Tools

lockfale/osint-framework

Curated framework of free OSINT tools and resources for gathering intelligence from public sources, organized by category with structured metadata…

soxoj/maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

lc/gau

Fetch known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl.

findomain/findomain

The fastest and complete solution for domain recognition. Supports screenshoting, port scan, HTTP check, data import from other tools, subdomain…

christophetd/cloudflair

🔎 Find origin servers of websites behind CloudFlare by using Internet-wide scan data from Censys.

christophetd/censys-subdomain-finder

⚡ Perform subdomain enumeration using the certificate transparency logs from Censys.

franccesco/getaltname

Extract subdomains from SSL certificates in HTTPS sites.

misterch0c/twitterbftd

Twitter Back From The Dead looks in a user tweets history for domain names that are available for registration

penafieljlm/inquisitor

Opinionated organisation-centric OSINT footprinting inspired from recon-ng and Maltego

fricciolosa-red-team/evildork

Automated Google dorking tool for extracting leaked secrets, personal information, and subdomains from a target domain or individual, outputting…

redhuntlabs/antisquat

AI-powered typosquatting and phishing domain detector using NLP and ChatGPT to generate domain permutations and extract contact information from…

a3h1nt/subcert

Passive subdomain enumeration tool that extracts valid subdomains from certificate transparency logs using Python, ideal for reconnaissance and bug…

hueristiq/xsubfind3r

Passive subdomain discovery tool that aggregates results from multiple online sources via CLI, supporting stdin/stdout, JSONL output, and API key…

osmankandemir/indicator-intelligence

Collects static files from target domains to discover related domains and IPv4 addresses for threat intelligence and IOC enrichment.

joda32/certcrunchy

Just a silly recon tool that uses data from SSL Certificates to find potential host names

piratesshield/apiharvester

The one shot API attacker tool - finds the API url from the given root simulate the automated attacks

rapiddns/rapiddns-cli

A powerful command-line interface for interacting with the [RapidDNS API](https://rapiddns.io/help/api). This tool allows you to perform DNS…

hackplayers/iptodomain

This tool extract domains from IP address based in the information saved in virustotal.