Open Source Intelligence Tools

OWASP attack-surface discovery framework written in Go that discovers external assets through DNS enumeration and OSINT, licensed under Apache-2.0.

Internet scan and host reconnaissance platform that maps exposed services, certificates, and infrastructure across the global web.

Breach record search engine covering usernames, emails, names, IPs, and phone numbers.

Troy Hunt breach search service covering exposed email addresses, passwords, and domains.

OSINT tool that checks which sites have an email registered via password-reset flows.

Fast HTTP toolkit that probes services, captures response metadata, and fingerprints technologies to verify external attack surfaces.

Configurable web crawler that discovers endpoints and content in standard and headless modes to map attack surfaces and catalog applications.

Username OSINT tool that checks thousands of sites and builds a dossier report with profile metadata.

Visual link-analysis and OSINT platform that maps relationships between domains, people, and infrastructure through transforms and data integrations.

Curated browser-based index of free OSINT tools and resources, organized by research task for username, email, domain, and records work.

Python web crawler for OSINT that extracts URLs, emails, social handles, files, secrets, and subdomains from a target website in a single run.

Full-featured, modular web-reconnaissance framework with a Metasploit-style CLI, SQLite workspaces, and a marketplace, licensed under GPL-3.0-or-later.

Automated full-spectrum recon framework chaining subdomain enumeration, probing, and vulnerability checks.

Python command-line tool that searches a username across more than 400 social networks and returns links to matching public profiles.

Search engine for Internet-connected devices that indexes service banners, open ports, and exposed assets across public IP space.

Open-source OSINT automation tool with 200+ modules and a web UI that gathers and correlates data on domains, IPs, emails, and users.

Go-based passive subdomain enumeration tool that aggregates online data sources to map an organization's external DNS footprint.

Lightweight, passive OSINT harvester that collects emails, subdomains, IPs, URLs, and names from public sources for authorized reconnaissance.

Community-maintained dataset and web tool for enumerating a username across hundreds of sites.