Tools

soxoj/maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

findomain/findomain

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain…

owasp-amass/amass

In-depth attack surface mapping and asset discovery

lockfale/osint-framework

Curated framework of free OSINT tools and resources for gathering intelligence from public sources, organized by category with structured metadata…

thalesgroup-cert/watcher

AI-powered threat intelligence platform for automated CVE/ransomware monitoring, domain surveillance, data leak detection, and incident response with…

lc/gau

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

voidsecsoftwares/voidsec-proxy

Multi-module offensive security toolkit for SOCKS5 proxy chaining, port scanning, DNS enumeration, hash cracking, reverse shell generation,…

h9zdev/geosentinel

Real-time geospatial OSINT platform aggregating flight, vessel, and satellite data with dark web search, social media dorking, and AI-powered…

piratesshield/apiharvester

The one shot API attacker tool - finds the API url from the given root simulate the automated attacks

franccesco/getaltname

Extract subdomains from SSL certificates in HTTPS sites.

joda32/certcrunchy

Just a silly recon tool that uses data from SSL Certificates to find potential host names

rapiddns/rapiddns-cli

A powerful command-line interface for interacting with the [RapidDNS API](https://rapiddns.io/help/api). This tool allows you to perform DNS…

datasploit/datasploit

An #OSINT Framework to perform various recon techniques on Companies, People, Phone Number, Bitcoin Addresses, etc., aggregate all the raw data, and…

hueristiq/xsubfind3r

Passive subdomain discovery tool that aggregates results from multiple online sources via CLI, supporting stdin/stdout, JSONL output, and API key…

olivsec/loboguara

Cyber threat intelligence platform for SSL certificate discovery, domain/URL scanning, data leak monitoring, tracking link generation, and threat…

christophetd/cloudflair

🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

christophetd/censys-subdomain-finder

⚡ Perform subdomain enumeration using the certificate transparency logs from Censys.

pielco11/fav-up

Shodan-powered tool to discover real IP addresses behind Cloudflare by hashing favicon icons using MurmurHash3, enabling origin server identification…