From 8fba2d0b653fec7ef4e051c5fbd0397335e0d088 Mon Sep 17 00:00:00 2001 From: s0lray Date: Thu, 26 Mar 2026 12:09:27 -0400 Subject: [PATCH 01/22] Add Compliance & Risk Intelligence category (THE-61) - Added new top-level category with 4 subcategories and 13 tools: - Sanctions Screening: OpenSanctions, OFAC, EU Sanctions Tool, dilisense - KYC / AML Tools: NameScan, OpenScreening, Companies House - Beneficial Ownership Lookup: OpenOwnership, ICIJ Offshore Leaks, OCCRP Aleph - PEP Databases: PepChecker, Ukraine PEP Register, EveryPolitician - Removed orphaned Public Records > Sanctions / PEP node (OpenSanctions already listed under Threat Intelligence > Terrorism & Extremism > Sanctions & Watchlists) - Category positioned after Public Records in the tree Co-Authored-By: Paperclip --- public/arf.json | 15578 +++++++++++++++++++++++----------------------- 1 file changed, 7909 insertions(+), 7669 deletions(-) diff --git a/public/arf.json b/public/arf.json index 086d965..14eb620 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1,7670 +1,7910 @@ { - "name": "OSINT Framework", - "type": "folder", - "children": [ - { - "name": "Username", - "type": "folder", - "children": [ - { - "name": "Username Search Engines", - "type": "folder", - "children": [ - { - "name": "Sylva Identity Discovery (T)", - "type": "url", - "url": "https://sylva.pfeister.dev/", - "description": "Open-source CLI tool for username and identity discovery with branch discovery to expand searches as additional linked identities are uncovered.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration with identity branching", - "input": "Username", - "output": "Linked accounts and identities across platforms", - "opsec": "active", - "opsecNote": "Makes requests to target platforms to check username existence; external API keys may be used.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Sherlock (T)", - "type": "url", - "url": "https://github.com/sherlock-project/sherlock", - "description": "Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.", - "status": "live", - "pricing": "free", - "bestFor": "Mass username enumeration across 400+ sites", - "input": "Username(s)", - "output": "List of discovered profile URLs across social networks", - "opsec": "active", - "opsecNote": "Directly queries each target site to check username existence; supports Tor/proxy for anonymity.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Namechk", - "type": "url", - "url": "https://namechk.com/", - "description": "Web-based username and domain availability checker that searches 100+ social media platforms and 36 domain extensions simultaneously.", - "status": "live", - "pricing": "free", - "bestFor": "Quick username availability check across social media and domains", - "input": "Username or domain name", - "output": "Availability status across 100+ platforms and domain extensions", - "opsec": "passive", - "opsecNote": "Searches are routed through Namechk's servers; target accounts are not directly contacted by the user.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "WhatsMyName (T)", - "type": "url", - "url": "https://github.com/WebBreacher/WhatsMyName", - "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration using community-maintained site detection data", - "input": "Username", - "output": "List of sites where the username exists, based on HTTP response pattern matching", - "opsec": "active", - "opsecNote": "Makes HTTP requests to each target site to check for username existence.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Thats Them", - "type": "url", - "url": "https://thatsthem.com/", - "description": "Free people search engine aggregating data from 50+ sources. Supports lookups by name, address, phone number, or email.", - "status": "live", - "pricing": "freemium", - "bestFor": "People search by name, email, phone, or address", - "input": "Name, email address, phone number, or physical address", - "output": "Contact info, residential details, demographics, and financial estimates", - "opsec": "passive", - "opsecNote": "Searches are routed through ThatsThem's servers; the target is not alerted.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "NameCheckup", - "type": "url", - "url": "https://namecheckup.com/", - "description": "Free web-based username and domain availability checker that searches across 20+ social media platforms and 40+ domain extensions with WHOIS lookup support.", - "status": "live", - "pricing": "free", - "bestFor": "Username and domain availability checking with WHOIS info", - "input": "Username or domain name", - "output": "Availability status across social platforms and domain extensions, with WHOIS data", - "opsec": "passive", - "opsecNote": "Searches are proxied through NameCheckup's servers; no direct contact with target platforms by the user.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "GitFive (T)", - "type": "url", - "url": "https://github.com/mxrch/GitFive", - "description": "OSINT CLI tool for investigating GitHub profiles. Tracks username/name history, maps emails to accounts, extracts SSH public keys, and exports findings as JSON.", - "status": "live", - "pricing": "free", - "bestFor": "Deep investigation of GitHub user profiles and email-to-account mapping", - "input": "GitHub username or email address", - "output": "Profile history, linked emails, SSH keys, repository analysis, JSON export", - "opsec": "active", - "opsecNote": "Queries GitHub API directly; developer recommends using a secondary GitHub account.", - "localInstall": true, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Sherlock", - "type": "url", - "url": "https://github.com/sherlock-project/sherlock", - "description": "Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.", - "status": "live", - "pricing": "free", - "bestFor": "Mass username enumeration across 400+ sites", - "input": "Username(s)", - "output": "List of discovered profile URLs across social networks", - "opsec": "active", - "opsecNote": "Directly queries each target site to check username existence; supports Tor/proxy for anonymity.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Names Directory", - "type": "url", - "url": "https://namesdir.com/", - "description": "Searchable database of 1B+ name combinations collected from public sources. Allows bidirectional lookup to find first names by surname or surnames by first name.", - "status": "live", - "pricing": "free", - "bestFor": "Finding name combinations and frequency data for a given first or last name", - "input": "First name or surname", - "output": "Associated name combinations with frequency counts", - "opsec": "passive", - "opsecNote": "Queries a static public database; no contact with any target individual.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Lullar", - "type": "url", - "url": "https://com.lullar.com", - "description": "Free people search and username lookup tool that searches across 148+ social media platforms including Instagram, TikTok, Facebook, and LinkedIn.", - "status": "live", - "pricing": "free", - "bestFor": "Social media profile discovery by username, email, or name", - "input": "Email address, full name, or username", - "output": "Social media profiles found across 148+ platforms", - "opsec": "passive", - "opsecNote": "Searches are routed through Lullar's servers; no direct queries from the user to target platforms.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - } - ] - }, - { - "name": "Specific Sites", - "type": "folder", - "children": [ - { - "name": "Amazon Usernames (M)", - "type": "url", - "url": "https://www.google.com/search?q=site:amazon.com+%3Cusername%3E", - "description": "Google dork that searches Amazon.com for pages associated with a specific username, surfacing public profiles, wishlists, and reviews.", - "status": "live", - "pricing": "free", - "bestFor": "Finding Amazon public profiles, wishlists, and review activity by username", - "input": "Username (inserted into Google search query)", - "output": "Google search results linking to Amazon pages mentioning the username", - "opsec": "passive", - "opsecNote": "Query goes to Google, not Amazon directly. Google may log the search but the target is not alerted.", - "localInstall": false, - "googleDork": true, - "registration": false, - "editUrl": true, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Github User (M)", - "type": "url", - "url": "https://api.github.com/users/%3Cusername%3E/events/public", - "description": "Queries the GitHub public Events API to retrieve a user's recent public activity, including pushes, pull requests, issues, and other repository events.", - "status": "live", - "pricing": "free", - "bestFor": "Enumerating a GitHub user's recent public activity and repository interactions", - "input": "GitHub username (inserted into URL path)", - "output": "JSON array of public events (pushes, PRs, issues, comments) with timestamps and repo details", - "opsec": "passive", - "opsecNote": "Unauthenticated API call; GitHub rate-limits by IP (60 req/hr) but does not notify the target user.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Tinder Usernames (M)", - "type": "url", - "url": "https://www.gotinder.com/@%3Cusername%3E", - "description": "Accesses a Tinder user's public web profile via their username. The gotinder.com domain redirects to tinder.com.", - "status": "live", - "pricing": "free", - "bestFor": "Confirming existence of a Tinder profile and viewing public profile details", - "input": "Tinder username (appended to URL after @)", - "output": "Public profile page with name, photo, and basic info if the user has web sharing enabled", - "opsec": "passive", - "opsecNote": "Simple HTTP GET to a public page; target is not notified of profile views via the web URL.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Keybase", - "type": "url", - "url": "https://keybase.io/", - "description": "Platform for cryptographic identity verification, linking social media accounts, PGP keys, and cryptocurrency addresses to a single profile. Acquired by Zoom in 2020 but still operational.", - "status": "live", - "pricing": "free", - "bestFor": "Looking up verified social accounts, PGP keys, and crypto wallets tied to a username", - "input": "Username", - "output": "User profile showing verified identities across platforms, PGP keys, cryptocurrency addresses, and devices", - "opsec": "passive", - "opsecNote": "Public profile lookups are passive web requests. No login required to view profiles.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "MIT PGP Key Server", - "type": "url", - "url": "https://pgp.mit.edu/", - "description": "MIT PGP Public Key Server for searching, submitting, and removing PGP public keys. Look up keys by name, email, or key ID to find associated cryptographic identities.", - "status": "live", - "pricing": "free", - "bestFor": "Looking up PGP public keys associated with a username or email address", - "input": "Name, email address, or key ID", - "output": "PGP public key data, key fingerprints, associated UIDs/email addresses, and key metadata", - "opsec": "passive", - "opsecNote": "Public key server query; no authentication required and target is not notified of lookups.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "ProtonMail users (M)", - "type": "url", - "url": "https://api.protonmail.ch/pks/lookup?op=index&search=@protonmail.com", - "description": "Queries ProtonMail's HKP-compatible PGP key server to look up the public key for a ProtonMail username. A successful response confirms the account exists.", - "status": "live", - "pricing": "free", - "bestFor": "Confirming whether a ProtonMail username exists and retrieving its PGP public key", - "input": "ProtonMail username (appended with @protonmail.com)", - "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", - "opsec": "passive", - "opsecNote": "Unauthenticated API query to ProtonMail's public key server. Target user is not notified. Enables user enumeration.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "ProtonMail Domains (M)", - "type": "url", - "url": "https://api.protonmail.ch/pks/lookup?op=index&search=", - "description": "Queries ProtonMail's HKP key server with a full email address to check for a PGP public key. Useful for identifying ProtonMail users on custom domains.", - "status": "live", - "pricing": "free", - "bestFor": "Checking if an email address on a custom domain is hosted on ProtonMail", - "input": "Full email address (any domain that may be hosted on ProtonMail)", - "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", - "opsec": "passive", - "opsecNote": "Unauthenticated public HKP endpoint. Target is not notified. Can reveal whether a custom domain uses ProtonMail.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "deprecated": false - } - ] - } - ] - }, - { - "name": "Email Address", - "type": "folder", - "children": [ - { - "name": "Email Search", - "type": "folder", - "children": [ - { - "name": "Sylva Identity Discovery (T)", - "type": "url", - "url": "https://sylva.pfeister.dev/" - }, - { - "name": "ThatsThem", - "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" - }, - { - "name": "Hunter", - "type": "url", - "url": "https://hunter.io/" - }, - { - "name": "Email to Address (R)", - "type": "url", - "url": "https://www.melissa.com/" - }, - { - "name": "VoilaNorbert", - "type": "url", - "url": "https://www.voilanorbert.com/" - }, - { - "name": "GHunt (T)", - "type": "url", - "url": "https://github.com/mxrch/GHunt" - }, - { - "name": "OSINT Industries", - "type": "url", - "url": "https://www.osint.industries/" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Infoga (T)", - "type": "url", - "url": "https://github.com/m4ll0k/infoga" - }, - { - "name": "Skymem", - "type": "url", - "url": "https://www.skymem.info/" - }, - { - "name": "Epieos Email Tool", - "type": "url", - "url": "https://tools.epieos.com/email.php" - }, - { - "name": "breach.vip", - "type": "url", - "url": "https://breach.vip/" - }, - { - "name": "Holehe (T)", - "type": "url", - "url": "https://github.com/megadose/holehe" - } - ] - }, - { - "name": "Common Email Formats", - "type": "folder", - "children": [ - { - "name": "Email Format", - "type": "url", - "url": "https://www.email-format.com/" - }, - { - "name": "Email Permutator", - "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" - } - ] - }, - { - "name": "Email Verification", - "type": "folder", - "children": [ - { - "name": "Reacher Github (T)", - "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" - }, - { - "name": "Reacher Demo", - "type": "url", - "url": "https://reacher.email" - }, - { - "name": "MailScrap", - "type": "url", - "url": "https://mailscrap.com/" - }, - { - "name": "Read Notify", - "type": "url", - "url": "https://www.readnotify.com/" - }, - { - "name": "Email Reputation", - "type": "url", - "url": "https://emailrep.io/" - }, - { - "name": "MailboxValidator", - "type": "url", - "url": "https://www.mailboxvalidator.com/demo" - }, - { - "name": "VerifyEmail (R$)", - "type": "url", - "url": "https://emailable.com/" - } - ] - }, - { - "name": "Breach Data", - "type": "folder", - "children": [ - { - "name": "Have I been pwned?", - "type": "url", - "url": "https://haveibeenpwned.com/", - "description": "Database of breached credentials and email addresses from known data breaches.", - "status": "live", - "pricing": "freemium", - "bestFor": "Breach detection, credential exposure checks", - "input": "Email address, phone number, password hash", - "output": "Breach names, breach dates, exposed data types", - "opsec": "passive", - "opsecNote": "Queries breach database via API. Target is not notified of lookups.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Hudson Rock", - "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" - }, - { - "name": "DeHashed (R)", - "type": "url", - "url": "https://dehashed.com/" - }, - { - "name": "Vigilante.pw", - "type": "url", - "url": "https://www.vigilante.pw/" - } - ] - }, - { - "name": "Mail Blacklists", - "type": "folder", - "children": [ - { - "name": "MxToolbox", - "type": "url", - "url": "https://mxtoolbox.com/" - } - ] - } - ] - }, - { - "name": "Domain Name", - "type": "folder", - "children": [ - { - "name": "Whois Records", - "type": "folder", - "children": [ - { - "name": "Domain Dossier", - "type": "url", - "url": "https://centralops.net/co/DomainDossier.aspx" - }, - { - "name": "domainIQ", - "type": "url", - "url": "https://www.domainiq.com/" - }, - { - "name": "DomainTools Whois", - "type": "url", - "url": "https://whois.domaintools.com/" - }, - { - "name": "SWITCH Internet Domains Whois (.ch)", - "type": "url", - "url": "https://www.nic.ch/whois/" - }, - { - "name": "Whoisology", - "type": "url", - "url": "https://whoisology.com/#advanced" - }, - { - "name": "Whois ARIN", - "type": "url", - "url": "https://whois.arin.net/ui/advanced.jsp" - }, - { - "name": "DNSstuff", - "type": "url", - "url": "https://www.dnsstuff.com/freetools" - }, - { - "name": "Robtex (R)", - "type": "url", - "url": "https://robtex.com/" - }, - { - "name": "Domaincrawler.com", - "type": "url", - "url": "https://domaincrawler.com/" - }, - { - "name": "MarkMonitor Whois Search", - "type": "url", - "url": "https://domains.markmonitor.com/whois/" - }, - { - "name": "easyWhois", - "type": "url", - "url": "https://www.easywhois.com/" - }, - { - "name": "Website Informer", - "type": "url", - "url": "https://website.informer.com/" - }, - { - "name": "Who.is", - "type": "url", - "url": "https://who.is/" - }, - { - "name": "Whois AMPed", - "type": "url", - "url": "https://whoisamped.com/" - }, - { - "name": "ViewDNS.info", - "type": "url", - "url": "https://viewdns.info/" - }, - { - "name": "Daily DNS Changes", - "type": "url", - "url": "https://dailychanges.domaintools.com/" - }, - { - "name": "IP2WHOIS", - "type": "url", - "url": "https://www.ip2whois.com" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/whois_domains/" - } - ] - }, - { - "name": "Subdomains", - "type": "folder", - "children": [ - { - "name": "SynapsInt", - "type": "url", - "url": "https://synapsint.com" - }, - { - "name": "Aquatone (T)", - "type": "url", - "url": "https://github.com/michenriksen/aquatone" - }, - { - "name": "FindSubDomains", - "type": "url", - "url": "https://findsubdomains.com/" - }, - { - "name": "Google Subdomains (D)", - "type": "url", - "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" - }, - { - "name": "Recon-ng (T)", - "type": "url", - "url": "https://github.com/lanmaster53/recon-ng", - "description": "Full-featured web reconnaissance framework with independent modules for data gathering.", - "status": "live", - "pricing": "free", - "bestFor": "Modular web recon, API-driven data collection", - "input": "Domain, company name, email, IP", - "output": "Contacts, hosts, credentials, ports via module-specific results", - "opsec": "passive", - "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "XRay", - "type": "url", - "url": "https://github.com/evilsocket/xray" - }, - { - "name": "DNS Recon (T)", - "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" - }, - { - "name": "Gobuster (T)", - "type": "url", - "url": "https://github.com/OJ/gobuster" - }, - { - "name": "Fierce Domain Scanner (T)", - "type": "url", - "url": "https://github.com/davidpepper/fierce-domain-scanner" - }, - { - "name": "Bluto (T)", - "type": "url", - "url": "https://github.com/darryllane/Bluto" - }, - { - "name": "OWASP Maryam (T)", - "type": "url", - "url": "https://github.com/saeeddhqan/Maryam" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Pentest-tools.com Subdomains", - "type": "url", - "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" - }, - { - "name": "SecLists DNS Subdomains (T)", - "type": "url", - "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" - }, - { - "name": "dnspop (T)", - "type": "url", - "url": "https://github.com/bitquark/dnspop" - }, - { - "name": "gdns (T)", - "type": "url", - "url": "https://github.com/hrbrmstr/gdns" - }, - { - "name": "Sublist3r", - "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" - }, - { - "name": "AltDNS (T)", - "type": "url", - "url": "https://github.com/infosec-au/altdns" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/domains/" - } - ] - }, - { - "name": "Discovery", - "type": "folder", - "children": [ - { - "name": "Shodan", - "type": "url", - "url": "https://www.shodan.io/", - "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", - "status": "live", - "pricing": "freemium", - "bestFor": "Port scanning, banner grabbing, IoT discovery", - "input": "IP address, domain", - "output": "Open ports, services, banners, CVEs", - "opsec": "passive", - "opsecNote": "Queries cached scan data. Does not directly probe the target.