rawfilejson / awesome-osint-arsenal
OSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.
rawfilejson / awesome-osint-arsenal
thewhiteh4t / seeker
Accurately Locate Smartphones using Social Engineering
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
soxoj / maigret
🕵️♂️ Collect a dossier on a person by username from 6K websites
laramies / theHarvester
E-mails, subdomains and names Harvester - OSINT
projectdiscovery / subfinder
Fast passive subdomain enumeration tool.
lockfale / OSINT-Framework
OSINT Framework
yogeshojha / rengine
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
six2dez / reconftw
reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities
j3ssie / osmedeus
A Modern Orchestration Engine for Security
ivre / ivre
Network recon framework. Build your own, self-hosted and fully-controlled alternatives to Shodan / ZoomEye / Censys and GreyNoise, run your Passive DNS service, build your taylor-made EASM tool, collect and analyse network intelligence from your sensors, and much more! Uses Nmap, Masscan, Zeek, p0f, ProjectDiscovery tools, etc.
leebaird / discover
Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited support for Kali Linux.
ibnaleem / gosearch
🔍 Search anyone's digital footprint across 300+ websites
edoardottt / cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
blechschmidt / massdns
A high-performance DNS stub resolver for bulk lookups and reconnaissance (subdomain enumeration)
Alfredredbird / tookie-osint
Tookie is a advanced OSINT information gathering tool that finds social media accounts based on inputs.
projectdiscovery / uncover
Quickly discover exposed hosts on the internet using multiple search engines.
kpcyrd / sn0int
Semi-automatic OSINT framework and package manager
Jieyab89 / OSINT-Cheat-sheet
OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.
lkarlslund / Adalanche
Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?
trickest / wordlists
Real-world infosec wordlists, updated regularly
OpenOSINT / OpenOSINT
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
projectdiscovery / shuffledns
MassDNS wrapper written in go to enumerate valid subdomains using active bruteforce as well as resolve subdomains with wildcard filtering and easy input-output support.
KatrielMoses / MailAccess
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
freelabz / secator
secator - the pentester's swiss knife
edoardottt / scilla
Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration
xalgorix / xalgorix
Autonomous AI pentesting agents — real-time reconnaissance, vulnerability detection, and exploitation orchestration. Go + TypeScript.
pikpikcu / airecon
AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance — without any API keys or cloud dependency.
Zarcolio / sitedorks
Search Google/Bing/Ecosia/DuckDuckGo/Yandex/Yahoo for a search term (dork) with a default set of websites, bug bounty programs or custom collection.
stanislav-web / OpenDoor
OWASP Web Recon & Directory Discovery Platform
reconmap / reconmap
Reconmap is a collaboration-first security operations platform for infosec teams and MSSPs, enabling end‑to‑end engagement management, from reconnaissance through execution and reporting. With built-in command automation, output parsing, and AI‑assisted summaries, it delivers faster, more structured, and high‑quality security assessments.
termuxhackers-id / SIGIT
Simple Information Gathering Toolkit
Zyrexnn / Cybermes
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
projectdiscovery / urlfinder
A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
vil / H4X-Tools
A modular, terminal-based toolkit for OSINT, reconnaissance, and scraping - built in Python, runs on Linux and Windows.
RevoltSecurities / Subdominator
SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty
chadi0x / TheBigBrother
The Big Brother is a weaponized OSINT platform featuring username enumeration (473+ platforms), quad-vector visual intelligence, Sky Radar tracking, crypto wallet analysis, SSL intelligence, digital footprint reconstruction, EXIF extraction, advanced dorking, and network reconnaissance.
hueristiq / xurlfind3r
A command-line tool for discovering URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly available.
natlas / natlas
Attack Surface Management since before Attack Surface Management was a thing
AnonCatalyst / Ominis-OSINT
This Python application is an OSINT (Open Source Intelligence) tool called "Ominis OSINT - Web Hunter." It performs online information gathering by querying Google for search results related to a user-inputted query. The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
vflame6 / leaker
Passive leak enumeration tool.
edoardottt / csprecon
Discover new target domains using Content Security Policy
shinthink / blitzstrike
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
eldarshiraliyev / BugScanner
🐛 Advanced web vulnerability scanner with 5-rule false-positive reduction, WAF evasion, and modern HTML reports
Kerlooo / FreeOSINTUI
Free alternative to https://osint-ui.com
argcyberskillhub / OSINT-X
OSINT-X is a terminal-based Open Source Intelligence and reconnaissance tool.
UseOSINT / Skills
28 OSINT Agent Skills that turn Cursor, Claude & AI coding agents into a full open-source intelligence platform — reconnaissance, attribution, GEOINT, breach checks & due diligence. Ethical, sourced, passive-first.
Ashmmmm / crockTail
crockTail is a passive OSINT (Open Source Intelligence) reconnaissance tool. Given a target domain, it aggregates publicly available information — DNS records, IP/ASN ownership, SSL/TLS certificate details, and domain registration data — into a single consolidated report.
hackwither / reap
reconnaissance for agent attack surfaces
DevCop95 / shodan_reconsx
Portable passive hostname reconnaissance through Shodan CTL
Tangruwo / RuwoScan
基于多智能体架构与自主决策机制，配合大语言模型的理解能力，输入自然语言指令，AI 自动完成从目标侦察到漏洞验证的完整渗透测试流程。
shaikarifali / bundlebleed
AI/LLM-assisted JS Recon and vulnerability triage for authorized bug bounty testing & pentesting — scope-gated, passive-by-default, human-verified
cleonaia / hack_cameraWeb
This project is used analyzing my own webcam’s network traffic from Kali Linux. The workflow uses Ettercap for an ARP MiTM demonstration, Wireshark for traffic analysis and Metasploit as an external lab tool. This repository also includes camera discovery and authenticated RTSP playback.
brooklynkray / in-the-dark
A guided cybersecurity reconnaissance and enumeration tool that helps learners understand what they discover and decide what to investigate next.
weidutech / pi-recon
Lightweight AI red teaming harness for authorized agent / GenAI challenges (BCTF Agent Plus–style): schedule, bounded recon, validate, digest.
kaifcodec / phonsint
🕵️♂️ Advanced phone number OSINT suite engineered for silent reconnaissance. Extracts masked emails, profile avatars and uncovers cross-platform account registrations, and enriches identity footprints with zero SMS alerts.