rawfilejson / awesome-osint-arsenal
OSINT & recon toolkit // 100+ tools, one-command installer, SOCMINT, GEOINT, network recon, dark web, forensics & more.
rawfilejson / awesome-osint-arsenal
soxoj / maigret
🕵️♂️ Collect a dossier on a person by username from 6K websites
reconurge / flowsint
A modern platform for visual, flexible, and extensible graph-based investigations. For cybersecurity analysts and investigators.
apurvsinghgautam / robin
AI-Powered Dark Web OSINT Tool
kaifcodec / user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
volatilityfoundation / volatility3
Volatility 3.0 development
Velocidex / velociraptor
Digging Deeper....
HughYau / qiushi-skill
Qiushi-Skill: Build agents that investigate first, focus on the main contradiction, validate in practice, and keep pushing until the work is actually done. 求是Skill——从经典唯物辩证法与实践哲学中提炼出一条总原则和九大方法论工具武装AI大脑。
sleuthkit / sleuthkit
The Sleuth Kit® (TSK) is a library and collection of command line digital forensics tools that allow you to investigate volume and file system data. The library can be incorporated into larger digital forensics tools and the command line tools can be directly used to find evidence.
sepinf-inc / IPED
IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
frankwxu / digital-forensics-lab
Free hands-on digital forensics labs for students and faculty
netwrix / pingcastle
PingCastle - Get Active Directory Security at 80% in 20% of the time
ComplianceAsCode / content
Security automation content in SCAP, Bash, Ansible, and other formats
mesquidar / ForensicsTools
A list of free and open forensics analysis tools and other resources
kpcyrd / sn0int
Semi-automatic OSINT framework and package manager
beenuar / AiSOC
Open-source AI Security Operations Center: alert fusion, LLM-agent triage, MITRE ATT&CK investigation, and a replayable decision ledger for every agent step. Self-hostable, runs with no API keys, MIT licensed. Ships an MCP server for Claude, Cursor and Continue.
0xSteph / pentest-ai-agents
Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.
eset / malware-ioc
Indicators of Compromises (IOC) of our various investigations
microsoft / CyberBattleSim
An experimentation and research platform to investigate the interaction of automated agents in an abstract simulated network environments.
K2SOsint / Legendary_OSINT
A list of OSINT tools & resources for (fraud-)investigators, CTI-analysts, KYC, AML and more.
google-deepmind / bsuite
bsuite is a collection of carefully-designed experiments that investigate core capabilities of a reinforcement learning (RL) agent
tclahr / uac
UAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
nvk / llm-wiki
LLM-compiled knowledge bases for any AI agent. Parallel multi-agent research, thesis-driven investigation, source ingestion, wiki compilation, querying, and artifact generation.
brettkromkamp / contextualise
Contextualise is an effective tool particularly suited for organising information-heavy projects and activities consisting of unstructured and widely diverse data and information resources
intake / intake
Intake is a lightweight package for finding, investigating, loading and disseminating data.
daem0nc0re / PrivFu
Kernel mode WinDbg extension and PoCs for token privilege investigation.
frangelbarrera / OSINT-BIBLE
Comprehensive 2026 OSINT guide — 450+ tools, AI intelligence, methodologies & ethics across 35 sections for investigation & threat intel.
termuxhackers-id / SIGIT
Simple Information Gathering Toolkit
cisagov / untitledgoosetool
Untitled Goose Tool is a robust and flexible hunt and incident response tool that adds novel authentication and data gathering methods in order to run a full investigation against a customer’s Azure Active Directory (AzureAD), Azure, and M365 environments.
elm1nst3r / GHOST-osint-crm
GHOST - Global Human Operations & Surveillance Tracking: Open-source investigation management platform for tracking people, connections, and intelligence data. Because Excel spreadsheets are for accountants, not investigators. Non-commercial license.
SoftInstigate / restheart
A backend for web, mobile, AI and IoT apps. Built on MongoDB
VersusControl / versus-incident
The self-hosted AI SRE agent. You don't have to monitor your systems alone. Versus Incident will keep track of your services, applications, and systems, detect new or unexpected problems, and provide your team with the evidence needed to investigate.
drego85 / tosint
Tosint is a Telegram OSINT tool that extracts actionable intelligence from bot tokens and chat IDs for security investigations.
asamassekou10 / ship-safe
The independent security agent for AI-written software. Finds issues, investigates whether they are real, and shows you the evidence. Deterministic core, no API key needed, JSON and SARIF output.
opensanctions / opensanctions
An open database of international sanctions data, persons of interest and politically exposed persons
TheDuffman85 / crowdsec-web-ui
A self-hosted dashboard for CrowdSec: investigate alerts, manage decisions, monitor runtime metrics, and send notifications from one responsive UI.