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/" - }, - { - "name": "Kraken (T)", - "type": "url", - "url": "https://github.com/Sw4mpf0x/Kraken" - }, - { - "name": "Online Nikto scanner", - "type": "url", - "url": "https://nikto.online/" - }, - { - "name": "urlscan.io", - "type": "url", - "url": "https://urlscan.io/search/#*" - }, - { - "name": "Daily DNS Changes", - "type": "url", - "url": "https://dailychanges.domaintools.com/" - }, - { - "name": "Redirect Detective", - "type": "url", - "url": "https://redirectdetective.com/" - }, - { - "name": "Sitediff (T)", - "type": "url", - "url": "https://github.com/digininja/sitediff" - }, - { - "name": "BuiltWith", - "type": "url", - "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", - "status": "live", - "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", - "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Wappalyzer", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "AnalyzeID", - "type": "url", - "url": "https://analyzeid.com/" - }, - { - "name": "Criminal IP Search", - "type": "url", - "url": "https://www.criminalip.io/" - }, - { - "name": "urlDNA", - "type": "url", - "url": "https://urldna.io" - }, - { - "name": "ZoomEye.ai", - "type": "url", - "url": "https://www.zoomeye.org/" - } - ] - }, - { - "name": "Certificate Search", - "type": "folder", - "children": [ - { - "name": "Shodan", - "type": "url", - "url": "https://www.shodan.io/" - }, - { - "name": "Google's Certificate Transparency", - "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" - }, - { - "name": "Spyse", - "type": "url", - "url": "https://spyse.com/search/certificate" - }, - { - "name": "Censys", - "type": "url", - "url": "https://censys.io/", - "description": "Internet-wide scanner and search engine for hosts, certificates, and services.", - "status": "live", - "pricing": "freemium", - "bestFor": "Certificate discovery, host enumeration, exposure monitoring", - "input": "Domain, IP, certificate fingerprint, search query", - "output": "Host details, open ports, TLS certificates, service banners", - "opsec": "passive", - "opsecNote": "Queries pre-scanned data. Does not probe the target directly.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "crt.sh - Certificate Search", - "type": "url", - "url": "https://crt.sh/?" - }, - { - "name": "CertKit - Certificate Transparency Log Search", - "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" - }, - { - "name": "certgraph (T)", - "type": "url", - "url": "https://github.com/lanrat/certgraph" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/certs/" - } - ] - }, - { - "name": "PassiveDNS", - "type": "folder", - "children": [ - { - "name": "Mnemonic", - "type": "url", - "url": "https://passivedns.mnemonic.no/" - }, - { - "name": "DNS Dumpster", - "type": "url", - "url": "https://dnsdumpster.com/" - }, - { - "name": "Deteque (R)", - "type": "url", - "url": "https://www.deteque.com/" - } - ] - }, - { - "name": "Reputation", - "type": "folder", - "children": [ - { - "name": "UrlQuery.net", - "type": "url", - "url": "https://urlquery.net/" - }, - { - "name": "URL Void", - "type": "url", - "url": "https://www.urlvoid.com/" - }, - { - "name": "FortiGuard Reputation Service", - "type": "url", - "url": "https://fortiguard.com/iprep" - }, - { - "name": "Trend Micro Site Safety Center", - "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" - }, - { - "name": "WatchGuard ReputationAuthority", - "type": "url", - "url": "https://www.reputationauthority.org/" - }, - { - "name": "Sucuri SiteCheck", - "type": "url", - "url": "https://sitecheck.sucuri.net/" - }, - { - "name": "ThreatMiner.org", - "type": "url", - "url": "https://www.threatminer.org/" - }, - { - "name": "BlueCoat WebPulse", - "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" - }, - { - "name": "Zscaler Zulu URL Risk Analyzer", - "type": "url", - "url": "https://zulu.zscaler.com/" - }, - { - "name": "Joe Sandbox Url Analyzer", - "type": "url", - "url": "https://www.url-analyzer.net/" - }, - { - "name": "Deepviz Domain Search", - "type": "url", - "url": "https://search.deepviz.com/" - }, - { - "name": "AVG Threat Labs", - "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" - }, - { - "name": "Webroot BrightCloud URL/IP Lookup", - "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" - }, - { - "name": "vURL Online", - "type": "url", - "url": "https://vurldissect.co.uk/" - }, - { - "name": "AlienVault Open Threat Exchange", - "type": "url", - "url": "https://otx.alienvault.com/browse/pulses/" - }, - { - "name": "Malware Domain List", - "type": "url", - "url": "https://www.malwaredomainlist.com/mdl.php" - }, - { - "name": "Web Inspector Online Scan", - "type": "url", - "url": "https://www.webinspector.com/website-malware-scanner/" - }, - { - "name": "Google Safe Browsing API", - "type": "url", - "url": "https://developers.google.com/safe-browsing/?csw=1" - }, - { - "name": "Cisco Talos", - "type": "url", - "url": "https://talosintelligence.com/" - } - ] - }, - { - "name": "Domain Blacklists", - "type": "folder", - "children": [ - { - "name": "Threatexpert.com Malicious URLs", - "type": "url", - "url": "https://www.networksec.org/grabbho/block.txt" - }, - { - "name": "Zeus C2 Tracker", - "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" - }, - { - "name": "Malware Domains Blacklist", - "type": "url", - "url": "https://mirror1.malwaredomains.com/files/domains.txt" - }, - { - "name": "Blackweb", - "type": "url", - "url": "https://github.com/maravento/blackweb" - }, - { - "name": "Critical Stack Intel (R)", - "type": "url", - "url": "https://intel.criticalstack.com/" - }, - { - "name": "DNS Sinkhole", - "type": "url", - "url": "https://malc0de.com/bl/" - }, - { - "name": "DNS-BH Malware Domain Blocklist", - "type": "url", - "url": "https://www.malwaredomains.com/wordpress/?page_id=66" - }, - { - "name": "Malware Domain List", - "type": "url", - "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" - }, - { - "name": "MalwareURL (R)", - "type": "url", - "url": "https://www.malwareurl.com/index.php" - }, - { - "name": "scumware.org", - "type": "url", - "url": "https://www.scumware.org/" - }, - { - "name": "ZeuS Tracker", - "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php" - }, - { - "name": "Shadowserver Foundation", - "type": "url", - "url": "https://www.shadowserver.org/" - }, - { - "name": "Email Domain Validation", - "type": "url", - "url": "https://www.mailboxvalidator.com/domain" - } - ] - }, - { - "name": "Typosquatting", - "type": "folder", - "children": [ - { - "name": "DNS Twist (T)", - "type": "url", - "url": "https://github.com/elceef/dnstwist" - }, - { - "name": "URLCrazy (T)", - "type": "url", - "url": "https://www.morningstarsecurity.com/research/urlcrazy" - }, - { - "name": "dnstwister", - "type": "url", - "url": "https://dnstwister.report/" - }, - { - "name": "Catphish (T)", - "type": "url", - "url": "https://github.com/ring0lab/catphish" - } - ] - }, - { - "name": "Analytics", - "type": "folder", - "children": [ - { - "name": "BuiltWith", - "type": "url", - "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", - "status": "live", - "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", - "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "SiteSleuth", - "type": "url", - "url": "https://www.sitesleuth.io/" - }, - { - "name": "Wappalyzer (T)", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "SEMrush", - "type": "url", - "url": "https://www.semrush.com/" - }, - { - "name": "Moonsearch", - "type": "url", - "url": "https://moonsearch.com/" - }, - { - "name": "Ewhois", - "type": "url", - "url": "https://ewhois.com/" - }, - { - "name": "StatsCrop", - "type": "url", - "url": "https://www.statscrop.com/" - }, - { - "name": "Open Site Explorer", - "type": "url", - "url": "https://moz.com/link-explorer" - }, - { - "name": "SpyOnWeb", - "type": "url", - "url": "https://www.spyonweb.com/" - }, - { - "name": "Keyword Density", - "type": "url", - "url": "https://tools.seobook.com/general/keyword-density/" - }, - { - "name": "Alexa Site Statistics", - "type": "url", - "url": "https://alexa.amazon.com/about" - }, - { - "name": "Cisco Umbrella Popularity List", - "type": "url", - "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" - }, - { - "name": "Alexa Top 500 Global Sites", - "type": "url", - "url": "https://alexa.amazon.com/about" - }, - { - "name": "Sitedossier", - "type": "url", - "url": "https://www.sitedossier.com/" - }, - { - "name": "Visual Site Mapper", - "type": "url", - "url": "https://github.com/alentum/sitemapper-nodejs" - }, - { - "name": "ClearWebStats.com", - "type": "url", - "url": "https://www.clearwebstats.com/" - }, - { - "name": "PubDB", - "type": "url", - "url": "https://pub-db.com/" - }, - { - "name": "SimilarWeb", - "type": "url", - "url": "https://www.similarweb.com/" - }, - { - "name": "Siteliner", - "type": "url", - "url": "https://www.siteliner.com/" - }, - { - "name": "WhatWeb", - "type": "url", - "url": "https://github.com/urbanadventurer/WhatWeb" - } - ] - }, - { - "name": "URL Expanders", - "type": "folder", - "children": [ - { - "name": "Link Expander", - "type": "url", - "url": "https://www.linkexpander.com/" - }, - { - "name": "CheckShortURL", - "type": "url", - "url": "https://checkshorturl.com/" - }, - { - "name": "URL Expander", - "type": "url", - "url": "https://urlex.org/" - }, - { - "name": "Where Does This Link Go?", - "type": "url", - "url": "https://wheregoes.com/" - }, - { - "name": "KnowURL", - "type": "url", - "url": "https://www.knowurl.com/" - } - ] - }, - { - "name": "Change Detection", - "type": "folder", - "children": [ - { - "name": "VisualPing", - "type": "url", - "url": "https://visualping.io:443/" - }, - { - "name": "Change Detection", - "type": "url", - "url": "https://visualping.io/" - }, - { - "name": "Check site availability Online", - "type": "url", - "url": "https://upcheck.online/" - }, - { - "name": "Follow That Page", - "type": "url", - "url": "https://www.followthatpage.com/" - }, - { - "name": "Urlwatch", - "type": "url", - "url": "https://github.com/thp/urlwatch" - }, - { - "name": "WatchThatPage", - "type": "url", - "url": "https://watchthatpage.com/" - }, - { - "name": "ChangeDetect", - "type": "url", - "url": "https://www.eatgrainmaker.com/home/" - } - ] - }, - { - "name": "Social Analysis", - "type": "folder", - "children": [ - { - "name": "Google Trends", - "type": "url", - "url": "https://trends.google.com/trends/" - } - ] - }, - { - "name": "DNSSEC", - "type": "folder", - "children": [ - { - "name": "DNSSEC Analyzer", - "type": "url", - "url": "https://dnssec-analyzer.verisignlabs.com/" - }, - { - "name": "DNSViz", - "type": "url", - "url": "https://dnsviz.net/" - } - ] - }, - { - "name": "Vulnerabilities", - "type": "folder", - "children": [ - { - "name": "Scanners", - "type": "folder", - "children": [ - { - "name": "Sn1per (T)", - "type": "url", - "url": "https://github.com/1N3/Sn1per" - }, - { - "name": "Online Nikto scanner", - "type": "url", - "url": "https://nikto.online/" - }, - { - "name": "WDES - Web Data Exposure Scanner (T)", - "type": "url", - "url": "https://github.com/eduardoit/web-data-exposure-scanner" - } - ] - }, - { - "name": "Disclosure Sites", - "type": "folder", - "children": [ - { - "name": "Zone-H.org", - "type": "url", - "url": "https://zone-h.org/archive" - } - ] - }, - { - "name": "RobotsDisallowed", - "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" - } - ] - }, - { - "name": "Tools", - "type": "folder", - "children": [ - { - "name": "Belati (T)", - "type": "url", - "url": "https://github.com/aancw/Belati" - }, - { - "name": "Burp Suite (T)", - "type": "url", - "url": "https://portswigger.net/burp" - }, - { - "name": "EyeWitness (T)", - "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" - }, - { - "name": "Hunting-New-Registered-Domains (T)", - "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" - }, - { - "name": "International Domain Name Conversion Tool", - "type": "url", - "url": "https://mct.verisign-grs.com/" - }, - { - "name": "Online Nikto scanner", - "type": "url", - "url": "https://nikto.online/" - } - ] - }, - { - "name": "Report Malicious Sites", - "type": "folder", - "children": [ - { - "name": "Microsoft", - "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" - }, - { - "name": "Google", - "type": "url", - "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" - } - ] - } - ] - }, - { - "name": "Cloud Infrastructure", - "type": "folder", - "children": [ - { - "name": "AWS Enumeration", - "type": "folder", - "children": [ - { - "name": "cloud_enum (T)", - "type": "url", - "url": "https://github.com/initstring/cloud_enum" - }, - { - "name": "AWSBucketDump (T)", - "type": "url", - "url": "https://github.com/jordanpotti/AWSBucketDump" - }, - { - "name": "Subfinder (T)", - "type": "url", - "url": "https://github.com/projectdiscovery/subfinder" - } - ] - }, - { - "name": "Azure/GCP Discovery", - "type": "folder", - "children": [ - { - "name": "GCPBucketBrute (T)", - "type": "url", - "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" - }, - { - "name": "AADInternals (T)", - "type": "url", - "url": "https://github.com/Gerenios/AADInternals" - }, - { - "name": "ROADtools (T)", - "type": "url", - "url": "https://github.com/dirkjanm/roadtools" - }, - { - "name": "MicroBurst (T)", - "type": "url", - "url": "https://github.com/NetSPI/MicroBurst" - }, - { - "name": "Stormspotter (T)", - "type": "url", - "url": "https://github.com/Azure/Stormspotter" - } - ] - }, - { - "name": "S3/Blob Storage", - "type": "folder", - "children": [ - { - "name": "Public Buckets", - "type": "url", - "url": "https://buckets.grayhatwarfare.com/" - }, - { - "name": "goblob (T)", - "type": "url", - "url": "https://github.com/Macmod/goblob" - }, - { - "name": "S3Scanner (T)", - "type": "url", - "url": "https://github.com/sa7mon/s3scanner" - }, - { - "name": "BucketLoot (T)", - "type": "url", - "url": "https://github.com/redhuntlabs/BucketLoot" - }, - { - "name": "lazys3 (T)", - "type": "url", - "url": "https://github.com/nahamsec/lazys3" - } - ] - }, - { - "name": "Cloud Configuration Analysis", - "type": "folder", - "children": [ - { - "name": "Prowler (T)", - "type": "url", - "url": "https://github.com/prowler-cloud/prowler" - }, - { - "name": "ScoutSuite (T)", - "type": "url", - "url": "https://github.com/nccgroup/ScoutSuite" - }, - { - "name": "Cloud Custodian (T)", - "type": "url", - "url": "https://github.com/cloud-custodian/cloud-custodian" - }, - { - "name": "Checkov (T)", - "type": "url", - "url": "https://github.com/bridgecrewio/checkov" - }, - { - "name": "Steampipe (T)", - "type": "url", - "url": "https://github.com/turbot/steampipe" - } - ] - }, - { - "name": "SaaS Footprinting", - "type": "folder", - "children": [ - { - "name": "Amass (T)", - "type": "url", - "url": "https://github.com/owasp-amass/amass" - }, - { - "name": "Sublist3r (T)", - "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "SpiderFoot (T)", - "type": "url", - "url": "https://github.com/smicallef/spiderfoot", - "description": "Automated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.", - "status": "live", - "pricing": "free", - "bestFor": "Automated recon, attack surface mapping, threat intelligence", - "input": "Domain, IP, email, name, phone, subnet", - "output": "Correlated intelligence graph, structured findings across modules", - "opsec": "active", - "opsecNote": "Some modules actively probe targets. Review module settings before running.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "dnsrecon (T)", - "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" - } - ] - } - ] - }, - { - "name": "IP & MAC Address", - "type": "folder", - "children": [ - { - "name": "Geolocation", - "type": "folder", - "children": [ - { - "name": "MaxMind Demo", - "type": "url", - "url": "https://www.maxmind.com/en/home" - }, - { - "name": "IPv4/IPv6 lists by country code", - "type": "url", - "url": "https://github.com/ipverse/" - }, - { - "name": "IP2Location.com", - "type": "url", - "url": "https://www.ip2location.com/demo" - }, - { - "name": "IP Fingerprints", - "type": "url", - "url": "https://ipfingerprints.com/" - }, - { - "name": "DB-IP", - "type": "url", - "url": "https://db-ip.com/" - }, - { - "name": "IP Location Finder", - "type": "url", - "url": "https://www.iplocation.net/" - }, - { - "name": "Info Sniper", - "type": "url", - "url": "https://www.infosniper.net/" - }, - { - "name": "utrace", - "type": "url", - "url": "https://en.utrace.de/" - } - ] - }, - { - "name": "Host / Port Discovery", - "type": "folder", - "children": [ - { - "name": "urlscan.io", - "type": "url", - "url": "https://urlscan.io/search/#*" - }, - { - "name": "Spyse", - "type": "url", - "url": "https://spyse.com/search/ip" - }, - { - "name": "Shodan", - "type": "url", - "url": "https://www.shodan.io/" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://netlas.io/" - }, - { - "name": "Portmap", - "type": "url", - "url": "https://portmap.com/" - }, - { - "name": "Scans.io", - "type": "url", - "url": "https://scans.io/" - }, - { - "name": "Nmap (T)", - "type": "url", - "url": "https://nmap.org/download.html" - }, - { - "name": "Online Port scanner", - "type": "url", - "url": "https://portscanner.online/" - }, - { - "name": "Internet Census Search", - "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" - }, - { - "name": "Criminal IP Search", - "type": "url", - "url": "https://www.criminalip.io/" - }, - { - "name": "Scanless (T)", - "type": "url", - "url": "https://github.com/vesche/scanless" - }, - { - "name": "BinaryEdge (R)", - "type": "url", - "url": "https://www.binaryedge.io/" - }, - { - "name": "Masscan (T)", - "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" - } - ] - }, - { - "name": "IPv4", - "type": "folder", - "children": [ - { - "name": "ASlookup.com", - "type": "url", - "url": "https://aslookup.com/" - }, - { - "name": "Port scanner Online", - "type": "url", - "url": "https://portscanner.online/" - }, - { - "name": "Onyphe", - "type": "url", - "url": "https://www.onyphe.io/" - }, - { - "name": "IPv4 CIDR Report", - "type": "url", - "url": "https://www.cidr-report.org/as2.0/" - }, - { - "name": "Reverse.report", - "type": "url", - "url": "https://reverse.report/" - }, - { - "name": "Team Cymru IP to ASN", - "type": "url", - "url": "https://asn.cymru.com/" - }, - { - "name": "IP to ASN DB", - "type": "url", - "url": "https://iptoasn.com/" - }, - { - "name": "Hacker Target - Reverse DNS", - "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" - } - ] - }, - { - "name": "IPv6", - "type": "folder", - "children": [ - { - "name": "IPv6 CIDR Report", - "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" - } - ] - }, - { - "name": "BGP", - "type": "folder", - "children": [ - { - "name": "Hurricane Electric BGP Toolkit", - "type": "url", - "url": "https://bgp.he.net/" - }, - { - "name": "BGP Malicious Content Ranking", - "type": "url", - "url": "https://bgpranking.circl.lu/" - }, - { - "name": "PeeringDB", - "type": "url", - "url": "https://www.peeringdb.com/advanced_search" - }, - { - "name": "BGP Tools", - "type": "url", - "url": "https://www.bgp4.as/tools" - } - ] - }, - { - "name": "Reputation", - "type": "folder", - "children": [ - { - "name": "IP Void", - "type": "url", - "url": "https://www.ipvoid.com/" - }, - { - "name": "ExoneraTor", - "type": "url", - "url": "https://exonerator.torproject.org/" - }, - { - "name": "Grey Noise", - "type": "url", - "url": "https://viz.greynoise.io/" - } - ] - }, - { - "name": "Blacklists", - "type": "folder", - "children": [ - { - "name": "Blocklist.de", - "type": "url", - "url": "https://www.blocklist.de/en/index.html" - }, - { - "name": "DShield API", - "type": "url", - "url": "https://isc.sans.edu/api/" - }, - { - "name": "FireHOL IP Lists ", - "type": "url", - "url": "https://iplists.firehol.org/" - }, - { - "name": "Project Honey Pot", - "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" - } - ] - }, - { - "name": "Neighbor Domains", - "type": "folder", - "children": [ - { - "name": "IP Fingerprints - Reverse IP Lookup", - "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" - }, - { - "name": "Bing IP Search (D)", - "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" - }, - { - "name": "TCP/IP Utils - Domain Neighbors", - "type": "url", - "url": "https://dnslytics.com/" - }, - { - "name": "MyIPNeighbors", - "type": "url", - "url": "https://www.my-ip-neighbors.com/" - } - ] - }, - { - "name": "Protected by Cloud Services", - "type": "folder", - "children": [ - { - "name": "CloudFlare Watch", - "type": "url", - "url": "https://www.crimeflare.com/" - }, - { - "name": "CloudFail (T)", - "type": "url", - "url": "https://github.com/m0rtem/CloudFail" - } - ] - }, - { - "name": "Wireless Network Info", - "type": "folder", - "children": [ - { - "name": "WiGLE: Wireless Network Mapping", - "type": "url", - "url": "https://wigle.net/" - }, - { - "name": "OpenCellid: Database of Cell Towers", - "type": "url", - "url": "https://opencellid.org/" - } - ] - }, - { - "name": "Network Analysis Tools", - "type": "folder", - "children": [ - { - "name": "Wireshark", - "type": "url", - "url": "https://www.wireshark.org/download.html" - }, - { - "name": "NetworkMiner", - "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" - }, - { - "name": "Packet Total", - "type": "url", - "url": "https://www.packettotal.com/" - }, - { - "name": "checkip (T)", - "type": "url", - "url": "https://github.com/jreisinger/checkip" - } - ] - }, - { - "name": "IP Loggers", - "type": "folder", - "children": [ - { - "name": "Ki.tc", - "type": "url", - "url": "https://ki.tc" - }, - { - "name": "Grabify", - "type": "url", - "url": "https://grabify.link" - }, - { - "name": "IP