Open Source Intelligence Tools
Open source intelligence tools collect and correlate public endpoints, DNS records, certificate logs, code leaks, and organizational assets to map external attack surfaces.
Software in Open Source Intelligence Tools
19 toolsNo tools in this category match the selected filters.
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Amass OWASP attack-surface discovery framework written in Go that discovers external assets through DNS enumeration and OSINT, licensed under Apache-2.0. | Apache-2.0 | Linux, macOS, Windows | Open Source |
| Censys Internet scan and host reconnaissance platform that maps exposed services, certificates, and infrastructure across the global web. | Proprietary | Web | Freemium |
| DeHashed Breach record search engine covering usernames, emails, names, IPs, and phone numbers. | Proprietary | Web | Freemium |
| Have I Been Pwned Troy Hunt breach search service covering exposed email addresses, passwords, and domains. | Proprietary | Web | Freemium |
| Holehe OSINT tool that checks which sites have an email registered via registration, login, and password-reset flows. | GPL-3.0-only | Linux, macOS, Windows | Open Source |
| httpx HTTP toolkit that probes services, captures response metadata, and fingerprints technologies to verify external attack surfaces. | MIT | Linux, Windows, macOS | Open Source |
| katana Configurable web crawler that discovers endpoints and content in standard and headless modes to map attack surfaces and catalog applications. | MIT | Linux, Windows, macOS | Open Source |
| Maigret Username OSINT tool that checks thousands of sites and builds a dossier report with profile metadata. | MIT | Linux, macOS, Windows | Free / Commercial |
| Maltego Visual link-analysis and OSINT platform that maps entities such as DNS names, people, and phone numbers through transforms and data integrations. | Proprietary | Windows, Linux, macOS | Free / Commercial |
| OSINT Framework Curated browser-based index of free OSINT tools and resources, organized by research task for username, email, domain, and records work. | MIT | Web | Open Source |
| Photon Python web crawler for OSINT that extracts URLs, emails, social handles, files, secrets, and subdomains from a target website in a single run. | GPL-3.0-or-later | Linux, macOS, Windows | Open Source |
| Recon-ng Full-featured, modular web-reconnaissance framework with a Metasploit-style CLI, SQLite workspaces, and a marketplace, licensed under GPL-3.0-or-later. | GPL-3.0-or-later | Linux | Open Source |
| reconFTW Automated recon framework chaining subdomain enumeration, probing, and vulnerability checks. | MIT | Linux, macOS | Open Source |
| Sherlock Python command-line tool that searches a username across more than 400 social networks and returns links to matching public profiles. | MIT | Linux, macOS, Windows | Open Source |
| Shodan Search engine for Internet-connected devices that indexes service banners, open ports, and exposed assets across public IP space. | Proprietary (service); MIT (Python client) | Web, Linux, macOS, Windows | Freemium |
| SpiderFoot Open-source OSINT automation tool with 200+ modules and a web UI that gathers and correlates data on domains, IPs, emails, and users. | MIT | Linux, macOS | Open Source |
| subfinder Go-based passive subdomain enumeration tool that aggregates online data sources to map an organization's external DNS footprint. | MIT | Linux, macOS, Windows | Open Source |
| theHarvester Lightweight, passive OSINT harvester that collects emails, subdomains, IPs, URLs, and names from public sources for authorized reconnaissance. | GPL-2.0-only | Linux, macOS, Windows | Open Source |
| WhatsMyName Community-maintained dataset and web tool for enumerating a username across hundreds of sites. | CC-BY-SA-4.0 | Web | Free |
About Open Source Intelligence Tools
Open source intelligence (OSINT) tools collect and correlate publicly available data to map an organization's external attack surface. The category includes subdomain enumeration tools like Amass and Subfinder that discover hosts from passive sources such as certificate transparency logs and passive DNS databases. Attack surface discovery platforms like Shodan and Censys index internet-connected devices, letting analysts find exposed services and open ports across their IP ranges. Recon frameworks like Recon-ng and SpiderFoot automate multi-source enumeration, combining DNS, WHOIS, certificate, and social media data into structured results. People and identity reconnaissance tools like Sherlock and theHarvester find email addresses, usernames, and social media profiles associated with a target organization. The category serves both offensive and defensive use cases. Offensive teams use OSINT during authorized assessments to identify entry points before active testing. Defensive teams use the same tools to monitor their own exposure, finding leaked credentials, accidentally exposed services, and shadow IT before attackers do. Most OSINT tools are open source and rely on public data sources, though commercial platforms like Shodan and Maltego offer paid tiers with broader data access and visualization.
Covered Topics
In This Catalog
- This category lists 19 tools: 12 open source, 4 freemium, 2 free / commercial, and 1 free.
- By platform, 14 run on Linux, 11 on Windows, 13 on macOS, and 6 on the web.
- The most common license among the open-source tools is MIT (7 tools).
Frequently Asked Questions
What is Open Source Intelligence Tools?→
Open source intelligence tools collect and correlate public endpoints, DNS records, certificate logs, code leaks, and organizational assets to map external attack surfaces.
What topics does the Open Source Intelligence Tools category cover?→
Passive Subdomain Enumeration, External Attack Surface Discovery, Certificate Transparency Auditing, Public Identity Reconnaissance, Multi-Source OSINT Frameworks
Which Open Source Intelligence tools are open source?→
12 of the 19 tools in this category are open source: Amass, Holehe, httpx, katana, OSINT Framework, Photon, Recon-ng, reconFTW, Sherlock, and SpiderFoot, and 2 more.