ICIJ / datashare
A self‑hosted search engine for documents
tenzir / tenzir
Tenzir is the data pipeline engine for security teams.
samvallad33 / vestige
Think before doing, prove before saving. Vestige is a local, deterministic safety kernel for AI agents. Every memory write and agent action is recorded in Strata, an append-only log, so you can see exactly what your agent did and why.
Johnng007 / Live-Forensicator
Cross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.
rndusr / stig
TUI and CLI for the BitTorrent client Transmission
7onez / cti-expert
CTI Expert — Cyber Threat Intelligence & OSINT analysis skill for Claude Code / Codex. 120+ commands, 57 techniques, 79 typed MCP tools, deterministic case pipeline + ICD-203 reports. No API keys required for core.
jeremykenedy / laravel-logger
Activity logging and an investigation dashboard for Laravel applications. Tested on Laravel 8 through 13. Add it as middleware or call it through a trait.
vognik / maltego-telegram
🔎 OSINT Maltego Transforms for investigating Telegram channels, groups, and users, including deanonymization via stickers, forwarded messages, similar channels, deleted posts, and more.
DouglasFreshHabian / AndroidForensics
Automated Android forensic toolkit: extract device info, apps, contacts, call logs, SMS, system logs, and more via ADB for security audits and investigations.
Psmths / windows-forensic-artifacts
Handbook of windows forensic artifacts across multiple Windows version with interpretation tips and some examples. Work in progress!
RockxyApp / Tracexy
Native, local-first network intelligence for macOS—capture live traffic, inspect PCAP/PCAPNG files, and investigate sessions, protocols, processes, flows, and packet evidence.
bdg9412 / artex-ko-plus
ARTEX 한국어판 ·AI 기반 침해사고 대응 기능 추가 (upstream: Autumn-27/ARTEX, AGPL-3.0)
OSINT-Experts-Society / Consensus-OSINT
🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.
dboudreau00 / NocTORnal
Self-hosted case system for cybercrime investigators. A social network graph where every entity and tie traces to a graded assertion on a WORM-locked exhibit with chain of custody. FastAPI and Postgres, row-level security, TLP gating, two-person controls, one egress proxy.
osintshifu / awesome-osint-repos
Continuously updated catalogue of open-source OSINT tools, skills, plugins, MCP servers, and agentic integrations.
zhiyuwang720-dev / CodeSage
AI-powered code review platform that ranks #1 on AACR-Bench with 52.8% precision, 23.4% recall, and 32.4% F1. Plans PR investigations, runs parallel reviewers, and verifies every finding against code evidence.
Boshen / cargo-bsize
Investigate Rust binary size
SteersmanRelease / lsc
🔥 Lol-Skin-Changer-2026
RomanZhukov9 / Crypto-Recovery-Tool
Python-based cryptocurrency wallet forensics suite supporting 40+ wallet types on Windows, Linux, and macOS. Features encrypted vault analysis, wallet detection, seed recovery, multi-chain address derivation, threaded processing, and TXT/CSV/JSON export. Designed for security research, compliance, incident response, and blockchain investigations.
spainvestigation / Mafia-Old-Country-Companion-Console
Mafia Old Country Ultimate Trainer Hub 2026 Guide for Windows
naomig-6453 / phasmophobia-hack-2026-ghost-investigation-toolkit
Phasmophobia Hack 2026 themed PC toolkit for ghost identification, evidence tracking, investigation planning, equipment management, map notes and contract analytics.
apimarte3 / reverse-engineering-api-de
Reverse-Engineering- und offizielle Routen in einem Index: `-ext`-IDs sind die Reverse-Kennung, der Rest läuft offiziell vergünstigt. AI API gateway / relay: 307 models behind one OpenAI-compatible key. image2.5 $0.0085/image, Seedance 2.0 Mini $0.01056/sec, LLM from $0.0228/M tokens. USD settlement, pay-as-you-go, $1 minimum top-up.
apimartkv1qavpa / unofficial-api-gateway-de
Reverse-Engineering- und offizielle Routen in einem Index: `-ext`-IDs sind die Reverse-Kennung, der Rest läuft offiziell vergünstigt. AI API gateway / relay: 307 models behind one OpenAI-compatible key. image2.5 $0.0085/image, Seedance 2.0 Mini $0.01056/sec, LLM from $0.0228/M tokens. USD settlement, pay-as-you-go, $1 minimum top-up.
apimartg / reverse-engineered-api-de
Reverse-Engineering- und offizielle Routen in einem Index: `-ext`-IDs sind die Reverse-Kennung, der Rest läuft offiziell vergünstigt. AI API gateway / relay: 307 models behind one OpenAI-compatible key. image2.5 $0.0085/image, Seedance 2.0 Mini $0.01056/sec, LLM from $0.0228/M tokens. USD settlement, pay-as-you-go, $1 minimum top-up.