Logger", - "type": "url", - "url": "https://iplogger.com/" - } - ] - } - ] - }, - { - "name": "Images / Videos / Docs", - "type": "folder", - "children": [ - { - "name": "Images", - "type": "folder", - "children": [ - { - "name": "Search", - "type": "folder", - "children": [ - { - "name": "Google Images", - "type": "url", - "url": "https://images.google.com/?gws_rd=ssl" - }, - { - "name": "Bing Images", - "type": "url", - "url": "https://www.bing.com/images" - }, - { - "name": "FaceCheck Facial Recognition Search", - "type": "url", - "url": "https://facecheck.id/" - }, - { - "name": "Surfface Face & People Search Engine", - "type": "url", - "url": "https://surfface.com/" - }, - { - "name": "PimEyes Face Search Engine", - "type": "url", - "url": "https://pimeyes.com/en" - }, - { - "name": "Yandex Images", - "type": "url", - "url": "https://www.yandex.com/images/" - }, - { - "name": "Baidu Images", - "type": "url", - "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" - }, - { - "name": "Twitter Image Search (M)", - "type": "url", - "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" - }, - { - "name": "Imgur Search", - "type": "url", - "url": "https://imgur.com/search" - }, - { - "name": "Photobucket", - "type": "url", - "url": "https://photobucket.com/" - }, - { - "name": "7Photos.net", - "type": "url", - "url": "https://7photos.net/" - }, - { - "name": "Panoramio", - "type": "url", - "url": "https://www.panoramio.com/" - }, - { - "name": "Current Location", - "type": "url", - "url": "https://current-location.com/" - }, - { - "name": "Lakako Photo Search", - "type": "url", - "url": "https://www.lakako.com/" - }, - { - "name": "Lenso.ai", - "type": "url", - "url": "https://lenso.ai/" - }, - { - "name": "CC Search", - "type": "url", - "url": "https://ccsearch.creativecommons.org/" - }, - { - "name": "CamFind App", - "type": "url", - "url": "https://camfindapp.com/" - }, - { - "name": "RevEye Reverse Image Search (T)", - "type": "url", - "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" - }, - { - "name": "SmugMug Search", - "type": "url", - "url": "https://www.smugmug.com/" - }, - { - "name": "ImageNet", - "type": "url", - "url": "https://image-net.org/" - }, - { - "name": "Places2", - "type": "url", - "url": "https://places2.csail.mit.edu/explore.html" - }, - { - "name": "Image Identification Project", - "type": "url", - "url": "https://www.imageidentify.com/" - }, - { - "name": "SauceNAO", - "type": "url", - "url": "https://saucenao.com/" - }, - { - "name": "Picarta", - "type": "url", - "url": "https://picarta.ai/" - }, - { - "name": "FaceSeek Face Search Engine", - "type": "url", - "url": "https://faceseek.online" - } - ] - }, - { - "name": "Instagram", - "type": "folder", - "children": [ - { - "name": "Webstigram", - "type": "url", - "url": "https://websta.me/search-engine-optimization/" - }, - { - "name": "Instagram", - "type": "url", - "url": "https://www.instagram.com/" - }, - { - "name": "Mini Instagram", - "type": "url", - "url": "https://mininsta.net/" - }, - { - "name": "Imgrab", - "type": "url", - "url": "https://www.imgrab.com/" - }, - { - "name": "Tofo.me", - "type": "url", - "url": "https://tofo.me/" - } - ] - }, - { - "name": "Flickr", - "type": "folder", - "children": [ - { - "name": "Flickr", - "type": "url", - "url": "https://www.flickr.com/" - }, - { - "name": "Flickr Map", - "type": "url", - "url": "https://www.flickr.com/map/" - }, - { - "name": "My Pics Map", - "type": "url", - "url": "https://www.mypicsmap.com/" - }, - { - "name": "idGettr", - "type": "url", - "url": "https://www.webfx.com/tools/idgettr/" - }, - { - "name": "Flickr Hive Mind", - "type": "url", - "url": "https://flickrhivemind.net/" - } - ] - }, - { - "name": "Metadata", - "type": "folder", - "children": [ - { - "name": "ExifEditor", - "type": "url", - "url": "https://exifeditor.io" - }, - { - "name": "ExifTool (T)", - "type": "url", - "url": "https://exiftool.org/" - }, - { - "name": "ExifViewer", - "type": "url", - "url": "https://www.exifviewer.org/" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" - }, - { - "name": "GeoSetter", - "type": "url", - "url": "https://geosetter.de/en/main-en/" - }, - { - "name": "Jeffrey's Exif Viewer", - "type": "url", - "url": "https://exif.regex.info/" - }, - { - "name": "JPEGsnoop (T)", - "type": "url", - "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" - }, - { - "name": "Metapicz", - "type": "url", - "url": "https://metapicz.com/#landing" - }, - { - "name": "Search by Exif", - "type": "url", - "url": "https://www.exif-search.com/" - }, - { - "name": "xeuledoc - Fetch metadata about any public Google document", - "type": "url", - "url": "https://github.com/Malfrats/xeuledoc" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" - }, - { - "name": "Exiv2 (T)", - "type": "url", - "url": "https://exiv2.org/" - }, - { - "name": "MediaInfo (T)", - "type": "url", - "url": "https://mediaarea.net/en/MediaInfo" - }, - { - "name": "Apache Tika (T)", - "type": "url", - "url": "https://tika.apache.org/" - }, - { - "name": "oletools (T)", - "type": "url", - "url": "https://github.com/decalage2/oletools" - }, - { - "name": "Hachoir (T)", - "type": "url", - "url": "https://github.com/vstinner/hachoir" - }, - { - "name": "C2PA Verify", - "type": "url", - "url": "https://contentcredentials.org/verify" - }, - { - "name": "Metadata2Go", - "type": "url", - "url": "https://www.metadata2go.com/" - }, - { - "name": "Get-Metadata", - "type": "url", - "url": "https://www.get-metadata.com/" - } - ] - }, - { - "name": "Forensics", - "type": "folder", - "children": [ - { - "name": "Ghiro (T)", - "type": "url", - "url": "https://github.com/ghirensics/ghiro" - }, - { - "name": "Camera Trace", - "type": "url", - "url": "https://www.cameratrace.com/trace" - }, - { - "name": "Forensically", - "type": "url", - "url": "https://29a.ch/photo-forensics/" - } - ] - }, - { - "name": "OCR", - "type": "folder", - "children": [ - { - "name": "Online OCR", - "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" - }, - { - "name": "i2OCR", - "type": "url", - "url": "https://www.i2ocr.com/" - }, - { - "name": "New OCR", - "type": "url", - "url": "https://www.newocr.com/" - }, - { - "name": "Online OCR", - "type": "url", - "url": "https://www.onlineocr.net/" - } - ] - }, - { - "name": "Tools", - "type": "folder", - "children": [ - { - "name": "Creepy (T)", - "type": "url", - "url": "https://www.geocreepy.com/" - } - ] - } - ] - }, - { - "name": "Videos", - "type": "folder", - "children": [ - { - "name": "Search", - "type": "folder", - "children": [ - { - "name": "Google Videos", - "type": "url", - "url": "https://www.google.com/videohp?gws_rd=ssl" - }, - { - "name": "Bing Videos", - "type": "url", - "url": "https://www.bing.com/videos" - }, - { - "name": "Internet Archive Videos", - "type": "url", - "url": "https://archive.org/details/opensource_movies" - }, - { - "name": "Vines (D)", - "type": "url", - "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" - }, - { - "name": "Dogpile Web Search", - "type": "url", - "url": "https://www.dogpile.com/" - }, - { - "name": "Geo Search Tool", - "type": "url", - "url": "https://www.geosearchtool.com/" - }, - { - "name": "blinkx Video Search", - "type": "url", - "url": "https://blinkx.com/" - }, - { - "name": "Facebook Live Map", - "type": "url", - "url": "https://www.facebook.com/watch/live/?ref=live_delegate" - }, - { - "name": "LiveLeak", - "type": "url", - "url": "https://www.liveleak.com/" - }, - { - "name": "Metatube", - "type": "url", - "url": "https://www.metatube.com/" - }, - { - "name": "Yahoo Video Search", - "type": "url", - "url": "https://video.search.yahoo.com/" - }, - { - "name": "Search YouTube by Location", - "type": "url", - "url": "https://mattw.io/youtube-geofind/location" - } - ] - }, - { - "name": "Analyze / Record", - "type": "folder", - "children": [ - { - "name": "DetURL", - "type": "url", - "url": "https://deturl.com/" - }, - { - "name": "Print YouTube StoryBoard Instructions", - "type": "url", - "url": "https://www.labnol.org/internet/print-youtube-video/28217" - }, - { - "name": "Print Storyboard from Youtube", - "type": "url", - "url": "javascript:(function(){a=ytplayer.config.args.storyboard_spec;if(!a){alert(\"Sorry we cannot process this YouTube video. Could you please try another one\");exit();}b=a.split(\"|\");base=b[0].split(\"$\")[0]+\"2/M\";c=b[3].split(\"%23\");sigh=c[c.length-1];var imgs=\"\";t=ytplayer.config.args.length_seconds;n=Math.ceil(c[2]/(c[3]*c[4]));for(i=0;i
\";}var title=ytplayer.config.args.title;msg=\"@protonmail.com", + "description": "Queries ProtonMail's HKP-compatible PGP key server to look up the public key for a ProtonMail username. A successful response confirms the account exists.", + "status": "live", + "pricing": "free", + "bestFor": "Confirming whether a ProtonMail username exists and retrieving its PGP public key", + "input": "ProtonMail username (appended with @protonmail.com)", + "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", + "opsec": "passive", + "opsecNote": "Unauthenticated API query to ProtonMail's public key server. Target user is not notified. Enables user enumeration.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ProtonMail Domains (M)", + "type": "url", + "url": "https://api.protonmail.ch/pks/lookup?op=index&search=", + "description": "Queries ProtonMail's HKP key server with a full email address to check for a PGP public key. Useful for identifying ProtonMail users on custom domains.", + "status": "live", + "pricing": "free", + "bestFor": "Checking if an email address on a custom domain is hosted on ProtonMail", + "input": "Full email address (any domain that may be hosted on ProtonMail)", + "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", + "opsec": "passive", + "opsecNote": "Unauthenticated public HKP endpoint. Target is not notified. Can reveal whether a custom domain uses ProtonMail.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + } + ] + }, + { + "name": "Email Address", + "type": "folder", + "children": [ + { + "name": "Email Search", + "type": "folder", + "children": [ + { + "name": "Sylva Identity Discovery (T)", + "type": "url", + "url": "https://sylva.pfeister.dev/" + }, + { + "name": "ThatsThem", + "type": "url", + "url": "https://thatsthem.com/reverse-email-lookup" + }, + { + "name": "Hunter", + "type": "url", + "url": "https://hunter.io/" + }, + { + "name": "Email to Address (R)", + "type": "url", + "url": "https://www.melissa.com/" + }, + { + "name": "VoilaNorbert", + "type": "url", + "url": "https://www.voilanorbert.com/" + }, + { + "name": "GHunt (T)", + "type": "url", + "url": "https://github.com/mxrch/GHunt" + }, + { + "name": "OSINT Industries", + "type": "url", + "url": "https://www.osint.industries/" + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email harvesting, subdomain enumeration, passive recon", + "input": "Domain name", + "output": "Email addresses, subdomains, IPs, URLs", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Infoga (T)", + "type": "url", + "url": "https://github.com/m4ll0k/infoga" + }, + { + "name": "Skymem", + "type": "url", + "url": "https://www.skymem.info/" + }, + { + "name": "Epieos Email Tool", + "type": "url", + "url": "https://tools.epieos.com/email.php" + }, + { + "name": "breach.vip", + "type": "url", + "url": "https://breach.vip/" + }, + { + "name": "Holehe (T)", + "type": "url", + "url": "https://github.com/megadose/holehe" + } + ] + }, + { + "name": "Common Email Formats", + "type": "folder", + "children": [ + { + "name": "Email Format", + "type": "url", + "url": "https://www.email-format.com/" + }, + { + "name": "Email Permutator", + "type": "url", + "url": "https://metricsparrow.com/toolkit/email-permutator/" + } + ] + }, + { + "name": "Email Verification", + "type": "folder", + "children": [ + { + "name": "Reacher Github (T)", + "type": "url", + "url": "https://github.com/reacherhq/check-if-email-exists" + }, + { + "name": "Reacher Demo", + "type": "url", + "url": "https://reacher.email" + }, + { + "name": "MailScrap", + "type": "url", + "url": "https://mailscrap.com/" + }, + { + "name": "Read Notify", + "type": "url", + "url": "https://www.readnotify.com/" + }, + { + "name": "Email Reputation", + "type": "url", + "url": "https://emailrep.io/" + }, + { + "name": "MailboxValidator", + "type": "url", + "url": "https://www.mailboxvalidator.com/demo" + }, + { + "name": "VerifyEmail (R$)", + "type": "url", + "url": "https://emailable.com/" + } + ] + }, + { + "name": "Breach Data", + "type": "folder", + "children": [ + { + "name": "Have I been pwned?", + "type": "url", + "url": "https://haveibeenpwned.com/", + "description": "Database of breached credentials and email addresses from known data breaches.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach detection, credential exposure checks", + "input": "Email address, phone number, password hash", + "output": "Breach names, breach dates, exposed data types", + "opsec": "passive", + "opsecNote": "Queries breach database via API. Target is not notified of lookups.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Hudson Rock", + "type": "url", + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + }, + { + "name": "DeHashed (R)", + "type": "url", + "url": "https://dehashed.com/" + }, + { + "name": "Vigilante.pw", + "type": "url", + "url": "https://www.vigilante.pw/" + } + ] + }, + { + "name": "Mail Blacklists", + "type": "folder", + "children": [ + { + "name": "MxToolbox", + "type": "url", + "url": "https://mxtoolbox.com/" + } + ] + } + ] + }, + { + "name": "Domain Name", + "type": "folder", + "children": [ + { + "name": "Whois Records", + "type": "folder", + "children": [ + { + "name": "Domain Dossier", + "type": "url", + "url": "https://centralops.net/co/DomainDossier.aspx" + }, + { + "name": "domainIQ", + "type": "url", + "url": "https://www.domainiq.com/" + }, + { + "name": "DomainTools Whois", + "type": "url", + "url": "https://whois.domaintools.com/" + }, + { + "name": "SWITCH Internet Domains Whois (.ch)", + "type": "url", + "url": "https://www.nic.ch/whois/" + }, + { + "name": "Whoisology", + "type": "url", + "url": "https://whoisology.com/#advanced" + }, + { + "name": "Whois ARIN", + "type": "url", + "url": "https://whois.arin.net/ui/advanced.jsp" + }, + { + "name": "DNSstuff", + "type": "url", + "url": "https://www.dnsstuff.com/freetools" + }, + { + "name": "Robtex (R)", + "type": "url", + "url": "https://robtex.com/" + }, + { + "name": "Domaincrawler.com", + "type": "url", + "url": "https://domaincrawler.com/" + }, + { + "name": "MarkMonitor Whois Search", + "type": "url", + "url": "https://domains.markmonitor.com/whois/" + }, + { + "name": "easyWhois", + "type": "url", + "url": "https://www.easywhois.com/" + }, + { + "name": "Website Informer", + "type": "url", + "url": "https://website.informer.com/" + }, + { + "name": "Who.is", + "type": "url", + "url": "https://who.is/" + }, + { + "name": "Whois AMPed", + "type": "url", + "url": "https://whoisamped.com/" + }, + { + "name": "ViewDNS.info", + "type": "url", + "url": "https://viewdns.info/" + }, + { + "name": "Daily DNS Changes", + "type": "url", + "url": "https://dailychanges.domaintools.com/" + }, + { + "name": "IP2WHOIS", + "type": "url", + "url": "https://www.ip2whois.com" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/whois_domains/" + } + ] + }, + { + "name": "Subdomains", + "type": "folder", + "children": [ + { + "name": "SynapsInt", + "type": "url", + "url": "https://synapsint.com" + }, + { + "name": "Aquatone (T)", + "type": "url", + "url": "https://github.com/michenriksen/aquatone" + }, + { + "name": "FindSubDomains", + "type": "url", + "url": "https://findsubdomains.com/" + }, + { + "name": "Google Subdomains (D)", + "type": "url", + "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" + }, + { + "name": "Recon-ng (T)", + "type": "url", + "url": "https://github.com/lanmaster53/recon-ng", + "description": "Full-featured web reconnaissance framework with independent modules for data gathering.", + "status": "live", + "pricing": "free", + "bestFor": "Modular web recon, API-driven data collection", + "input": "Domain, company name, email, IP", + "output": "Contacts, hosts, credentials, ports via module-specific results", + "opsec": "passive", + "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "XRay", + "type": "url", + "url": "https://github.com/evilsocket/xray" + }, + { + "name": "DNS Recon (T)", + "type": "url", + "url": "https://github.com/darkoperator/dnsrecon" + }, + { + "name": "Gobuster (T)", + "type": "url", + "url": "https://github.com/OJ/gobuster" + }, + { + "name": "Fierce Domain Scanner (T)", + "type": "url", + "url": "https://github.com/davidpepper/fierce-domain-scanner" + }, + { + "name": "Bluto (T)", + "type": "url", + "url": "https://github.com/darryllane/Bluto" + }, + { + "name": "OWASP Maryam (T)", + "type": "url", + "url": "https://github.com/saeeddhqan/Maryam" + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email harvesting, subdomain enumeration, passive recon", + "input": "Domain name", + "output": "Email addresses, subdomains, IPs, URLs", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Pentest-tools.com Subdomains", + "type": "url", + "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" + }, + { + "name": "SecLists DNS Subdomains (T)", + "type": "url", + "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" + }, + { + "name": "dnspop (T)", + "type": "url", + "url": "https://github.com/bitquark/dnspop" + }, + { + "name": "gdns (T)", + "type": "url", + "url": "https://github.com/hrbrmstr/gdns" + }, + { + "name": "Sublist3r", + "type": "url", + "url": "https://github.com/aboul3la/Sublist3r" + }, + { + "name": "AltDNS (T)", + "type": "url", + "url": "https://github.com/infosec-au/altdns" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/domains/" + } + ] + }, + { + "name": "Discovery", + "type": "folder", + "children": [ + { + "name": "Shodan", + "type": "url", + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Port scanning, banner grabbing, IoT discovery", + "input": "IP address, domain", + "output": "Open ports, services, banners, CVEs", + "opsec": "passive", + "opsecNote": "Queries cached scan data. Does not directly probe the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/" + }, + { + "name": "Kraken (T)", + "type": "url", + "url": "https://github.com/Sw4mpf0x/Kraken" + }, + { + "name": "Online Nikto scanner", + "type": "url", + "url": "https://nikto.online/" + }, + { + "name": "urlscan.io", + "type": "url", + "url": "https://urlscan.io/search/#*" + }, + { + "name": "Daily DNS Changes", + "type": "url", + "url": "https://dailychanges.domaintools.com/" + }, + { + "name": "Redirect Detective", + "type": "url", + "url": "https://redirectdetective.com/" + }, + { + "name": "Sitediff (T)", + "type": "url", + "url": "https://github.com/digininja/sitediff" + }, + { + "name": "BuiltWith", + "type": "url", + "url": "https://builtwith.com/", + "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack identification, competitor analysis", + "input": "Domain or URL", + "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "opsec": "passive", + "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer", + "type": "url", + "url": "https://www.wappalyzer.com/" + }, + { + "name": "AnalyzeID", + "type": "url", + "url": "https://analyzeid.com/" + }, + { + "name": "Criminal IP Search", + "type": "url", + "url": "https://www.criminalip.io/" + }, + { + "name": "urlDNA", + "type": "url", + "url": "https://urldna.io" + }, + { + "name": "ZoomEye.ai", + "type": "url", + "url": "https://www.zoomeye.org/" + } + ] + }, + { + "name": "Certificate Search", + "type": "folder", + "children": [ + { + "name": "Shodan", + "type": "url", + "url": "https://www.shodan.io/" + }, + { + "name": "Google's Certificate Transparency", + "type": "url", + "url": "https://www.certificate-transparency.org/known-logs" + }, + { + "name": "Spyse", + "type": "url", + "url": "https://spyse.com/search/certificate" + }, + { + "name": "Censys", + "type": "url", + "url": "https://censys.io/", + "description": "Internet-wide scanner and search engine for hosts, certificates, and services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Certificate discovery, host enumeration, exposure monitoring", + "input": "Domain, IP, certificate fingerprint, search query", + "output": "Host details, open ports, TLS certificates, service banners", + "opsec": "passive", + "opsecNote": "Queries pre-scanned data. Does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "crt.sh - Certificate Search", + "type": "url", + "url": "https://crt.sh/?" + }, + { + "name": "CertKit - Certificate Transparency Log Search", + "type": "url", + "url": "https://www.certkit.io/tools/ct-logs/" + }, + { + "name": "certgraph (T)", + "type": "url", + "url": "https://github.com/lanrat/certgraph" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/certs/" + } + ] + }, + { + "name": "PassiveDNS", + "type": "folder", + "children": [ + { + "name": "Mnemonic", + "type": "url", + "url": "https://passivedns.mnemonic.no/" + }, + { + "name": "DNS Dumpster", + "type": "url", + "url": "https://dnsdumpster.com/" + }, + { + "name": "Deteque (R)", + "type": "url", + "url": "https://www.deteque.com/" + } + ] + }, + { + "name": "Reputation", + "type": "folder", + "children": [ + { + "name": "UrlQuery.net", + "type": "url", + "url": "https://urlquery.net/" + }, + { + "name": "URL Void", + "type": "url", + "url": "https://www.urlvoid.com/" + }, + { + "name": "FortiGuard Reputation Service", + "type": "url", + "url": "https://fortiguard.com/iprep" + }, + { + "name": "Trend Micro Site Safety Center", + "type": "url", + "url": "https://global.sitesafety.trendmicro.com/" + }, + { + "name": "WatchGuard ReputationAuthority", + "type": "url", + "url": "https://www.reputationauthority.org/" + }, + { + "name": "Sucuri SiteCheck", + "type": "url", + "url": "https://sitecheck.sucuri.net/" + }, + { + "name": "ThreatMiner.org", + "type": "url", + "url": "https://www.threatminer.org/" + }, + { + "name": "BlueCoat WebPulse", + "type": "url", + "url": "https://sitereview.bluecoat.com/sitereview.jsp" + }, + { + "name": "Zscaler Zulu URL Risk Analyzer", + "type": "url", + "url": "https://zulu.zscaler.com/" + }, + { + "name": "Joe Sandbox Url Analyzer", + "type": "url", + "url": "https://www.url-analyzer.net/" + }, + { + "name": "Deepviz Domain Search", + "type": "url", + "url": "https://search.deepviz.com/" + }, + { + "name": "AVG Threat Labs", + "type": "url", + "url": "https://www.avg.com/en/signal/website-safety" + }, + { + "name": "Webroot BrightCloud URL/IP Lookup", + "type": "url", + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + }, + { + "name": "vURL Online", + "type": "url", + "url": "https://vurldissect.co.uk/" + }, + { + "name": "AlienVault Open Threat Exchange", + "type": "url", + "url": "https://otx.alienvault.com/browse/pulses/" + }, + { + "name": "Malware Domain List", + "type": "url", + "url": "https://www.malwaredomainlist.com/mdl.php" + }, + { + "name": "Web Inspector Online Scan", + "type": "url", + "url": "https://www.webinspector.com/website-malware-scanner/" + }, + { + "name": "Google Safe Browsing API", + "type": "url", + "url": "https://developers.google.com/safe-browsing/?csw=1" + }, + { + "name": "Cisco Talos", + "type": "url", + "url": "https://talosintelligence.com/" + } + ] + }, + { + "name": "Domain Blacklists", + "type": "folder", + "children": [ + { + "name": "Threatexpert.com Malicious URLs", + "type": "url", + "url": "https://www.networksec.org/grabbho/block.txt" + }, + { + "name": "Zeus C2 Tracker", + "type": "url", + "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" + }, + { + "name": "Malware Domains Blacklist", + "type": "url", + "url": "https://mirror1.malwaredomains.com/files/domains.txt" + }, + { + "name": "Blackweb", + "type": "url", + "url": "https://github.com/maravento/blackweb" + }, + { + "name": "Critical Stack Intel (R)", + "type": "url", + "url": "https://intel.criticalstack.com/" + }, + { + "name": "DNS Sinkhole", + "type": "url", + "url": "https://malc0de.com/bl/" + }, + { + "name": "DNS-BH Malware Domain Blocklist", + "type": "url", + "url": "https://www.malwaredomains.com/wordpress/?page_id=66" + }, + { + "name": "Malware Domain List", + "type": "url", + "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" + }, + { + "name": "MalwareURL (R)", + "type": "url", + "url": "https://www.malwareurl.com/index.php" + }, + { + "name": "scumware.org", + "type": "url", + "url": "https://www.scumware.org/" + }, + { + "name": "ZeuS Tracker", + "type": "url", + "url": "https://zeustracker.abuse.ch/blocklist.php" + }, + { + "name": "Shadowserver Foundation", + "type": "url", + "url": "https://www.shadowserver.org/" + }, + { + "name": "Email Domain Validation", + "type": "url", + "url": "https://www.mailboxvalidator.com/domain" + } + ] + }, + { + "name": "Typosquatting", + "type": "folder", + "children": [ + { + "name": "DNS Twist (T)", + "type": "url", + "url": "https://github.com/elceef/dnstwist" + }, + { + "name": "URLCrazy (T)", + "type": "url", + "url": "https://www.morningstarsecurity.com/research/urlcrazy" + }, + { + "name": "dnstwister", + "type": "url", + "url": "https://dnstwister.report/" + }, + { + "name": "Catphish (T)", + "type": "url", + "url": "https://github.com/ring0lab/catphish" + } + ] + }, + { + "name": "Analytics", + "type": "folder", + "children": [ + { + "name": "BuiltWith", + "type": "url", + "url": "https://builtwith.com/", + "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack identification, competitor analysis", + "input": "Domain or URL", + "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "opsec": "passive", + "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SiteSleuth", + "type": "url", + "url": "https://www.sitesleuth.io/" + }, + { + "name": "Wappalyzer (T)", + "type": "url", + "url": "https://www.wappalyzer.com/" + }, + { + "name": "SEMrush", + "type": "url", + "url": "https://www.semrush.com/" + }, + { + "name": "Moonsearch", + "type": "url", + "url": "https://moonsearch.com/" + }, + { + "name": "Ewhois", + "type": "url", + "url": "https://ewhois.com/" + }, + { + "name": "StatsCrop", + "type": "url", + "url": "https://www.statscrop.com/" + }, + { + "name": "Open Site Explorer", + "type": "url", + "url": "https://moz.com/link-explorer" + }, + { + "name": "SpyOnWeb", + "type": "url", + "url": "https://www.spyonweb.com/" + }, + { + "name": "Keyword Density", + "type": "url", + "url": "https://tools.seobook.com/general/keyword-density/" + }, + { + "name": "Alexa Site Statistics", + "type": "url", + "url": "https://alexa.amazon.com/about" + }, + { + "name": "Cisco Umbrella Popularity List", + "type": "url", + "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" + }, + { + "name": "Alexa Top 500 Global Sites", + "type": "url", + "url": "https://alexa.amazon.com/about" + }, + { + "name": "Sitedossier", + "type": "url", + "url": "https://www.sitedossier.com/" + }, + { + "name": "Visual Site Mapper", + "type": "url", + "url": "https://github.com/alentum/sitemapper-nodejs" + }, + { + "name": "ClearWebStats.com", + "type": "url", + "url": "https://www.clearwebstats.com/" + }, + { + "name": "PubDB", + "type": "url", + "url": "https://pub-db.com/" + }, + { + "name": "SimilarWeb", + "type": "url", + "url": "https://www.similarweb.com/" + }, + { + "name": "Siteliner", + "type": "url", + "url": "https://www.siteliner.com/" + }, + { + "name": "WhatWeb", + "type": "url", + "url": "https://github.com/urbanadventurer/WhatWeb" + } + ] + }, + { + "name": "URL Expanders", + "type": "folder", + "children": [ + { + "name": "Link Expander", + "type": "url", + "url": "https://www.linkexpander.com/" + }, + { + "name": "CheckShortURL", + "type": "url", + "url": "https://checkshorturl.com/" + }, + { + "name": "URL Expander", + "type": "url", + "url": "https://urlex.org/" + }, + { + "name": "Where Does This Link Go?", + "type": "url", + "url": "https://wheregoes.com/" + }, + { + "name": "KnowURL", + "type": "url", + "url": "https://www.knowurl.com/" + } + ] + }, + { + "name": "Change Detection", + "type": "folder", + "children": [ + { + "name": "VisualPing", + "type": "url", + "url": "https://visualping.io:443/" + }, + { + "name": "Change Detection", + "type": "url", + "url": "https://visualping.io/" + }, + { + "name": "Check site availability Online", + "type": "url", + "url": "https://upcheck.online/" + }, + { + "name": "Follow That Page", + "type": "url", + "url": "https://www.followthatpage.com/" + }, + { + "name": "Urlwatch", + "type": "url", + "url": "https://github.com/thp/urlwatch" + }, + { + "name": "WatchThatPage", + "type": "url", + "url": "https://watchthatpage.com/" + }, + { + "name": "ChangeDetect", + "type": "url", + "url": "https://www.eatgrainmaker.com/home/" + } + ] + }, + { + "name": "Social Analysis", + "type": "folder", + "children": [ + { + "name": "Google Trends", + "type": "url", + "url": "https://trends.google.com/trends/" + } + ] + }, + { + "name": "DNSSEC", + "type": "folder", + "children": [ + { + "name": "DNSSEC Analyzer", + "type": "url", + "url": "https://dnssec-analyzer.verisignlabs.com/" + }, + { + "name": "DNSViz", + "type": "url", + "url": "https://dnsviz.net/" + } + ] + }, + { + "name": "Vulnerabilities", + "type": "folder", + "children": [ + { + "name": "Scanners", + "type": "folder", + "children": [ + { + "name": "Sn1per (T)", + "type": "url", + "url": "https://github.com/1N3/Sn1per" + }, + { + "name": "Online Nikto scanner", + "type": "url", + "url": "https://nikto.online/" + }, + { + "name": "WDES - Web Data Exposure Scanner (T)", + "type": "url", + "url": "https://github.com/eduardoit/web-data-exposure-scanner" + } + ] + }, + { + "name": "Disclosure Sites", + "type": "folder", + "children": [ + { + "name": "Zone-H.org", + "type": "url", + "url": "https://zone-h.org/archive" + } + ] + }, + { + "name": "RobotsDisallowed", + "type": "url", + "url": "https://github.com/danielmiessler/RobotsDisallowed" + } + ] + }, + { + "name": "Tools", + "type": "folder", + "children": [ + { + "name": "Belati (T)", + "type": "url", + "url": "https://github.com/aancw/Belati" + }, + { + "name": "Burp Suite (T)", + "type": "url", + "url": "https://portswigger.net/burp" + }, + { + "name": "EyeWitness (T)", + "type": "url", + "url": "https://github.com/ChrisTruncer/EyeWitness" + }, + { + "name": "Hunting-New-Registered-Domains (T)", + "type": "url", + "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + }, + { + "name": "International Domain Name Conversion Tool", + "type": "url", + "url": "https://mct.verisign-grs.com/" + }, + { + "name": "Online Nikto scanner", + "type": "url", + "url": "https://nikto.online/" + } + ] + }, + { + "name": "Report Malicious Sites", + "type": "folder", + "children": [ + { + "name": "Microsoft", + "type": "url", + "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" + }, + { + "name": "Google", + "type": "url", + "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" + } + ] + } + ] + }, + { + "name": "Cloud Infrastructure", + "type": "folder", + "children": [ + { + "name": "AWS Enumeration", + "type": "folder", + "children": [ + { + "name": "cloud_enum (T)", + "type": "url", + "url": "https://github.com/initstring/cloud_enum" + }, + { + "name": "AWSBucketDump (T)", + "type": "url", + "url": "https://github.com/jordanpotti/AWSBucketDump" + }, + { + "name": "Subfinder (T)", + "type": "url", + "url": "https://github.com/projectdiscovery/subfinder" + } + ] + }, + { + "name": "Azure/GCP Discovery", + "type": "folder", + "children": [ + { + "name": "GCPBucketBrute (T)", + "type": "url", + "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" + }, + { + "name": "AADInternals (T)", + "type": "url", + "url": "https://github.com/Gerenios/AADInternals" + }, + { + "name": "ROADtools (T)", + "type": "url", + "url": "https://github.com/dirkjanm/roadtools" + }, + { + "name": "MicroBurst (T)", + "type": "url", + "url": "https://github.com/NetSPI/MicroBurst" + }, + { + "name": "Stormspotter (T)", + "type": "url", + "url": "https://github.com/Azure/Stormspotter" + } + ] + }, + { + "name": "S3/Blob Storage", + "type": "folder", + "children": [ + { + "name": "Public Buckets", + "type": "url", + "url": "https://buckets.grayhatwarfare.com/" + }, + { + "name": "goblob (T)", + "type": "url", + "url": "https://github.com/Macmod/goblob" + }, + { + "name": "S3Scanner (T)", + "type": "url", + "url": "https://github.com/sa7mon/s3scanner" + }, + { + "name": "BucketLoot (T)", + "type": "url", + "url": "https://github.com/redhuntlabs/BucketLoot" + }, + { + "name": "lazys3 (T)", + "type": "url", + "url": "https://github.com/nahamsec/lazys3" + } + ] + }, + { + "name": "Cloud Configuration Analysis", + "type": "folder", + "children": [ + { + "name": "Prowler (T)", + "type": "url", + "url": "https://github.com/prowler-cloud/prowler" + }, + { + "name": "ScoutSuite (T)", + "type": "url", + "url": "https://github.com/nccgroup/ScoutSuite" + }, + { + "name": "Cloud Custodian (T)", + "type": "url", + "url": "https://github.com/cloud-custodian/cloud-custodian" + }, + { + "name": "Checkov (T)", + "type": "url", + "url": "https://github.com/bridgecrewio/checkov" + }, + { + "name": "Steampipe (T)", + "type": "url", + "url": "https://github.com/turbot/steampipe" + } + ] + }, + { + "name": "SaaS Footprinting", + "type": "folder", + "children": [ + { + "name": "Amass (T)", + "type": "url", + "url": "https://github.com/owasp-amass/amass" + }, + { + "name": "Sublist3r (T)", + "type": "url", + "url": "https://github.com/aboul3la/Sublist3r" + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email harvesting, subdomain enumeration, passive recon", + "input": "Domain name", + "output": "Email addresses, subdomains, IPs, URLs", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SpiderFoot (T)", + "type": "url", + "url": "https://github.com/smicallef/spiderfoot", + "description": "Automated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Automated recon, attack surface mapping, threat intelligence", + "input": "Domain, IP, email, name, phone, subnet", + "output": "Correlated intelligence graph, structured findings across modules", + "opsec": "active", + "opsecNote": "Some modules actively probe targets. Review module settings before running.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dnsrecon (T)", + "type": "url", + "url": "https://github.com/darkoperator/dnsrecon" + } + ] + } + ] + }, + { + "name": "IP & MAC Address", + "type": "folder", + "children": [ + { + "name": "Geolocation", + "type": "folder", + "children": [ + { + "name": "MaxMind Demo", + "type": "url", + "url": "https://www.maxmind.com/en/home" + }, + { + "name": "IPv4/IPv6 lists by country code", + "type": "url", + "url": "https://github.com/ipverse/" + }, + { + "name": "IP2Location.com", + "type": "url", + "url": "https://www.ip2location.com/demo" + }, + { + "name": "IP Fingerprints", + "type": "url", + "url": "https://ipfingerprints.com/" + }, + { + "name": "DB-IP", + "type": "url", + "url": "https://db-ip.com/" + }, + { + "name": "IP Location Finder", + "type": "url", + "url": "https://www.iplocation.net/" + }, + { + "name": "Info Sniper", + "type": "url", + "url": "https://www.infosniper.net/" + }, + { + "name": "utrace", + "type": "url", + "url": "https://en.utrace.de/" + } + ] + }, + { + "name": "Host / Port Discovery", + "type": "folder", + "children": [ + { + "name": "urlscan.io", + "type": "url", + "url": "https://urlscan.io/search/#*" + }, + { + "name": "Spyse", + "type": "url", + "url": "https://spyse.com/search/ip" + }, + { + "name": "Shodan", + "type": "url", + "url": "https://www.shodan.io/" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://netlas.io/" + }, + { + "name": "Portmap", + "type": "url", + "url": "https://portmap.com/" + }, + { + "name": "Scans.io", + "type": "url", + "url": "https://scans.io/" + }, + { + "name": "Nmap (T)", + "type": "url", + "url": "https://nmap.org/download.html" + }, + { + "name": "Online Port scanner", + "type": "url", + "url": "https://portscanner.online/" + }, + { + "name": "Internet Census Search", + "type": "url", + "url": "https://www.exfiltrated.com/querystart.php" + }, + { + "name": "Criminal IP Search", + "type": "url", + "url": "https://www.criminalip.io/" + }, + { + "name": "Scanless (T)", + "type": "url", + "url": "https://github.com/vesche/scanless" + }, + { + "name": "BinaryEdge (R)", + "type": "url", + "url": "https://www.binaryedge.io/" + }, + { + "name": "Masscan (T)", + "type": "url", + "url": "https://github.com/robertdavidgraham/masscan" + } + ] + }, + { + "name": "IPv4", + "type": "folder", + "children": [ + { + "name": "ASlookup.com", + "type": "url", + "url": "https://aslookup.com/" + }, + { + "name": "Port scanner Online", + "type": "url", + "url": "https://portscanner.online/" + }, + { + "name": "Onyphe", + "type": "url", + "url": "https://www.onyphe.io/" + }, + { + "name": "IPv4 CIDR Report", + "type": "url", + "url": "https://www.cidr-report.org/as2.0/" + }, + { + "name": "Reverse.report", + "type": "url", + "url": "https://reverse.report/" + }, + { + "name": "Team Cymru IP to ASN", + "type": "url", + "url": "https://asn.cymru.com/" + }, + { + "name": "IP to ASN DB", + "type": "url", + "url": "https://iptoasn.com/" + }, + { + "name": "Hacker Target - Reverse DNS", + "type": "url", + "url": "https://hackertarget.com/reverse-dns-lookup/" + } + ] + }, + { + "name": "IPv6", + "type": "folder", + "children": [ + { + "name": "IPv6 CIDR Report", + "type": "url", + "url": "https://www.cidr-report.org/v6/as2.0/" + } + ] + }, + { + "name": "BGP", + "type": "folder", + "children": [ + { + "name": "Hurricane Electric BGP Toolkit", + "type": "url", + "url": "https://bgp.he.net/" + }, + { + "name": "BGP Malicious Content Ranking", + "type": "url", + "url": "https://bgpranking.circl.lu/" + }, + { + "name": "PeeringDB", + "type": "url", + "url": "https://www.peeringdb.com/advanced_search" + }, + { + "name": "BGP Tools", + "type": "url", + "url": "https://www.bgp4.as/tools" + } + ] + }, + { + "name": "Reputation", + "type": "folder", + "children": [ + { + "name": "IP Void", + "type": "url", + "url": "https://www.ipvoid.com/" + }, + { + "name": "ExoneraTor", + "type": "url", + "url": "https://exonerator.torproject.org/" + }, + { + "name": "Grey Noise", + "type": "url", + "url": "https://viz.greynoise.io/" + } + ] + }, + { + "name": "Blacklists", + "type": "folder", + "children": [ + { + "name": "Blocklist.de", + "type": "url", + "url": "https://www.blocklist.de/en/index.html" + }, + { + "name": "DShield API", + "type": "url", + "url": "https://isc.sans.edu/api/" + }, + { + "name": "FireHOL IP Lists ", + "type": "url", + "url": "https://iplists.firehol.org/" + }, + { + "name": "Project Honey Pot", + "type": "url", + "url": "https://www.projecthoneypot.org/list_of_ips.php" + } + ] + }, + { + "name": "Neighbor Domains", + "type": "folder", + "children": [ + { + "name": "IP Fingerprints - Reverse IP Lookup", + "type": "url", + "url": "https://ipfingerprints.com/reverseip.php" + }, + { + "name": "Bing IP Search (D)", + "type": "url", + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + }, + { + "name": "TCP/IP Utils - Domain Neighbors", + "type": "url", + "url": "https://dnslytics.com/" + }, + { + "name": "MyIPNeighbors", + "type": "url", + "url": "https://www.my-ip-neighbors.com/" + } + ] + }, + { + "name": "Protected by Cloud Services", + "type": "folder", + "children": [ + { + "name": "CloudFlare Watch", + "type": "url", + "url": "https://www.crimeflare.com/" + }, + { + "name": "CloudFail (T)", + "type": "url", + "url": "https://github.com/m0rtem/CloudFail" + } + ] + }, + { + "name": "Wireless Network Info", + "type": "folder", + "children": [ + { + "name": "WiGLE: Wireless Network Mapping", + "type": "url", + "url": "https://wigle.net/" + }, + { + "name": "OpenCellid: Database of Cell Towers", + "type": "url", + "url": "https://opencellid.org/" + } + ] + }, + { + "name": "Network Analysis Tools", + "type": "folder", + "children": [ + { + "name": "Wireshark", + "type": "url", + "url": "https://www.wireshark.org/download.html" + }, + { + "name": "NetworkMiner", + "type": "url", + "url": "https://www.netresec.com/?page=Networkminer" + }, + { + "name": "Packet Total", + "type": "url", + "url": "https://www.packettotal.com/" + }, + { + "name": "checkip (T)", + "type": "url", + "url": "https://github.com/jreisinger/checkip" + } + ] + }, + { + "name": "IP Loggers", + "type": "folder", + "children": [ + { + "name": "Ki.tc", + "type": "url", + "url": "https://ki.tc" + }, + { + "name": "Grabify", + "type": "url", + "url": "https://grabify.link" + }, + { + "name": "IP Logger", + "type": "url", + "url": "https://iplogger.com/" + } + ] + } + ] + }, + { + "name": "Images / Videos / Docs", + "type": "folder", + "children": [ + { + "name": "Images", + "type": "folder", + "children": [ + { + "name": "Search", + "type": "folder", + "children": [ + { + "name": "Google Images", + "type": "url", + "url": "https://images.google.com/?gws_rd=ssl" + }, + { + "name": "Bing Images", + "type": "url", + "url": "https://www.bing.com/images" + }, + { + "name": "FaceCheck Facial Recognition Search", + "type": "url", + "url": "https://facecheck.id/" + }, + { + "name": "Surfface Face & People Search Engine", + "type": "url", + "url": "https://surfface.com/" + }, + { + "name": "PimEyes Face Search Engine", + "type": "url", + "url": "https://pimeyes.com/en" + }, + { + "name": "Yandex Images", + "type": "url", + "url": "https://www.yandex.com/images/" + }, + { + "name": "Baidu Images", + "type": "url", + "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" + }, + { + "name": "Twitter Image Search (M)", + "type": "url", + "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" + }, + { + "name": "Imgur Search", + "type": "url", + "url": "https://imgur.com/search" + }, + { + "name": "Photobucket", + "type": "url", + "url": "https://photobucket.com/" + }, + { + "name": "7Photos.net", + "type": "url", + "url": "https://7photos.net/" + }, + { + "name": "Panoramio", + "type": "url", + "url": "https://www.panoramio.com/" + }, + { + "name": "Current Location", + "type": "url", + "url": "https://current-location.com/" + }, + { + "name": "Lakako Photo Search", + "type": "url", + "url": "https://www.lakako.com/" + }, + { + "name": "Lenso.ai", + "type": "url", + "url": "https://lenso.ai/" + }, + { + "name": "CC