smap
• Nmap-censys

[↑](#-table-of-contents) Phone number

Tools

• Osint.industries
• Emobiletracker
• Castrick
• PhoneInfoga
• GhostTrack
• Predicta Search
• BuscaPaginasBlancas - Python tool for automated lookups on Spanish white pages (PaginasBlancas.es) to find phone numbers and addresses

[↑](#-table-of-contents) Search Engines

• Shodan
• Greynoise.io
• ZoomEye
• Onyphe
• Fofa
• Binaryedge
• FullHunt
• Netlas
• Quake360
• Criminalip
• Synapsint
• Natlas
• Leakix
• Dorki.io
• ZoomEye
• Natlas
• Natlas
• Natlas
• Censys

[↑](#-table-of-contents) Source code

Tools

• Publicwww
• Nerdydata
• Searchcode
• Grep.app

[↑](#-table-of-contents) SubDomain collector

Tools

• Nmmapper

[↑](#-table-of-contents) SubDomain's

Tools

• Phonebook
• Shrewdeye
• Bbot
• sub.Monitor - Passive subdomain continous monitoring tool
• Sudomy
• subchase - Chase subdomains by parsing the results of Google and Yandex search results
• SubGPT - SubGPT looks at subdomains you have already discovered for a domain and uses BingGPT to find more.
• alterx - Fast and customizable subdomain wordlist generator using DSL.
• Photon - Incredibly fast crawler designed for OSINT.
• subdomain-enum - securitytrails api
• subdomainfinder.c99. - A subdomain finder is a tool used to find the subdomains of a given domain.
• Subdominator
• SubDomainRadar.io - Discover hidden subdomains with unparalleled accuracy and speed
• Amass
• dash.pugrecon.celes.in
• subchase - Chase subdomains by parsing the results of Google and Yandex search results
• dash.pugrecon.celes.in

[↑](#-table-of-contents) Telegram

Tools

• Telepathy
• Telepathy

[↑](#-table-of-contents) URLs

Tools

• Rextracter.streamlit - Gathers links and analyses content
• theHarvester
• ronin-recon - Recursive recon engine and framework that can enumerate subdomains, DNS records, port scan, grab TLS certs, spider websites, and collect email addresses.
• Spiderfoot
• GooFuzz - Enumerate directories, files, subdomains or parameters without leaving evidence on the target's serve
• Gau
• Xurlfind3r
• Unja
• urlhunter - a recon tool that allows searching on URLs that are exposed via shortener services
• Waymore
• Uscrapper - Tool that allows users to extract various personal information from a website.
• Ominis-Osint - The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
• Urlfinder

[↑](-table-of-contents) Usefull links

Tools

• WhereToGo - list of popular services that might be used in organizations. By having an account of the user - you can try to find entry points to the organization data. #semiosint
• Cloud OSINT - Repository with information related to Cloud Osint
• Information Disclosure Write-Ups And PoCs

[↑](#-table-of-contents) Wifi

Tools

• 3Wifi - free base of access points