Curated list of OSINT tools for offensive security, covering email harvesting, subdomain enumeration, threat intelligence, and social engineering for penetration testing and red team operations.
This repository contains tools and links that can be used during OSINT in Pentest or Red Team. Currently, there are numerous awesome lists with tons of tools, but Offensive Security specialists often don't need such an extensive selection. This motivated the creation of this list. These tools cover almost all the needs of Offensive Security specialists and will help you get the job done efficiently.
If the tool performs multiple functions, for example collecting subdomains and URLs, it will be listed in two places.
Welcome! If you find that any of your favourite offensive tools is not on the list, you can suggest adding it.
Search Engines for Investigation Domains/IP Addresses.
Tools that help you collect email addresses. Usually the search requires the domain of the company.
Tools for automatic search of subdomains. Most of them require API keys to work correctly.
Only sites/tools whose search is not automated by the tools above are listed here.
Tools for passive collection and analysis URLs
Tools for finding mentions in code. Useful to search for company/company mentions to find passwords/secrets/confidential information.
An undiscovered area, the author is too dumb for that. Will gradually expand.