Search", + "type": "url", + "url": "https://ccsearch.creativecommons.org/" + }, + { + "name": "CamFind App", + "type": "url", + "url": "https://camfindapp.com/" + }, + { + "name": "RevEye Reverse Image Search (T)", + "type": "url", + "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" + }, + { + "name": "SmugMug Search", + "type": "url", + "url": "https://www.smugmug.com/" + }, + { + "name": "ImageNet", + "type": "url", + "url": "https://image-net.org/" + }, + { + "name": "Places2", + "type": "url", + "url": "https://places2.csail.mit.edu/explore.html" + }, + { + "name": "Image Identification Project", + "type": "url", + "url": "https://www.imageidentify.com/" + }, + { + "name": "SauceNAO", + "type": "url", + "url": "https://saucenao.com/" + }, + { + "name": "Picarta", + "type": "url", + "url": "https://picarta.ai/" + }, + { + "name": "FaceSeek Face Search Engine", + "type": "url", + "url": "https://faceseek.online" + } + ] + }, + { + "name": "Instagram", + "type": "folder", + "children": [ + { + "name": "Webstigram", + "type": "url", + "url": "https://websta.me/search-engine-optimization/" + }, + { + "name": "Instagram", + "type": "url", + "url": "https://www.instagram.com/" + }, + { + "name": "Mini Instagram", + "type": "url", + "url": "https://mininsta.net/" + }, + { + "name": "Imgrab", + "type": "url", + "url": "https://www.imgrab.com/" + }, + { + "name": "Tofo.me", + "type": "url", + "url": "https://tofo.me/" + } + ] + }, + { + "name": "Flickr", + "type": "folder", + "children": [ + { + "name": "Flickr", + "type": "url", + "url": "https://www.flickr.com/" + }, + { + "name": "Flickr Map", + "type": "url", + "url": "https://www.flickr.com/map/" + }, + { + "name": "My Pics Map", + "type": "url", + "url": "https://www.mypicsmap.com/" + }, + { + "name": "idGettr", + "type": "url", + "url": "https://www.webfx.com/tools/idgettr/" + }, + { + "name": "Flickr Hive Mind", + "type": "url", + "url": "https://flickrhivemind.net/" + } + ] + }, + { + "name": "Metadata", + "type": "folder", + "children": [ + { + "name": "ExifEditor", + "type": "url", + "url": "https://exifeditor.io" + }, + { + "name": "ExifTool (T)", + "type": "url", + "url": "https://exiftool.org/" + }, + { + "name": "ExifViewer", + "type": "url", + "url": "https://www.exifviewer.org/" + }, + { + "name": "FOCA (T)", + "type": "url", + "url": "https://github.com/ElevenPaths/FOCA" + }, + { + "name": "GeoSetter", + "type": "url", + "url": "https://geosetter.de/en/main-en/" + }, + { + "name": "Jeffrey's Exif Viewer", + "type": "url", + "url": "https://exif.regex.info/" + }, + { + "name": "JPEGsnoop (T)", + "type": "url", + "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" + }, + { + "name": "Metapicz", + "type": "url", + "url": "https://metapicz.com/#landing" + }, + { + "name": "Search by Exif", + "type": "url", + "url": "https://www.exif-search.com/" + }, + { + "name": "xeuledoc - Fetch metadata about any public Google document", + "type": "url", + "url": "https://github.com/Malfrats/xeuledoc" + }, + { + "name": "FOCA (T)", + "type": "url", + "url": "https://github.com/ElevenPaths/FOCA" + }, + { + "name": "Exiv2 (T)", + "type": "url", + "url": "https://exiv2.org/" + }, + { + "name": "MediaInfo (T)", + "type": "url", + "url": "https://mediaarea.net/en/MediaInfo" + }, + { + "name": "Apache Tika (T)", + "type": "url", + "url": "https://tika.apache.org/" + }, + { + "name": "oletools (T)", + "type": "url", + "url": "https://github.com/decalage2/oletools" + }, + { + "name": "Hachoir (T)", + "type": "url", + "url": "https://github.com/vstinner/hachoir" + }, + { + "name": "C2PA Verify", + "type": "url", + "url": "https://contentcredentials.org/verify" + }, + { + "name": "Metadata2Go", + "type": "url", + "url": "https://www.metadata2go.com/" + }, + { + "name": "Get-Metadata", + "type": "url", + "url": "https://www.get-metadata.com/" + } + ] + }, + { + "name": "Forensics", + "type": "folder", + "children": [ + { + "name": "Ghiro (T)", + "type": "url", + "url": "https://github.com/ghirensics/ghiro" + }, + { + "name": "Camera Trace", + "type": "url", + "url": "https://www.cameratrace.com/trace" + }, + { + "name": "Forensically", + "type": "url", + "url": "https://29a.ch/photo-forensics/" + } + ] + }, + { + "name": "OCR", + "type": "folder", + "children": [ + { + "name": "Online OCR", + "type": "url", + "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" + }, + { + "name": "i2OCR", + "type": "url", + "url": "https://www.i2ocr.com/" + }, + { + "name": "New OCR", + "type": "url", + "url": "https://www.newocr.com/" + }, + { + "name": "Online OCR", + "type": "url", + "url": "https://www.onlineocr.net/" + } + ] + }, + { + "name": "Tools", + "type": "folder", + "children": [ + { + "name": "Creepy (T)", + "type": "url", + "url": "https://www.geocreepy.com/" + } + ] + } + ] + }, + { + "name": "Videos", + "type": "folder", + "children": [ + { + "name": "Search", + "type": "folder", + "children": [ + { + "name": "Google Videos", + "type": "url", + "url": "https://www.google.com/videohp?gws_rd=ssl" + }, + { + "name": "Bing Videos", + "type": "url", + "url": "https://www.bing.com/videos" + }, + { + "name": "Internet Archive Videos", + "type": "url", + "url": "https://archive.org/details/opensource_movies" + }, + { + "name": "Vines (D)", + "type": "url", + "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" + }, + { + "name": "Dogpile Web Search", + "type": "url", + "url": "https://www.dogpile.com/" + }, + { + "name": "Geo Search Tool", + "type": "url", + "url": "https://www.geosearchtool.com/" + }, + { + "name": "blinkx Video Search", + "type": "url", + "url": "https://blinkx.com/" + }, + { + "name": "Facebook Live Map", + "type": "url", + "url": "https://www.facebook.com/watch/live/?ref=live_delegate" + }, + { + "name": "LiveLeak", + "type": "url", + "url": "https://www.liveleak.com/" + }, + { + "name": "Metatube", + "type": "url", + "url": "https://www.metatube.com/" + }, + { + "name": "Yahoo Video Search", + "type": "url", + "url": "https://video.search.yahoo.com/" + }, + { + "name": "Search YouTube by Location", + "type": "url", + "url": "https://mattw.io/youtube-geofind/location" + } + ] + }, + { + "name": "Analyze / Record", + "type": "folder", + "children": [ + { + "name": "DetURL", + "type": "url", + "url": "https://deturl.com/" + }, + { + "name": "Print YouTube StoryBoard Instructions", + "type": "url", + "url": "https://www.labnol.org/internet/print-youtube-video/28217" + }, + { + "name": "Print Storyboard from Youtube", + "type": "url", + "url": "javascript:(function(){a=ytplayer.config.args.storyboard_spec;if(!a){alert(\"Sorry we cannot process this YouTube video. Could you please try another one\");exit();}b=a.split(\"|\");base=b[0].split(\"$\")[0]+\"2/M\";c=b[3].split(\"%23\");sigh=c[c.length-1];var imgs=\"\";t=ytplayer.config.args.length_seconds;n=Math.ceil(c[2]/(c[3]*c[4]));for(i=0;i
\";}var title=ytplayer.config.args.title;msg=\" Date: Thu, 26 Mar 2026 12:20:12 -0400 Subject: [PATCH 02/22] Enrich Compliance & Risk Intelligence tools with metadata (THE-61) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add description, status badges, pricing, bestFor, input/output, opsec details, and all badge fields for 13 tools across Sanctions Screening, KYC/AML, Beneficial Ownership, and PEP Databases. Notable findings: - Ukraine PEP Register marked (D) — site now redirects to wartime advocacy page - EU Sanctions Tool marked (D) — DNS resolution degraded - PepChecker and OCCRP Aleph marked (R) — require registration Co-Authored-By: Paperclip --- public/arf.json | 16013 +++++++++++++++++++++++----------------------- 1 file changed, 8104 insertions(+), 7909 deletions(-) diff --git a/public/arf.json b/public/arf.json index 14eb620..f26d28d 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1,7910 +1,8105 @@ { - "name": "OSINT Framework", - "type": "folder", - "children": [ - { - "name": "Username", - "type": "folder", - "children": [ - { - "name": "Username Search Engines", - "type": "folder", - "children": [ - { - "name": "Sylva Identity Discovery (T)", - "type": "url", - "url": "https://sylva.pfeister.dev/", - "description": "Open-source CLI tool for username and identity discovery with branch discovery to expand searches as additional linked identities are uncovered.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration with identity branching", - "input": "Username", - "output": "Linked accounts and identities across platforms", - "opsec": "active", - "opsecNote": "Makes requests to target platforms to check username existence; external API keys may be used.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Sherlock (T)", - "type": "url", - "url": "https://github.com/sherlock-project/sherlock", - "description": "Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.", - "status": "live", - "pricing": "free", - "bestFor": "Mass username enumeration across 400+ sites", - "input": "Username(s)", - "output": "List of discovered profile URLs across social networks", - "opsec": "active", - "opsecNote": "Directly queries each target site to check username existence; supports Tor/proxy for anonymity.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Namechk", - "type": "url", - "url": "https://namechk.com/", - "description": "Web-based username and domain availability checker that searches 100+ social media platforms and 36 domain extensions simultaneously.", - "status": "live", - "pricing": "free", - "bestFor": "Quick username availability check across social media and domains", - "input": "Username or domain name", - "output": "Availability status across 100+ platforms and domain extensions", - "opsec": "passive", - "opsecNote": "Searches are routed through Namechk's servers; target accounts are not directly contacted by the user.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "WhatsMyName (T)", - "type": "url", - "url": "https://github.com/WebBreacher/WhatsMyName", - "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration using community-maintained site detection data", - "input": "Username", - "output": "List of sites where the username exists, based on HTTP response pattern matching", - "opsec": "active", - "opsecNote": "Makes HTTP requests to each target site to check for username existence.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Thats Them", - "type": "url", - "url": "https://thatsthem.com/", - "description": "Free people search engine aggregating data from 50+ sources. Supports lookups by name, address, phone number, or email.", - "status": "live", - "pricing": "freemium", - "bestFor": "People search by name, email, phone, or address", - "input": "Name, email address, phone number, or physical address", - "output": "Contact info, residential details, demographics, and financial estimates", - "opsec": "passive", - "opsecNote": "Searches are routed through ThatsThem's servers; the target is not alerted.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "NameCheckup", - "type": "url", - "url": "https://namecheckup.com/", - "description": "Free web-based username and domain availability checker that searches across 20+ social media platforms and 40+ domain extensions with WHOIS lookup support.", - "status": "live", - "pricing": "free", - "bestFor": "Username and domain availability checking with WHOIS info", - "input": "Username or domain name", - "output": "Availability status across social platforms and domain extensions, with WHOIS data", - "opsec": "passive", - "opsecNote": "Searches are proxied through NameCheckup's servers; no direct contact with target platforms by the user.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "GitFive (T)", - "type": "url", - "url": "https://github.com/mxrch/GitFive", - "description": "OSINT CLI tool for investigating GitHub profiles. Tracks username/name history, maps emails to accounts, extracts SSH public keys, and exports findings as JSON.", - "status": "live", - "pricing": "free", - "bestFor": "Deep investigation of GitHub user profiles and email-to-account mapping", - "input": "GitHub username or email address", - "output": "Profile history, linked emails, SSH keys, repository analysis, JSON export", - "opsec": "active", - "opsecNote": "Queries GitHub API directly; developer recommends using a secondary GitHub account.", - "localInstall": true, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Sherlock", - "type": "url", - "url": "https://github.com/sherlock-project/sherlock", - "description": "Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.", - "status": "live", - "pricing": "free", - "bestFor": "Mass username enumeration across 400+ sites", - "input": "Username(s)", - "output": "List of discovered profile URLs across social networks", - "opsec": "active", - "opsecNote": "Directly queries each target site to check username existence; supports Tor/proxy for anonymity.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Names Directory", - "type": "url", - "url": "https://namesdir.com/", - "description": "Searchable database of 1B+ name combinations collected from public sources. Allows bidirectional lookup to find first names by surname or surnames by first name.", - "status": "live", - "pricing": "free", - "bestFor": "Finding name combinations and frequency data for a given first or last name", - "input": "First name or surname", - "output": "Associated name combinations with frequency counts", - "opsec": "passive", - "opsecNote": "Queries a static public database; no contact with any target individual.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Lullar", - "type": "url", - "url": "https://com.lullar.com", - "description": "Free people search and username lookup tool that searches across 148+ social media platforms including Instagram, TikTok, Facebook, and LinkedIn.", - "status": "live", - "pricing": "free", - "bestFor": "Social media profile discovery by username, email, or name", - "input": "Email address, full name, or username", - "output": "Social media profiles found across 148+ platforms", - "opsec": "passive", - "opsecNote": "Searches are routed through Lullar's servers; no direct queries from the user to target platforms.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - } - ] - }, - { - "name": "Specific Sites", - "type": "folder", - "children": [ - { - "name": "Amazon Usernames (M)", - "type": "url", - "url": "https://www.google.com/search?q=site:amazon.com+%3Cusername%3E", - "description": "Google dork that searches Amazon.com for pages associated with a specific username, surfacing public profiles, wishlists, and reviews.", - "status": "live", - "pricing": "free", - "bestFor": "Finding Amazon public profiles, wishlists, and review activity by username", - "input": "Username (inserted into Google search query)", - "output": "Google search results linking to Amazon pages mentioning the username", - "opsec": "passive", - "opsecNote": "Query goes to Google, not Amazon directly. Google may log the search but the target is not alerted.", - "localInstall": false, - "googleDork": true, - "registration": false, - "editUrl": true, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Github User (M)", - "type": "url", - "url": "https://api.github.com/users/%3Cusername%3E/events/public", - "description": "Queries the GitHub public Events API to retrieve a user's recent public activity, including pushes, pull requests, issues, and other repository events.", - "status": "live", - "pricing": "free", - "bestFor": "Enumerating a GitHub user's recent public activity and repository interactions", - "input": "GitHub username (inserted into URL path)", - "output": "JSON array of public events (pushes, PRs, issues, comments) with timestamps and repo details", - "opsec": "passive", - "opsecNote": "Unauthenticated API call; GitHub rate-limits by IP (60 req/hr) but does not notify the target user.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Tinder Usernames (M)", - "type": "url", - "url": "https://www.gotinder.com/@%3Cusername%3E", - "description": "Accesses a Tinder user's public web profile via their username. The gotinder.com domain redirects to tinder.com.", - "status": "live", - "pricing": "free", - "bestFor": "Confirming existence of a Tinder profile and viewing public profile details", - "input": "Tinder username (appended to URL after @)", - "output": "Public profile page with name, photo, and basic info if the user has web sharing enabled", - "opsec": "passive", - "opsecNote": "Simple HTTP GET to a public page; target is not notified of profile views via the web URL.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Keybase", - "type": "url", - "url": "https://keybase.io/", - "description": "Platform for cryptographic identity verification, linking social media accounts, PGP keys, and cryptocurrency addresses to a single profile. Acquired by Zoom in 2020 but still operational.", - "status": "live", - "pricing": "free", - "bestFor": "Looking up verified social accounts, PGP keys, and crypto wallets tied to a username", - "input": "Username", - "output": "User profile showing verified identities across platforms, PGP keys, cryptocurrency addresses, and devices", - "opsec": "passive", - "opsecNote": "Public profile lookups are passive web requests. No login required to view profiles.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "MIT PGP Key Server", - "type": "url", - "url": "https://pgp.mit.edu/", - "description": "MIT PGP Public Key Server for searching, submitting, and removing PGP public keys. Look up keys by name, email, or key ID to find associated cryptographic identities.", - "status": "live", - "pricing": "free", - "bestFor": "Looking up PGP public keys associated with a username or email address", - "input": "Name, email address, or key ID", - "output": "PGP public key data, key fingerprints, associated UIDs/email addresses, and key metadata", - "opsec": "passive", - "opsecNote": "Public key server query; no authentication required and target is not notified of lookups.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "ProtonMail users (M)", - "type": "url", - "url": "https://api.protonmail.ch/pks/lookup?op=index&search=@protonmail.com", - "description": "Queries ProtonMail's HKP-compatible PGP key server to look up the public key for a ProtonMail username. A successful response confirms the account exists.", - "status": "live", - "pricing": "free", - "bestFor": "Confirming whether a ProtonMail username exists and retrieving its PGP public key", - "input": "ProtonMail username (appended with @protonmail.com)", - "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", - "opsec": "passive", - "opsecNote": "Unauthenticated API query to ProtonMail's public key server. Target user is not notified. Enables user enumeration.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "ProtonMail Domains (M)", - "type": "url", - "url": "https://api.protonmail.ch/pks/lookup?op=index&search=", - "description": "Queries ProtonMail's HKP key server with a full email address to check for a PGP public key. Useful for identifying ProtonMail users on custom domains.", - "status": "live", - "pricing": "free", - "bestFor": "Checking if an email address on a custom domain is hosted on ProtonMail", - "input": "Full email address (any domain that may be hosted on ProtonMail)", - "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", - "opsec": "passive", - "opsecNote": "Unauthenticated public HKP endpoint. Target is not notified. Can reveal whether a custom domain uses ProtonMail.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": true, - "api": true, - "invitationOnly": false, - "deprecated": false - } - ] - } - ] - }, - { - "name": "Email Address", - "type": "folder", - "children": [ - { - "name": "Email Search", - "type": "folder", - "children": [ - { - "name": "Sylva Identity Discovery (T)", - "type": "url", - "url": "https://sylva.pfeister.dev/" - }, - { - "name": "ThatsThem", - "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" - }, - { - "name": "Hunter", - "type": "url", - "url": "https://hunter.io/" - }, - { - "name": "Email to Address (R)", - "type": "url", - "url": "https://www.melissa.com/" - }, - { - "name": "VoilaNorbert", - "type": "url", - "url": "https://www.voilanorbert.com/" - }, - { - "name": "GHunt (T)", - "type": "url", - "url": "https://github.com/mxrch/GHunt" - }, - { - "name": "OSINT Industries", - "type": "url", - "url": "https://www.osint.industries/" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Infoga (T)", - "type": "url", - "url": "https://github.com/m4ll0k/infoga" - }, - { - "name": "Skymem", - "type": "url", - "url": "https://www.skymem.info/" - }, - { - "name": "Epieos Email Tool", - "type": "url", - "url": "https://tools.epieos.com/email.php" - }, - { - "name": "breach.vip", - "type": "url", - "url": "https://breach.vip/" - }, - { - "name": "Holehe (T)", - "type": "url", - "url": "https://github.com/megadose/holehe" - } - ] - }, - { - "name": "Common Email Formats", - "type": "folder", - "children": [ - { - "name": "Email Format", - "type": "url", - "url": "https://www.email-format.com/" - }, - { - "name": "Email Permutator", - "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" - } - ] - }, - { - "name": "Email Verification", - "type": "folder", - "children": [ - { - "name": "Reacher Github (T)", - "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" - }, - { - "name": "Reacher Demo", - "type": "url", - "url": "https://reacher.email" - }, - { - "name": "MailScrap", - "type": "url", - "url": "https://mailscrap.com/" - }, - { - "name": "Read Notify", - "type": "url", - "url": "https://www.readnotify.com/" - }, - { - "name": "Email Reputation", - "type": "url", - "url": "https://emailrep.io/" - }, - { - "name": "MailboxValidator", - "type": "url", - "url": "https://www.mailboxvalidator.com/demo" - }, - { - "name": "VerifyEmail (R$)", - "type": "url", - "url": "https://emailable.com/" - } - ] - }, - { - "name": "Breach Data", - "type": "folder", - "children": [ - { - "name": "Have I been pwned?", - "type": "url", - "url": "https://haveibeenpwned.com/", - "description": "Database of breached credentials and email addresses from known data breaches.", - "status": "live", - "pricing": "freemium", - "bestFor": "Breach detection, credential exposure checks", - "input": "Email address, phone number, password hash", - "output": "Breach names, breach dates, exposed data types", - "opsec": "passive", - "opsecNote": "Queries breach database via API. Target is not notified of lookups.