Curated list of OSINT tools for offensive security, covering email harvesting, subdomain enumeration, threat intelligence, and social engineering for penetration testing and red team operations.
This repository contains tools and links that can be used during OSINT in Pentest or Red Team. Currently, there are numerous awesome lists with tons of tools, but Offensive Security specialists often don't need such an extensive selection. This motivated the creation of this list. These tools cover almost all the needs of Offensive Security specialists and will help you get the job done efficiently.
If the tool performs multiple functions, for example collecting subdomains and URLs, it will be listed in two places.
Welcome! If you find that any of your favourite offensive tools is not on the list, you can suggest adding it.
Search Engines for Investigation Domains/IP Addresses.
Tools that help you collect email addresses. Usually the search requires the domain of the company.
Tools for automatic search of subdomains. Most of them require API keys to work correctly.
Only sites/tools whose search is not automated by the tools above are listed here.
Tools for passive collection and analysis URLs
Tools for finding mentions in code. Useful to search for company/company mentions to find passwords/secrets/confidential information.
An undiscovered area, the author is too dumb for that. Will gradually expand.
Threat Intelligence tools containing extensive company information, subdomains, DNS information, URLs and much more.
IP/Domain network analysis tools.
Tools for viewing the DNS history of a domain.
Tools allowing you to search for and download files located on public FTP servers.
Tools for automated passive IP address/subnet scanning.
Tools that help in passive/semi-passive analysis of Microsoft Exchange.
Tools for investigating Telegram chats.
Tools for Google Dorks.
Nickname search tools.
Sometimes situations happen that require analysing an employee's phone number to get more information.
Tools for searching, gathering information from cloud.
Links to guide, methodologies and any information that would be useful.
Some of the sites included might require registration or offer more data for $$$, but you should be able to get at least a portion of the available information for no cost.
Inspired by https://github.com/jivoi/awesome-osint