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Hudson Rock", - "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" - }, - { - "name": "DeHashed (R)", - "type": "url", - "url": "https://dehashed.com/" - }, - { - "name": "Vigilante.pw", - "type": "url", - "url": "https://www.vigilante.pw/" - } - ] - }, - { - "name": "Mail Blacklists", - "type": "folder", - "children": [ - { - "name": "MxToolbox", - "type": "url", - "url": "https://mxtoolbox.com/" - } - ] - } - ] - }, - { - "name": "Domain Name", - "type": "folder", - "children": [ - { - "name": "Whois Records", - "type": "folder", - "children": [ - { - "name": "Domain Dossier", - "type": "url", - "url": "https://centralops.net/co/DomainDossier.aspx" - }, - { - "name": "domainIQ", - "type": "url", - "url": "https://www.domainiq.com/" - }, - { - "name": "DomainTools Whois", - "type": "url", - "url": "https://whois.domaintools.com/" - }, - { - "name": "SWITCH Internet Domains Whois (.ch)", - "type": "url", - "url": "https://www.nic.ch/whois/" - }, - { - "name": "Whoisology", - "type": "url", - "url": "https://whoisology.com/#advanced" - }, - { - "name": "Whois ARIN", - "type": "url", - "url": "https://whois.arin.net/ui/advanced.jsp" - }, - { - "name": "DNSstuff", - "type": "url", - "url": "https://www.dnsstuff.com/freetools" - }, - { - "name": "Robtex (R)", - "type": "url", - "url": "https://robtex.com/" - }, - { - "name": "Domaincrawler.com", - "type": "url", - "url": "https://domaincrawler.com/" - }, - { - "name": "MarkMonitor Whois Search", - "type": "url", - "url": "https://domains.markmonitor.com/whois/" - }, - { - "name": "easyWhois", - "type": "url", - "url": "https://www.easywhois.com/" - }, - { - "name": "Website Informer", - "type": "url", - "url": "https://website.informer.com/" - }, - { - "name": "Who.is", - "type": "url", - "url": "https://who.is/" - }, - { - "name": "Whois AMPed", - "type": "url", - "url": "https://whoisamped.com/" - }, - { - "name": "ViewDNS.info", - "type": "url", - "url": "https://viewdns.info/" - }, - { - "name": "Daily DNS Changes", - "type": "url", - "url": "https://dailychanges.domaintools.com/" - }, - { - "name": "IP2WHOIS", - "type": "url", - "url": "https://www.ip2whois.com" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/whois_domains/" - } - ] - }, - { - "name": "Subdomains", - "type": "folder", - "children": [ - { - "name": "SynapsInt", - "type": "url", - "url": "https://synapsint.com" - }, - { - "name": "Aquatone (T)", - "type": "url", - "url": "https://github.com/michenriksen/aquatone" - }, - { - "name": "FindSubDomains", - "type": "url", - "url": "https://findsubdomains.com/" - }, - { - "name": "Google Subdomains (D)", - "type": "url", - "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" - }, - { - "name": "Recon-ng (T)", - "type": "url", - "url": "https://github.com/lanmaster53/recon-ng", - "description": "Full-featured web reconnaissance framework with independent modules for data gathering.", - "status": "live", - "pricing": "free", - "bestFor": "Modular web recon, API-driven data collection", - "input": "Domain, company name, email, IP", - "output": "Contacts, hosts, credentials, ports via module-specific results", - "opsec": "passive", - "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "XRay", - "type": "url", - "url": "https://github.com/evilsocket/xray" - }, - { - "name": "DNS Recon (T)", - "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" - }, - { - "name": "Gobuster (T)", - "type": "url", - "url": "https://github.com/OJ/gobuster" - }, - { - "name": "Fierce Domain Scanner (T)", - "type": "url", - "url": "https://github.com/davidpepper/fierce-domain-scanner" - }, - { - "name": "Bluto (T)", - "type": "url", - "url": "https://github.com/darryllane/Bluto" - }, - { - "name": "OWASP Maryam (T)", - "type": "url", - "url": "https://github.com/saeeddhqan/Maryam" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Pentest-tools.com Subdomains", - "type": "url", - "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" - }, - { - "name": "SecLists DNS Subdomains (T)", - "type": "url", - "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" - }, - { - "name": "dnspop (T)", - "type": "url", - "url": "https://github.com/bitquark/dnspop" - }, - { - "name": "gdns (T)", - "type": "url", - "url": "https://github.com/hrbrmstr/gdns" - }, - { - "name": "Sublist3r", - "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" - }, - { - "name": "AltDNS (T)", - "type": "url", - "url": "https://github.com/infosec-au/altdns" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/domains/" - } - ] - }, - { - "name": "Discovery", - "type": "folder", - "children": [ - { - "name": "Shodan", - "type": "url", - "url": "https://www.shodan.io/", - "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", - "status": "live", - "pricing": "freemium", - "bestFor": "Port scanning, banner grabbing, IoT discovery", - "input": "IP address, domain", - "output": "Open ports, services, banners, CVEs", - "opsec": "passive", - "opsecNote": "Queries cached scan data. Does not directly probe the target.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/" - }, - { - "name": "Kraken (T)", - "type": "url", - "url": "https://github.com/Sw4mpf0x/Kraken" - }, - { - "name": "Online Nikto scanner", - "type": "url", - "url": "https://nikto.online/" - }, - { - "name": "urlscan.io", - "type": "url", - "url": "https://urlscan.io/search/#*" - }, - { - "name": "Daily DNS Changes", - "type": "url", - "url": "https://dailychanges.domaintools.com/" - }, - { - "name": "Redirect Detective", - "type": "url", - "url": "https://redirectdetective.com/" - }, - { - "name": "Sitediff (T)", - "type": "url", - "url": "https://github.com/digininja/sitediff" - }, - { - "name": "BuiltWith", - "type": "url", - "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", - "status": "live", - "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", - "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "Wappalyzer", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "AnalyzeID", - "type": "url", - "url": "https://analyzeid.com/" - }, - { - "name": "Criminal IP Search", - "type": "url", - "url": "https://www.criminalip.io/" - }, - { - "name": "urlDNA", - "type": "url", - "url": "https://urldna.io" - }, - { - "name": "ZoomEye.ai", - "type": "url", - "url": "https://www.zoomeye.org/" - } - ] - }, - { - "name": "Certificate Search", - "type": "folder", - "children": [ - { - "name": "Shodan", - "type": "url", - "url": "https://www.shodan.io/" - }, - { - "name": "Google's Certificate Transparency", - "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" - }, - { - "name": "Spyse", - "type": "url", - "url": "https://spyse.com/search/certificate" - }, - { - "name": "Censys", - "type": "url", - "url": "https://censys.io/", - "description": "Internet-wide scanner and search engine for hosts, certificates, and services.", - "status": "live", - "pricing": "freemium", - "bestFor": "Certificate discovery, host enumeration, exposure monitoring", - "input": "Domain, IP, certificate fingerprint, search query", - "output": "Host details, open ports, TLS certificates, service banners", - "opsec": "passive", - "opsecNote": "Queries pre-scanned data. Does not probe the target directly.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "crt.sh - Certificate Search", - "type": "url", - "url": "https://crt.sh/?" - }, - { - "name": "CertKit - Certificate Transparency Log Search", - "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" - }, - { - "name": "certgraph (T)", - "type": "url", - "url": "https://github.com/lanrat/certgraph" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://app.netlas.io/certs/" - } - ] - }, - { - "name": "PassiveDNS", - "type": "folder", - "children": [ - { - "name": "Mnemonic", - "type": "url", - "url": "https://passivedns.mnemonic.no/" - }, - { - "name": "DNS Dumpster", - "type": "url", - "url": "https://dnsdumpster.com/" - }, - { - "name": "Deteque (R)", - "type": "url", - "url": "https://www.deteque.com/" - } - ] - }, - { - "name": "Reputation", - "type": "folder", - "children": [ - { - "name": "UrlQuery.net", - "type": "url", - "url": "https://urlquery.net/" - }, - { - "name": "URL Void", - "type": "url", - "url": "https://www.urlvoid.com/" - }, - { - "name": "FortiGuard Reputation Service", - "type": "url", - "url": "https://fortiguard.com/iprep" - }, - { - "name": "Trend Micro Site Safety Center", - "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" - }, - { - "name": "WatchGuard ReputationAuthority", - "type": "url", - "url": "https://www.reputationauthority.org/" - }, - { - "name": "Sucuri SiteCheck", - "type": "url", - "url": "https://sitecheck.sucuri.net/" - }, - { - "name": "ThreatMiner.org", - "type": "url", - "url": "https://www.threatminer.org/" - }, - { - "name": "BlueCoat WebPulse", - "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" - }, - { - "name": "Zscaler Zulu URL Risk Analyzer", - "type": "url", - "url": "https://zulu.zscaler.com/" - }, - { - "name": "Joe Sandbox Url Analyzer", - "type": "url", - "url": "https://www.url-analyzer.net/" - }, - { - "name": "Deepviz Domain Search", - "type": "url", - "url": "https://search.deepviz.com/" - }, - { - "name": "AVG Threat Labs", - "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" - }, - { - "name": "Webroot BrightCloud URL/IP Lookup", - "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" - }, - { - "name": "vURL Online", - "type": "url", - "url": "https://vurldissect.co.uk/" - }, - { - "name": "AlienVault Open Threat Exchange", - "type": "url", - "url": "https://otx.alienvault.com/browse/pulses/" - }, - { - "name": "Malware Domain List", - "type": "url", - "url": "https://www.malwaredomainlist.com/mdl.php" - }, - { - "name": "Web Inspector Online Scan", - "type": "url", - "url": "https://www.webinspector.com/website-malware-scanner/" - }, - { - "name": "Google Safe Browsing API", - "type": "url", - "url": "https://developers.google.com/safe-browsing/?csw=1" - }, - { - "name": "Cisco Talos", - "type": "url", - "url": "https://talosintelligence.com/" - } - ] - }, - { - "name": "Domain Blacklists", - "type": "folder", - "children": [ - { - "name": "Threatexpert.com Malicious URLs", - "type": "url", - "url": "https://www.networksec.org/grabbho/block.txt" - }, - { - "name": "Zeus C2 Tracker", - "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" - }, - { - "name": "Malware Domains Blacklist", - "type": "url", - "url": "https://mirror1.malwaredomains.com/files/domains.txt" - }, - { - "name": "Blackweb", - "type": "url", - "url": "https://github.com/maravento/blackweb" - }, - { - "name": "Critical Stack Intel (R)", - "type": "url", - "url": "https://intel.criticalstack.com/" - }, - { - "name": "DNS Sinkhole", - "type": "url", - "url": "https://malc0de.com/bl/" - }, - { - "name": "DNS-BH Malware Domain Blocklist", - "type": "url", - "url": "https://www.malwaredomains.com/wordpress/?page_id=66" - }, - { - "name": "Malware Domain List", - "type": "url", - "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" - }, - { - "name": "MalwareURL (R)", - "type": "url", - "url": "https://www.malwareurl.com/index.php" - }, - { - "name": "scumware.org", - "type": "url", - "url": "https://www.scumware.org/" - }, - { - "name": "ZeuS Tracker", - "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php" - }, - { - "name": "Shadowserver Foundation", - "type": "url", - "url": "https://www.shadowserver.org/" - }, - { - "name": "Email Domain Validation", - "type": "url", - "url": "https://www.mailboxvalidator.com/domain" - } - ] - }, - { - "name": "Typosquatting", - "type": "folder", - "children": [ - { - "name": "DNS Twist (T)", - "type": "url", - "url": "https://github.com/elceef/dnstwist" - }, - { - "name": "URLCrazy (T)", - "type": "url", - "url": "https://www.morningstarsecurity.com/research/urlcrazy" - }, - { - "name": "dnstwister", - "type": "url", - "url": "https://dnstwister.report/" - }, - { - "name": "Catphish (T)", - "type": "url", - "url": "https://github.com/ring0lab/catphish" - } - ] - }, - { - "name": "Analytics", - "type": "folder", - "children": [ - { - "name": "BuiltWith", - "type": "url", - "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", - "status": "live", - "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", - "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", - "localInstall": false, - "googleDork": false, - "registration": true, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "SiteSleuth", - "type": "url", - "url": "https://www.sitesleuth.io/" - }, - { - "name": "Wappalyzer (T)", - "type": "url", - "url": "https://www.wappalyzer.com/" - }, - { - "name": "SEMrush", - "type": "url", - "url": "https://www.semrush.com/" - }, - { - "name": "Moonsearch", - "type": "url", - "url": "https://moonsearch.com/" - }, - { - "name": "Ewhois", - "type": "url", - "url": "https://ewhois.com/" - }, - { - "name": "StatsCrop", - "type": "url", - "url": "https://www.statscrop.com/" - }, - { - "name": "Open Site Explorer", - "type": "url", - "url": "https://moz.com/link-explorer" - }, - { - "name": "SpyOnWeb", - "type": "url", - "url": "https://www.spyonweb.com/" - }, - { - "name": "Keyword Density", - "type": "url", - "url": "https://tools.seobook.com/general/keyword-density/" - }, - { - "name": "Alexa Site Statistics", - "type": "url", - "url": "https://alexa.amazon.com/about" - }, - { - "name": "Cisco Umbrella Popularity List", - "type": "url", - "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" - }, - { - "name": "Alexa Top 500 Global Sites", - "type": "url", - "url": "https://alexa.amazon.com/about" - }, - { - "name": "Sitedossier", - "type": "url", - "url": "https://www.sitedossier.com/" - }, - { - "name": "Visual Site Mapper", - "type": "url", - "url": "https://github.com/alentum/sitemapper-nodejs" - }, - { - "name": "ClearWebStats.com", - "type": "url", - "url": "https://www.clearwebstats.com/" - }, - { - "name": "PubDB", - "type": "url", - "url": "https://pub-db.com/" - }, - { - "name": "SimilarWeb", - "type": "url", - "url": "https://www.similarweb.com/" - }, - { - "name": "Siteliner", - "type": "url", - "url": "https://www.siteliner.com/" - }, - { - "name": "WhatWeb", - "type": "url", - "url": "https://github.com/urbanadventurer/WhatWeb" - } - ] - }, - { - "name": "URL Expanders", - "type": "folder", - "children": [ - { - "name": "Link Expander", - "type": "url", - "url": "https://www.linkexpander.com/" - }, - { - "name": "CheckShortURL", - "type": "url", - "url": "https://checkshorturl.com/" - }, - { - "name": "URL Expander", - "type": "url", - "url": "https://urlex.org/" - }, - { - "name": "Where Does This Link Go?", - "type": "url", - "url": "https://wheregoes.com/" - }, - { - "name": "KnowURL", - "type": "url", - "url": "https://www.knowurl.com/" - } - ] - }, - { - "name": "Change Detection", - "type": "folder", - "children": [ - { - "name": "VisualPing", - "type": "url", - "url": "https://visualping.io:443/" - }, - { - "name": "Change Detection", - "type": "url", - "url": "https://visualping.io/" - }, - { - "name": "Check site availability Online", - "type": "url", - "url": "https://upcheck.online/" - }, - { - "name": "Follow That Page", - "type": "url", - "url": "https://www.followthatpage.com/" - }, - { - "name": "Urlwatch", - "type": "url", - "url": "https://github.com/thp/urlwatch" - }, - { - "name": "WatchThatPage", - "type": "url", - "url": "https://watchthatpage.com/" - }, - { - "name": "ChangeDetect", - "type": "url", - "url": "https://www.eatgrainmaker.com/home/" - } - ] - }, - { - "name": "Social Analysis", - "type": "folder", - "children": [ - { - "name": "Google Trends", - "type": "url", - "url": "https://trends.google.com/trends/" - } - ] - }, - { - "name": "DNSSEC", - "type": "folder", - "children": [ - { - "name": "DNSSEC Analyzer", - "type": "url", - "url": "https://dnssec-analyzer.verisignlabs.com/" - }, - { - "name": "DNSViz", - "type": "url", - "url": "https://dnsviz.net/" - } - ] - }, - { - "name": "Vulnerabilities", - "type": "folder", - "children": [ - { - "name": "Scanners", - "type": "folder", - "children": [ - { - "name": "Sn1per (T)", - "type": "url", - "url": "https://github.com/1N3/Sn1per" - }, - { - "name": "Online Nikto scanner", - "type": "url", - "url": "https://nikto.online/" - }, - { - "name": "WDES - Web Data Exposure Scanner (T)", - "type": "url", - "url": "https://github.com/eduardoit/web-data-exposure-scanner" - } - ] - }, - { - "name": "Disclosure Sites", - "type": "folder", - "children": [ - { - "name": "Zone-H.org", - "type": "url", - "url": "https://zone-h.org/archive" - } - ] - }, - { - "name": "RobotsDisallowed", - "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" - } - ] - }, - { - "name": "Tools", - "type": "folder", - "children": [ - { - "name": "Belati (T)", - "type": "url", - "url": "https://github.com/aancw/Belati" - }, - { - "name": "Burp Suite (T)", - "type": "url", - "url": "https://portswigger.net/burp" - }, - { - "name": "EyeWitness (T)", - "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" - }, - { - "name": "Hunting-New-Registered-Domains (T)", - "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" - }, - { - "name": "International Domain Name Conversion Tool", - "type": "url", - "url": "https://mct.verisign-grs.com/" - }, - { - "name": "Online Nikto scanner", - "type": "url", - "url": "https://nikto.online/" - } - ] - }, - { - "name": "Report Malicious Sites", - "type": "folder", - "children": [ - { - "name": "Microsoft", - "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" - }, - { - "name": "Google", - "type": "url", - "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" - } - ] - } - ] - }, - { - "name": "Cloud Infrastructure", - "type": "folder", - "children": [ - { - "name": "AWS Enumeration", - "type": "folder", - "children": [ - { - "name": "cloud_enum (T)", - "type": "url", - "url": "https://github.com/initstring/cloud_enum" - }, - { - "name": "AWSBucketDump (T)", - "type": "url", - "url": "https://github.com/jordanpotti/AWSBucketDump" - }, - { - "name": "Subfinder (T)", - "type": "url", - "url": "https://github.com/projectdiscovery/subfinder" - } - ] - }, - { - "name": "Azure/GCP Discovery", - "type": "folder", - "children": [ - { - "name": "GCPBucketBrute (T)", - "type": "url", - "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" - }, - { - "name": "AADInternals (T)", - "type": "url", - "url": "https://github.com/Gerenios/AADInternals" - }, - { - "name": "ROADtools (T)", - "type": "url", - "url": "https://github.com/dirkjanm/roadtools" - }, - { - "name": "MicroBurst (T)", - "type": "url", - "url": "https://github.com/NetSPI/MicroBurst" - }, - { - "name": "Stormspotter (T)", - "type": "url", - "url": "https://github.com/Azure/Stormspotter" - } - ] - }, - { - "name": "S3/Blob Storage", - "type": "folder", - "children": [ - { - "name": "Public Buckets", - "type": "url", - "url": "https://buckets.grayhatwarfare.com/" - }, - { - "name": "goblob (T)", - "type": "url", - "url": "https://github.com/Macmod/goblob" - }, - { - "name": "S3Scanner (T)", - "type": "url", - "url": "https://github.com/sa7mon/s3scanner" - }, - { - "name": "BucketLoot (T)", - "type": "url", - "url": "https://github.com/redhuntlabs/BucketLoot" - }, - { - "name": "lazys3 (T)", - "type": "url", - "url": "https://github.com/nahamsec/lazys3" - } - ] - }, - { - "name": "Cloud Configuration Analysis", - "type": "folder", - "children": [ - { - "name": "Prowler (T)", - "type": "url", - "url": "https://github.com/prowler-cloud/prowler" - }, - { - "name": "ScoutSuite (T)", - "type": "url", - "url": "https://github.com/nccgroup/ScoutSuite" - }, - { - "name": "Cloud Custodian (T)", - "type": "url", - "url": "https://github.com/cloud-custodian/cloud-custodian" - }, - { - "name": "Checkov (T)", - "type": "url", - "url": "https://github.com/bridgecrewio/checkov" - }, - { - "name": "Steampipe (T)", - "type": "url", - "url": "https://github.com/turbot/steampipe" - } - ] - }, - { - "name": "SaaS Footprinting", - "type": "folder", - "children": [ - { - "name": "Amass (T)", - "type": "url", - "url": "https://github.com/owasp-amass/amass" - }, - { - "name": "Sublist3r (T)", - "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" - }, - { - "name": "theHarvester (T)", - "type": "url", - "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", - "status": "live", - "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", - "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "SpiderFoot (T)", - "type": "url", - "url": "https://github.com/smicallef/spiderfoot", - "description": "Automated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.", - "status": "live", - "pricing": "free", - "bestFor": "Automated recon, attack surface mapping, threat intelligence", - "input": "Domain, IP, email, name, phone, subnet", - "output": "Correlated intelligence graph, structured findings across modules", - "opsec": "active", - "opsecNote": "Some modules actively probe targets. Review module settings before running.", - "localInstall": true, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": true, - "invitationOnly": false, - "deprecated": false - }, - { - "name": "dnsrecon (T)", - "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" - } - ] - } - ] - }, - { - "name": "IP & MAC Address", - "type": "folder", - "children": [ - { - "name": "Geolocation", - "type": "folder", - "children": [ - { - "name": "MaxMind Demo", - "type": "url", - "url": "https://www.maxmind.com/en/home" - }, - { - "name": "IPv4/IPv6 lists by country code", - "type": "url", - "url": "https://github.com/ipverse/" - }, - { - "name": "IP2Location.com", - "type": "url", - "url": "https://www.ip2location.com/demo" - }, - { - "name": "IP Fingerprints", - "type": "url", - "url": "https://ipfingerprints.com/" - }, - { - "name": "DB-IP", - "type": "url", - "url": "https://db-ip.com/" - }, - { - "name": "IP Location Finder", - "type": "url", - "url": "https://www.iplocation.net/" - }, - { - "name": "Info Sniper", - "type": "url", - "url": "https://www.infosniper.net/" - }, - { - "name": "utrace", - "type": "url", - "url": "https://en.utrace.de/" - } - ] - }, - { - "name": "Host / Port Discovery", - "type": "folder", - "children": [ - { - "name": "urlscan.io", - "type": "url", - "url": "https://urlscan.io/search/#*" - }, - { - "name": "Spyse", - "type": "url", - "url": "https://spyse.com/search/ip" - }, - { - "name": "Shodan", - "type": "url", - "url": "https://www.shodan.io/" - }, - { - "name": "Netlas.io", - "type": "url", - "url": "https://netlas.io/" - }, - { - "name": "Portmap", - "type": "url", - "url": "https://portmap.com/" - }, - { - "name": "Scans.io", - "type": "url", - "url": "https://scans.io/" - }, - { - "name": "Nmap (T)", - "type": "url", - "url": "https://nmap.org/download.html" - }, - { - "name": "Online Port scanner", - "type": "url", - "url": "https://portscanner.online/" - }, - { - "name": "Internet Census Search", - "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" - }, - { - "name": "Criminal IP Search", - "type": "url", - "url": "https://www.criminalip.io/" - }, - { - "name": "Scanless (T)", - "type": "url", - "url": "https://github.com/vesche/scanless" - }, - { - "name": "BinaryEdge (R)", - "type": "url", - "url": "https://www.binaryedge.io/" - }, - { - "name": "Masscan (T)", - "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" - } - ] - }, - { - "name": "IPv4", - "type": "folder", - "children": [ - { - "name": "ASlookup.com", - "type": "url", - "url": "https://aslookup.com/" - }, - { - "name": "Port scanner Online", - "type": "url", - "url": "https://portscanner.online/" - }, - { - "name": "Onyphe", - "type": "url", - "url": "https://www.onyphe.io/" - }, - { - "name": "IPv4 CIDR Report", - "type": "url", - "url": "https://www.cidr-report.org/as2.0/" - }, - { - "name": "Reverse.report", - "type": "url", - "url": "https://reverse.report/" - }, - { - "name": "Team Cymru IP to ASN", - "type": "url", - "url": "https://asn.cymru.com/" - }, - { - "name": "IP to ASN DB", - "type": "url", - "url": "https://iptoasn.com/" - }, - { - "name": "Hacker Target - Reverse DNS", - "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" - } - ] - }, - { - "name": "IPv6", - "type": "folder", - "children": [ - { - "name": "IPv6 CIDR Report", - "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" - } - ] - }, - { - "name": "BGP", - "type": "folder", - "children": [ - { - "name": "Hurricane Electric BGP Toolkit", - "type": "url", - "url": "https://bgp.he.net/" - }, - { - "name": "BGP Malicious Content Ranking", - "type": "url", - "url": "https://bgpranking.circl.lu/" - }, - { - "name": "PeeringDB", - "type": "url", - "url": "https://www.peeringdb.com/advanced_search" - }, - { - "name": "BGP Tools", - "type": "url", - "url": "https://www.bgp4.as/tools" - } - ] - }, - { - "name": "Reputation", - "type": "folder", - "children": [ - { - "name": "IP Void", - "type": "url", - "url": "https://www.ipvoid.com/" - }, - { - "name": "ExoneraTor", - "type": "url", - "url": "https://exonerator.torproject.org/" - }, - { - "name": "Grey Noise", - "type": "url", - "url": "https://viz.greynoise.io/" - } - ] - }, - { - "name": "Blacklists", - "type": "folder", - "children": [ - { - "name": "Blocklist.de", - "type": "url", - "url": "https://www.blocklist.de/en/index.html" - }, - { - "name": "DShield API", - "type": "url", - "url": "https://isc.sans.edu/api/" - }, - { - "name": "FireHOL IP Lists ", - "type": "url", - "url": "https://iplists.firehol.org/" - }, - { - "name": "Project Honey Pot", - "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" - } - ] - }, - { - "name": "Neighbor Domains", - "type": "folder", - "children": [ - { - "name": "IP Fingerprints - Reverse IP Lookup", - "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" - }, - { - "name": "Bing IP Search (D)", - "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" - }, - { - "name": "TCP/IP Utils - Domain Neighbors", - "type": "url", - "url": "https://dnslytics.com/" - }, - { - "name": "MyIPNeighbors", - "type": "url", - "url": "https://www.my-ip-neighbors.com/" - } - ] - }, - { - "name": "Protected by Cloud Services", - "type": "folder", - "children": [ - { - "name": "CloudFlare Watch", - "type": "url", - "url": "https://www.crimeflare.com/" - }, - { - "name": "CloudFail (T)", - "type": "url", - "url": "https://github.com/m0rtem/CloudFail" - } - ] - }, - { - "name": "Wireless Network Info", - "type": "folder", - "children": [ - { - "name": "WiGLE: Wireless Network Mapping", - "type": "url", - "url": "https://wigle.net/" - }, - { - "name": "OpenCellid: Database of Cell Towers", - "type": "url", - "url": "https://opencellid.org/" - } - ] - }, - { - "name": "Network Analysis Tools", - "type": "folder", - "children": [ - { - "name": "Wireshark", - "type": "url", - "url": "https://www.wireshark.org/download.html" - }, - { - "name": "NetworkMiner", - "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" - }, - { - "name": "Packet Total", - "type": "url", - "url": "https://www.packettotal.com/" - }, - { - "name": "checkip (T)", - "type": "url", - "url": "https://github.com/jreisinger/checkip" - } - ] - }, - { - "name": "IP Loggers", - "type": "folder", - "children": [ - { - "name": "Ki.tc", - "type": "url", - "url": "https://ki.tc" - }, - { - "name": "Grabify", - "type": "url", - "url": "https://grabify.link" - }, - { - "name": "IP Logger", - "type": "url", - "url": "https://iplogger.com/" - } - ] - } - ] - }, - { - "name": "Images / Videos / Docs", - "type": "folder", - "children": [ - { - "name": "Images", - "type": "folder", - "children": [ - { - "name": "Search", - "type": "folder", - "children": [ - { - "name": "Google Images", - "type": "url", - "url": "https://images.google.com/?gws_rd=ssl" - }, - { - "name": "Bing Images", - "type": "url", - "url": "https://www.bing.com/images" - }, - { - "name": "FaceCheck Facial Recognition Search", - "type": "url", - "url": "https://facecheck.id/" - }, - { - "name": "Surfface Face & People Search Engine", - "type": "url", - "url": "https://surfface.com/" - }, - { - "name": "PimEyes Face Search Engine", - "type": "url", - "url": "https://pimeyes.com/en" - }, - { - "name": "Yandex Images", - "type": "url", - "url": "https://www.yandex.com/images/" - }, - { - "name": "Baidu Images", - "type": "url", - "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" - }, - { - "name": "Twitter Image Search (M)", - "type": "url", - "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" - }, - { - "name": "Imgur Search", - "type": "url", - "url": "https://imgur.com/search" - }, - { - "name": "Photobucket", - "type": "url", - "url": "https://photobucket.com/" - }, - { - "name": "7Photos.net", - "type": "url", - "url": "https://7photos.net/" - }, - { - "name": "Panoramio", - "type": "url", - "url": "https://www.panoramio.com/" - }, - { - "name": "Current Location", - "type": "url", - "url": "https://current-location.com/" - }, - { - "name": "Lakako Photo Search", - "type": "url", - "url": "https://www.lakako.com/" - }, - { - "name": "Lenso.ai", - "type": "url", - "url": "https://lenso.ai/" - }, - { - "name": "CC Search", - "type": "url", - "url": "https://ccsearch.creativecommons.org/" - }, - { - "name": "CamFind App", - "type": "url", - "url": "https://camfindapp.com/" - }, - { - "name": "RevEye Reverse Image Search (T)", - "type": "url", - "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" - }, - { - "name": "SmugMug Search", - "type": "url", - "url": "https://www.smugmug.com/" - }, - { - "name": "ImageNet", - "type": "url", - "url": "https://image-net.org/" - }, - { - "name": "Places2", - "type": "url", - "url": "https://places2.csail.mit.edu/explore.html" - }, - { - "name": "Image Identification Project", - "type": "url", - "url": "https://www.imageidentify.com/" - }, - { - "name": "SauceNAO", - "type": "url", - "url": "https://saucenao.com/" - }, - { - "name": "Picarta", - "type": "url", - "url": "https://picarta.ai/" - }, - { - "name": "FaceSeek Face Search Engine", - "type": "url", - "url": "https://faceseek.online" - } - ] - }, - { - "name": "Instagram", - "type": "folder", - "children": [ - { - "name": "Webstigram", - "type": "url", - "url": "https://websta.me/search-engine-optimization/" - }, - { - "name": "Instagram", - "type": "url", - "url": "https://www.instagram.com/" - }, - { - "name": "Mini Instagram", - "type": "url", - "url": "https://mininsta.net/" - }, - { - "name": "Imgrab", - "type": "url", - "url": "https://www.imgrab.com/" - }, - { - "name": "Tofo.me", - "type": "url", - "url": "https://tofo.me/" - } - ] - }, - { - "name": "Flickr", - "type": "folder", - "children": [ - { - "name": "Flickr", - "type": "url", - "url": "https://www.flickr.com/" - }, - { - "name": "Flickr Map", - "type": "url", - "url": "https://www.flickr.com/map/" - }, - { - "name": "My Pics Map", - "type": "url", - "url": "https://www.mypicsmap.com/" - }, - { - "name": "idGettr", - "type": "url", - "url": "https://www.webfx.com/tools/idgettr/" - }, - { - "name": "Flickr Hive Mind", - "type": "url", - "url": "https://flickrhivemind.net/" - } - ] - }, - { - "name": "Metadata", - "type": "folder", - "children": [ - { - "name": "ExifEditor", - "type": "url", - "url": "https://exifeditor.io" - }, - { - "name": "ExifTool (T)", - "type": "url", - "url": "https://exiftool.org/" - }, - { - "name": "ExifViewer", - "type": "url", - "url": "https://www.exifviewer.org/" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" - }, - { - "name": "GeoSetter", - "type": "url", - "url": "https://geosetter.de/en/main-en/" - }, - { - "name": "Jeffrey's Exif Viewer", - "type": "url", - "url": "https://exif.regex.info/" - }, - { - "name": "JPEGsnoop (T)", - "type": "url", - "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" - }, - { - "name": "Metapicz", - "type": "url", - "url": "https://metapicz.com/#landing" - }, - { - "name": "Search by Exif", - "type": "url", - "url": "https://www.exif-search.com/" - }, - { - "name": "xeuledoc - Fetch metadata about any public Google document", - "type": "url", - "url": "https://github.com/Malfrats/xeuledoc" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" - }, - { - "name": "Exiv2 (T)", - "type": "url", - "url": "https://exiv2.org/" - }, - { - "name": "MediaInfo (T)", - "type": "url", - "url": "https://mediaarea.net/en/MediaInfo" - }, - { - "name": "Apache Tika (T)", - "type": "url", - "url": "https://tika.apache.org/" - }, - { - "name": "oletools (T)", - "type": "url", - "url": "https://github.com/decalage2/oletools" - }, - { - "name": "Hachoir (T)", - "type": "url", - "url": "https://github.com/vstinner/hachoir" - }, - { - "name": "C2PA Verify", - "type": "url", - "url": "https://contentcredentials.org/verify" - }, - { - "name": "Metadata2Go", - "type": "url", - "url": "https://www.metadata2go.com/" - }, - { - "name": "Get-Metadata", - "type": "url", - "url": "https://www.get-metadata.com/" - } - ] - }, - { - "name": "Forensics", - "type": "folder", - "children": [ - { - "name": "Ghiro (T)", - "type": "url", - "url": "https://github.com/ghirensics/ghiro" - }, - { - "name": "Camera Trace", - "type": "url", - "url": "https://www.cameratrace.com/trace" - }, - { - "name": "Forensically", - "type": "url", - "url": "https://29a.ch/photo-forensics/" - } - ] - }, - { - "name": "OCR", - "type": "folder", - "children": [ - { - "name": "Online OCR", - "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" - }, - { - "name": "i2OCR", - "type": "url", - "url": "https://www.i2ocr.com/" - }, - { - "name": "New OCR", - "type": "url", - "url": "https://www.newocr.com/" - }, - { - "name": "Online OCR", - "type": "url", - "url": "https://www.onlineocr.net/" - } - ] - }, - { - "name": "Tools", - "type": "folder", - "children": [ - { - "name": "Creepy (T)", - "type": "url", - "url": "https://www.geocreepy.com/" - } - ] - } - ] - }, - { - "name": "Videos", - "type": "folder", - "children": [ - { - "name": "Search", - "type": "folder", - "children": [ - { - "name": "Google Videos", - "type": "url", - "url": "https://www.google.com/videohp?gws_rd=ssl" - }, - { - "name": "Bing Videos", - "type": "url", - "url": "https://www.bing.com/videos" - }, - { - "name": "Internet Archive Videos", - "type": "url", - "url": "https://archive.org/details/opensource_movies" - }, - { - "name": "Vines (D)", - "type": "url", - "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" - }, - { - "name": "Dogpile Web Search", - "type": "url", - "url": "https://www.dogpile.com/" - }, - { - "name": "Geo Search Tool", - "type": "url", - "url": "https://www.geosearchtool.com/" - }, - { - "name": "blinkx Video Search", - "type": "url", - "url": "https://blinkx.com/" - }, - { - "name": "Facebook Live Map", - "type": "url", - "url": "https://www.facebook.com/watch/live/?ref=live_delegate" - }, - { - "name": "LiveLeak", - "type": "url", - "url": "https://www.liveleak.com/" - }, - { - "name": "Metatube", - "type": "url", - "url": "https://www.metatube.com/" - }, - { - "name": "Yahoo Video Search", - "type": "url", - "url": "https://video.search.yahoo.com/" - }, - { - "name": "Search YouTube by Location", - "type": "url", - "url": "https://mattw.io/youtube-geofind/location" - } - ] - }, - { - "name": "Analyze / Record", - "type": "folder", - "children": [ - { - "name": "DetURL", - "type": "url", - "url": "https://deturl.com/" - }, - { - "name": "Print YouTube StoryBoard Instructions", - "type": "url", - "url": "https://www.labnol.org/internet/print-youtube-video/28217" - }, - { - "name": "Print Storyboard from Youtube", - "type": "url", - "url": "javascript:(function(){a=ytplayer.config.args.storyboard_spec;if(!a){alert(\"Sorry we cannot process this YouTube video. Could you please try another one\");exit();}b=a.split(\"|\");base=b[0].split(\"$\")[0]+\"2/M\";c=b[3].split(\"%23\");sigh=c[c.length-1];var imgs=\"\";t=ytplayer.config.args.length_seconds;n=Math.ceil(c[2]/(c[3]*c[4]));for(i=0;i
\";}var title=ytplayer.config.args.title;msg=\"@protonmail.com", + "description": "Queries ProtonMail's HKP-compatible PGP key server to look up the public key for a ProtonMail username. A successful response confirms the account exists.", + "status": "live", + "pricing": "free", + "bestFor": "Confirming whether a ProtonMail username exists and retrieving its PGP public key", + "input": "ProtonMail username (appended with @protonmail.com)", + "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", + "opsec": "passive", + "opsecNote": "Unauthenticated API query to ProtonMail's public key server. Target user is not notified. Enables user enumeration.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "ProtonMail Domains (M)", + "type": "url", + "url": "https://api.protonmail.ch/pks/lookup?op=index&search=", + "description": "Queries ProtonMail's HKP key server with a full email address to check for a PGP public key. Useful for identifying ProtonMail users on custom domains.", + "status": "live", + "pricing": "free", + "bestFor": "Checking if an email address on a custom domain is hosted on ProtonMail", + "input": "Full email address (any domain that may be hosted on ProtonMail)", + "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", + "opsec": "passive", + "opsecNote": "Unauthenticated public HKP endpoint. Target is not notified. Can reveal whether a custom domain uses ProtonMail.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false + } + ] + } + ] + }, + { + "name": "Email Address", + "type": "folder", + "children": [ + { + "name": "Email Search", + "type": "folder", + "children": [ + { + "name": "Sylva Identity Discovery (T)", + "type": "url", + "url": "https://sylva.pfeister.dev/" + }, + { + "name": "ThatsThem", + "type": "url", + "url": "https://thatsthem.com/reverse-email-lookup" + }, + { + "name": "Hunter", + "type": "url", + "url": "https://hunter.io/" + }, + { + "name": "Email to Address (R)", + "type": "url", + "url": "https://www.melissa.com/" + }, + { + "name": "VoilaNorbert", + "type": "url", + "url": "https://www.voilanorbert.com/" + }, + { + "name": "GHunt (T)", + "type": "url", + "url": "https://github.com/mxrch/GHunt" + }, + { + "name": "OSINT Industries", + "type": "url", + "url": "https://www.osint.industries/" + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email harvesting, subdomain enumeration, passive recon", + "input": "Domain name", + "output": "Email addresses, subdomains, IPs, URLs", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Infoga (T)", + "type": "url", + "url": "https://github.com/m4ll0k/infoga" + }, + { + "name": "Skymem", + "type": "url", + "url": "https://www.skymem.info/" + }, + { + "name": "Epieos Email Tool", + "type": "url", + "url": "https://tools.epieos.com/email.php" + }, + { + "name": "breach.vip", + "type": "url", + "url": "https://breach.vip/" + }, + { + "name": "Holehe (T)", + "type": "url", + "url": "https://github.com/megadose/holehe" + } + ] + }, + { + "name": "Common Email Formats", + "type": "folder", + "children": [ + { + "name": "Email Format", + "type": "url", + "url": "https://www.email-format.com/" + }, + { + "name": "Email Permutator", + "type": "url", + "url": "https://metricsparrow.com/toolkit/email-permutator/" + } + ] + }, + { + "name": "Email Verification", + "type": "folder", + "children": [ + { + "name": "Reacher Github (T)", + "type": "url", + "url": "https://github.com/reacherhq/check-if-email-exists" + }, + { + "name": "Reacher Demo", + "type": "url", + "url": "https://reacher.email" + }, + { + "name": "MailScrap", + "type": "url", + "url": "https://mailscrap.com/" + }, + { + "name": "Read Notify", + "type": "url", + "url": "https://www.readnotify.com/" + }, + { + "name": "Email Reputation", + "type": "url", + "url": "https://emailrep.io/" + }, + { + "name": "MailboxValidator", + "type": "url", + "url": "https://www.mailboxvalidator.com/demo" + }, + { + "name": "VerifyEmail (R$)", + "type": "url", + "url": "https://emailable.com/" + } + ] + }, + { + "name": "Breach Data", + "type": "folder", + "children": [ + { + "name": "Have I been pwned?", + "type": "url", + "url": "https://haveibeenpwned.com/", + "description": "Database of breached credentials and email addresses from known data breaches.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach detection, credential exposure checks", + "input": "Email address, phone number, password hash", + "output": "Breach names, breach dates, exposed data types", + "opsec": "passive", + "opsecNote": "Queries breach database via API. Target is not notified of lookups.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Hudson Rock", + "type": "url", + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + }, + { + "name": "DeHashed (R)", + "type": "url", + "url": "https://dehashed.com/" + }, + { + "name": "Vigilante.pw", + "type": "url", + "url": "https://www.vigilante.pw/" + } + ] + }, + { + "name": "Mail Blacklists", + "type": "folder", + "children": [ + { + "name": "MxToolbox", + "type": "url", + "url": "https://mxtoolbox.com/" + } + ] + } + ] + }, + { + "name": "Domain Name", + "type": "folder", + "children": [ + { + "name": "Whois Records", + "type": "folder", + "children": [ + { + "name": "Domain Dossier", + "type": "url", + "url": "https://centralops.net/co/DomainDossier.aspx" + }, + { + "name": "domainIQ", + "type": "url", + "url": "https://www.domainiq.com/" + }, + { + "name": "DomainTools Whois", + "type": "url", + "url": "https://whois.domaintools.com/" + }, + { + "name": "SWITCH Internet Domains Whois (.ch)", + "type": "url", + "url": "https://www.nic.ch/whois/" + }, + { + "name": "Whoisology", + "type": "url", + "url": "https://whoisology.com/#advanced" + }, + { + "name": "Whois ARIN", + "type": "url", + "url": "https://whois.arin.net/ui/advanced.jsp" + }, + { + "name": "DNSstuff", + "type": "url", + "url": "https://www.dnsstuff.com/freetools" + }, + { + "name": "Robtex (R)", + "type": "url", + "url": "https://robtex.com/" + }, + { + "name": "Domaincrawler.com", + "type": "url", + "url": "https://domaincrawler.com/" + }, + { + "name": "MarkMonitor Whois Search", + "type": "url", + "url": "https://domains.markmonitor.com/whois/" + }, + { + "name": "easyWhois", + "type": "url", + "url": "https://www.easywhois.com/" + }, + { + "name": "Website Informer", + "type": "url", + "url": "https://website.informer.com/" + }, + { + "name": "Who.is", + "type": "url", + "url": "https://who.is/" + }, + { + "name": "Whois AMPed", + "type": "url", + "url": "https://whoisamped.com/" + }, + { + "name": "ViewDNS.info", + "type": "url", + "url": "https://viewdns.info/" + }, + { + "name": "Daily DNS Changes", + "type": "url", + "url": "https://dailychanges.domaintools.com/" + }, + { + "name": "IP2WHOIS", + "type": "url", + "url": "https://www.ip2whois.com" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/whois_domains/" + } + ] + }, + { + "name": "Subdomains", + "type": "folder", + "children": [ + { + "name": "SynapsInt", + "type": "url", + "url": "https://synapsint.com" + }, + { + "name": "Aquatone (T)", + "type": "url", + "url": "https://github.com/michenriksen/aquatone" + }, + { + "name": "FindSubDomains", + "type": "url", + "url": "https://findsubdomains.com/" + }, + { + "name": "Google Subdomains (D)", + "type": "url", + "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" + }, + { + "name": "Recon-ng (T)", + "type": "url", + "url": "https://github.com/lanmaster53/recon-ng", + "description": "Full-featured web reconnaissance framework with independent modules for data gathering.", + "status": "live", + "pricing": "free", + "bestFor": "Modular web recon, API-driven data collection", + "input": "Domain, company name, email, IP", + "output": "Contacts, hosts, credentials, ports via module-specific results", + "opsec": "passive", + "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "XRay", + "type": "url", + "url": "https://github.com/evilsocket/xray" + }, + { + "name": "DNS Recon (T)", + "type": "url", + "url": "https://github.com/darkoperator/dnsrecon" + }, + { + "name": "Gobuster (T)", + "type": "url", + "url": "https://github.com/OJ/gobuster" + }, + { + "name": "Fierce Domain Scanner (T)", + "type": "url", + "url": "https://github.com/davidpepper/fierce-domain-scanner" + }, + { + "name": "Bluto (T)", + "type": "url", + "url": "https://github.com/darryllane/Bluto" + }, + { + "name": "OWASP Maryam (T)", + "type": "url", + "url": "https://github.com/saeeddhqan/Maryam" + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email harvesting, subdomain enumeration, passive recon", + "input": "Domain name", + "output": "Email addresses, subdomains, IPs, URLs", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Pentest-tools.com Subdomains", + "type": "url", + "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" + }, + { + "name": "SecLists DNS Subdomains (T)", + "type": "url", + "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" + }, + { + "name": "dnspop (T)", + "type": "url", + "url": "https://github.com/bitquark/dnspop" + }, + { + "name": "gdns (T)", + "type": "url", + "url": "https://github.com/hrbrmstr/gdns" + }, + { + "name": "Sublist3r", + "type": "url", + "url": "https://github.com/aboul3la/Sublist3r" + }, + { + "name": "AltDNS (T)", + "type": "url", + "url": "https://github.com/infosec-au/altdns" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/domains/" + } + ] + }, + { + "name": "Discovery", + "type": "folder", + "children": [ + { + "name": "Shodan", + "type": "url", + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Port scanning, banner grabbing, IoT discovery", + "input": "IP address, domain", + "output": "Open ports, services, banners, CVEs", + "opsec": "passive", + "opsecNote": "Queries cached scan data. Does not directly probe the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/" + }, + { + "name": "Kraken (T)", + "type": "url", + "url": "https://github.com/Sw4mpf0x/Kraken" + }, + { + "name": "Online Nikto scanner", + "type": "url", + "url": "https://nikto.online/" + }, + { + "name": "urlscan.io", + "type": "url", + "url": "https://urlscan.io/search/#*" + }, + { + "name": "Daily DNS Changes", + "type": "url", + "url": "https://dailychanges.domaintools.com/" + }, + { + "name": "Redirect Detective", + "type": "url", + "url": "https://redirectdetective.com/" + }, + { + "name": "Sitediff (T)", + "type": "url", + "url": "https://github.com/digininja/sitediff" + }, + { + "name": "BuiltWith", + "type": "url", + "url": "https://builtwith.com/", + "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack identification, competitor analysis", + "input": "Domain or URL", + "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "opsec": "passive", + "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Wappalyzer", + "type": "url", + "url": "https://www.wappalyzer.com/" + }, + { + "name": "AnalyzeID", + "type": "url", + "url": "https://analyzeid.com/" + }, + { + "name": "Criminal IP Search", + "type": "url", + "url": "https://www.criminalip.io/" + }, + { + "name": "urlDNA", + "type": "url", + "url": "https://urldna.io" + }, + { + "name": "ZoomEye.ai", + "type": "url", + "url": "https://www.zoomeye.org/" + } + ] + }, + { + "name": "Certificate Search", + "type": "folder", + "children": [ + { + "name": "Shodan", + "type": "url", + "url": "https://www.shodan.io/" + }, + { + "name": "Google's Certificate Transparency", + "type": "url", + "url": "https://www.certificate-transparency.org/known-logs" + }, + { + "name": "Spyse", + "type": "url", + "url": "https://spyse.com/search/certificate" + }, + { + "name": "Censys", + "type": "url", + "url": "https://censys.io/", + "description": "Internet-wide scanner and search engine for hosts, certificates, and services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Certificate discovery, host enumeration, exposure monitoring", + "input": "Domain, IP, certificate fingerprint, search query", + "output": "Host details, open ports, TLS certificates, service banners", + "opsec": "passive", + "opsecNote": "Queries pre-scanned data. Does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "crt.sh - Certificate Search", + "type": "url", + "url": "https://crt.sh/?" + }, + { + "name": "CertKit - Certificate Transparency Log Search", + "type": "url", + "url": "https://www.certkit.io/tools/ct-logs/" + }, + { + "name": "certgraph (T)", + "type": "url", + "url": "https://github.com/lanrat/certgraph" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://app.netlas.io/certs/" + } + ] + }, + { + "name": "PassiveDNS", + "type": "folder", + "children": [ + { + "name": "Mnemonic", + "type": "url", + "url": "https://passivedns.mnemonic.no/" + }, + { + "name": "DNS Dumpster", + "type": "url", + "url": "https://dnsdumpster.com/" + }, + { + "name": "Deteque (R)", + "type": "url", + "url": "https://www.deteque.com/" + } + ] + }, + { + "name": "Reputation", + "type": "folder", + "children": [ + { + "name": "UrlQuery.net", + "type": "url", + "url": "https://urlquery.net/" + }, + { + "name": "URL Void", + "type": "url", + "url": "https://www.urlvoid.com/" + }, + { + "name": "FortiGuard Reputation Service", + "type": "url", + "url": "https://fortiguard.com/iprep" + }, + { + "name": "Trend Micro Site Safety Center", + "type": "url", + "url": "https://global.sitesafety.trendmicro.com/" + }, + { + "name": "WatchGuard ReputationAuthority", + "type": "url", + "url": "https://www.reputationauthority.org/" + }, + { + "name": "Sucuri SiteCheck", + "type": "url", + "url": "https://sitecheck.sucuri.net/" + }, + { + "name": "ThreatMiner.org", + "type": "url", + "url": "https://www.threatminer.org/" + }, + { + "name": "BlueCoat WebPulse", + "type": "url", + "url": "https://sitereview.bluecoat.com/sitereview.jsp" + }, + { + "name": "Zscaler Zulu URL Risk Analyzer", + "type": "url", + "url": "https://zulu.zscaler.com/" + }, + { + "name": "Joe Sandbox Url Analyzer", + "type": "url", + "url": "https://www.url-analyzer.net/" + }, + { + "name": "Deepviz Domain Search", + "type": "url", + "url": "https://search.deepviz.com/" + }, + { + "name": "AVG Threat Labs", + "type": "url", + "url": "https://www.avg.com/en/signal/website-safety" + }, + { + "name": "Webroot BrightCloud URL/IP Lookup", + "type": "url", + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + }, + { + "name": "vURL Online", + "type": "url", + "url": "https://vurldissect.co.uk/" + }, + { + "name": "AlienVault Open Threat Exchange", + "type": "url", + "url": "https://otx.alienvault.com/browse/pulses/" + }, + { + "name": "Malware Domain List", + "type": "url", + "url": "https://www.malwaredomainlist.com/mdl.php" + }, + { + "name": "Web Inspector Online Scan", + "type": "url", + "url": "https://www.webinspector.com/website-malware-scanner/" + }, + { + "name": "Google Safe Browsing API", + "type": "url", + "url": "https://developers.google.com/safe-browsing/?csw=1" + }, + { + "name": "Cisco Talos", + "type": "url", + "url": "https://talosintelligence.com/" + } + ] + }, + { + "name": "Domain Blacklists", + "type": "folder", + "children": [ + { + "name": "Threatexpert.com Malicious URLs", + "type": "url", + "url": "https://www.networksec.org/grabbho/block.txt" + }, + { + "name": "Zeus C2 Tracker", + "type": "url", + "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" + }, + { + "name": "Malware Domains Blacklist", + "type": "url", + "url": "https://mirror1.malwaredomains.com/files/domains.txt" + }, + { + "name": "Blackweb", + "type": "url", + "url": "https://github.com/maravento/blackweb" + }, + { + "name": "Critical Stack Intel (R)", + "type": "url", + "url": "https://intel.criticalstack.com/" + }, + { + "name": "DNS Sinkhole", + "type": "url", + "url": "https://malc0de.com/bl/" + }, + { + "name": "DNS-BH Malware Domain Blocklist", + "type": "url", + "url": "https://www.malwaredomains.com/wordpress/?page_id=66" + }, + { + "name": "Malware Domain List", + "type": "url", + "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" + }, + { + "name": "MalwareURL (R)", + "type": "url", + "url": "https://www.malwareurl.com/index.php" + }, + { + "name": "scumware.org", + "type": "url", + "url": "https://www.scumware.org/" + }, + { + "name": "ZeuS Tracker", + "type": "url", + "url": "https://zeustracker.abuse.ch/blocklist.php" + }, + { + "name": "Shadowserver Foundation", + "type": "url", + "url": "https://www.shadowserver.org/" + }, + { + "name": "Email Domain Validation", + "type": "url", + "url": "https://www.mailboxvalidator.com/domain" + } + ] + }, + { + "name": "Typosquatting", + "type": "folder", + "children": [ + { + "name": "DNS Twist (T)", + "type": "url", + "url": "https://github.com/elceef/dnstwist" + }, + { + "name": "URLCrazy (T)", + "type": "url", + "url": "https://www.morningstarsecurity.com/research/urlcrazy" + }, + { + "name": "dnstwister", + "type": "url", + "url": "https://dnstwister.report/" + }, + { + "name": "Catphish (T)", + "type": "url", + "url": "https://github.com/ring0lab/catphish" + } + ] + }, + { + "name": "Analytics", + "type": "folder", + "children": [ + { + "name": "BuiltWith", + "type": "url", + "url": "https://builtwith.com/", + "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack identification, competitor analysis", + "input": "Domain or URL", + "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "opsec": "passive", + "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SiteSleuth", + "type": "url", + "url": "https://www.sitesleuth.io/" + }, + { + "name": "Wappalyzer (T)", + "type": "url", + "url": "https://www.wappalyzer.com/" + }, + { + "name": "SEMrush", + "type": "url", + "url": "https://www.semrush.com/" + }, + { + "name": "Moonsearch", + "type": "url", + "url": "https://moonsearch.com/" + }, + { + "name": "Ewhois", + "type": "url", + "url": "https://ewhois.com/" + }, + { + "name": "StatsCrop", + "type": "url", + "url": "https://www.statscrop.com/" + }, + { + "name": "Open Site Explorer", + "type": "url", + "url": "https://moz.com/link-explorer" + }, + { + "name": "SpyOnWeb", + "type": "url", + "url": "https://www.spyonweb.com/" + }, + { + "name": "Keyword Density", + "type": "url", + "url": "https://tools.seobook.com/general/keyword-density/" + }, + { + "name": "Alexa Site Statistics", + "type": "url", + "url": "https://alexa.amazon.com/about" + }, + { + "name": "Cisco Umbrella Popularity List", + "type": "url", + "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" + }, + { + "name": "Alexa Top 500 Global Sites", + "type": "url", + "url": "https://alexa.amazon.com/about" + }, + { + "name": "Sitedossier", + "type": "url", + "url": "https://www.sitedossier.com/" + }, + { + "name": "Visual Site Mapper", + "type": "url", + "url": "https://github.com/alentum/sitemapper-nodejs" + }, + { + "name": "ClearWebStats.com", + "type": "url", + "url": "https://www.clearwebstats.com/" + }, + { + "name": "PubDB", + "type": "url", + "url": "https://pub-db.com/" + }, + { + "name": "SimilarWeb", + "type": "url", + "url": "https://www.similarweb.com/" + }, + { + "name": "Siteliner", + "type": "url", + "url": "https://www.siteliner.com/" + }, + { + "name": "WhatWeb", + "type": "url", + "url": "https://github.com/urbanadventurer/WhatWeb" + } + ] + }, + { + "name": "URL Expanders", + "type": "folder", + "children": [ + { + "name": "Link Expander", + "type": "url", + "url": "https://www.linkexpander.com/" + }, + { + "name": "CheckShortURL", + "type": "url", + "url": "https://checkshorturl.com/" + }, + { + "name": "URL Expander", + "type": "url", + "url": "https://urlex.org/" + }, + { + "name": "Where Does This Link Go?", + "type": "url", + "url": "https://wheregoes.com/" + }, + { + "name": "KnowURL", + "type": "url", + "url": "https://www.knowurl.com/" + } + ] + }, + { + "name": "Change Detection", + "type": "folder", + "children": [ + { + "name": "VisualPing", + "type": "url", + "url": "https://visualping.io:443/" + }, + { + "name": "Change Detection", + "type": "url", + "url": "https://visualping.io/" + }, + { + "name": "Check site availability Online", + "type": "url", + "url": "https://upcheck.online/" + }, + { + "name": "Follow That Page", + "type": "url", + "url": "https://www.followthatpage.com/" + }, + { + "name": "Urlwatch", + "type": "url", + "url": "https://github.com/thp/urlwatch" + }, + { + "name": "WatchThatPage", + "type": "url", + "url": "https://watchthatpage.com/" + }, + { + "name": "ChangeDetect", + "type": "url", + "url": "https://www.eatgrainmaker.com/home/" + } + ] + }, + { + "name": "Social Analysis", + "type": "folder", + "children": [ + { + "name": "Google Trends", + "type": "url", + "url": "https://trends.google.com/trends/" + } + ] + }, + { + "name": "DNSSEC", + "type": "folder", + "children": [ + { + "name": "DNSSEC Analyzer", + "type": "url", + "url": "https://dnssec-analyzer.verisignlabs.com/" + }, + { + "name": "DNSViz", + "type": "url", + "url": "https://dnsviz.net/" + } + ] + }, + { + "name": "Vulnerabilities", + "type": "folder", + "children": [ + { + "name": "Scanners", + "type": "folder", + "children": [ + { + "name": "Sn1per (T)", + "type": "url", + "url": "https://github.com/1N3/Sn1per" + }, + { + "name": "Online Nikto scanner", + "type": "url", + "url": "https://nikto.online/" + }, + { + "name": "WDES - Web Data Exposure Scanner (T)", + "type": "url", + "url": "https://github.com/eduardoit/web-data-exposure-scanner" + } + ] + }, + { + "name": "Disclosure Sites", + "type": "folder", + "children": [ + { + "name": "Zone-H.org", + "type": "url", + "url": "https://zone-h.org/archive" + } + ] + }, + { + "name": "RobotsDisallowed", + "type": "url", + "url": "https://github.com/danielmiessler/RobotsDisallowed" + } + ] + }, + { + "name": "Tools", + "type": "folder", + "children": [ + { + "name": "Belati (T)", + "type": "url", + "url": "https://github.com/aancw/Belati" + }, + { + "name": "Burp Suite (T)", + "type": "url", + "url": "https://portswigger.net/burp" + }, + { + "name": "EyeWitness (T)", + "type": "url", + "url": "https://github.com/ChrisTruncer/EyeWitness" + }, + { + "name": "Hunting-New-Registered-Domains (T)", + "type": "url", + "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + }, + { + "name": "International Domain Name Conversion Tool", + "type": "url", + "url": "https://mct.verisign-grs.com/" + }, + { + "name": "Online Nikto scanner", + "type": "url", + "url": "https://nikto.online/" + } + ] + }, + { + "name": "Report Malicious Sites", + "type": "folder", + "children": [ + { + "name": "Microsoft", + "type": "url", + "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" + }, + { + "name": "Google", + "type": "url", + "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" + } + ] + } + ] + }, + { + "name": "Cloud Infrastructure", + "type": "folder", + "children": [ + { + "name": "AWS Enumeration", + "type": "folder", + "children": [ + { + "name": "cloud_enum (T)", + "type": "url", + "url": "https://github.com/initstring/cloud_enum" + }, + { + "name": "AWSBucketDump (T)", + "type": "url", + "url": "https://github.com/jordanpotti/AWSBucketDump" + }, + { + "name": "Subfinder (T)", + "type": "url", + "url": "https://github.com/projectdiscovery/subfinder" + } + ] + }, + { + "name": "Azure/GCP Discovery", + "type": "folder", + "children": [ + { + "name": "GCPBucketBrute (T)", + "type": "url", + "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" + }, + { + "name": "AADInternals (T)", + "type": "url", + "url": "https://github.com/Gerenios/AADInternals" + }, + { + "name": "ROADtools (T)", + "type": "url", + "url": "https://github.com/dirkjanm/roadtools" + }, + { + "name": "MicroBurst (T)", + "type": "url", + "url": "https://github.com/NetSPI/MicroBurst" + }, + { + "name": "Stormspotter (T)", + "type": "url", + "url": "https://github.com/Azure/Stormspotter" + } + ] + }, + { + "name": "S3/Blob Storage", + "type": "folder", + "children": [ + { + "name": "Public Buckets", + "type": "url", + "url": "https://buckets.grayhatwarfare.com/" + }, + { + "name": "goblob (T)", + "type": "url", + "url": "https://github.com/Macmod/goblob" + }, + { + "name": "S3Scanner (T)", + "type": "url", + "url": "https://github.com/sa7mon/s3scanner" + }, + { + "name": "BucketLoot (T)", + "type": "url", + "url": "https://github.com/redhuntlabs/BucketLoot" + }, + { + "name": "lazys3 (T)", + "type": "url", + "url": "https://github.com/nahamsec/lazys3" + } + ] + }, + { + "name": "Cloud Configuration Analysis", + "type": "folder", + "children": [ + { + "name": "Prowler (T)", + "type": "url", + "url": "https://github.com/prowler-cloud/prowler" + }, + { + "name": "ScoutSuite (T)", + "type": "url", + "url": "https://github.com/nccgroup/ScoutSuite" + }, + { + "name": "Cloud Custodian (T)", + "type": "url", + "url": "https://github.com/cloud-custodian/cloud-custodian" + }, + { + "name": "Checkov (T)", + "type": "url", + "url": "https://github.com/bridgecrewio/checkov" + }, + { + "name": "Steampipe (T)", + "type": "url", + "url": "https://github.com/turbot/steampipe" + } + ] + }, + { + "name": "SaaS Footprinting", + "type": "folder", + "children": [ + { + "name": "Amass (T)", + "type": "url", + "url": "https://github.com/owasp-amass/amass" + }, + { + "name": "Sublist3r (T)", + "type": "url", + "url": "https://github.com/aboul3la/Sublist3r" + }, + { + "name": "theHarvester (T)", + "type": "url", + "url": "https://github.com/laramies/theHarvester", + "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "status": "live", + "pricing": "free", + "bestFor": "Email harvesting, subdomain enumeration, passive recon", + "input": "Domain name", + "output": "Email addresses, subdomains, IPs, URLs", + "opsec": "passive", + "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "SpiderFoot (T)", + "type": "url", + "url": "https://github.com/smicallef/spiderfoot", + "description": "Automated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Automated recon, attack surface mapping, threat intelligence", + "input": "Domain, IP, email, name, phone, subnet", + "output": "Correlated intelligence graph, structured findings across modules", + "opsec": "active", + "opsecNote": "Some modules actively probe targets. Review module settings before running.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "dnsrecon (T)", + "type": "url", + "url": "https://github.com/darkoperator/dnsrecon" + } + ] + } + ] + }, + { + "name": "IP & MAC Address", + "type": "folder", + "children": [ + { + "name": "Geolocation", + "type": "folder", + "children": [ + { + "name": "MaxMind Demo", + "type": "url", + "url": "https://www.maxmind.com/en/home" + }, + { + "name": "IPv4/IPv6 lists by country code", + "type": "url", + "url": "https://github.com/ipverse/" + }, + { + "name": "IP2Location.com", + "type": "url", + "url": "https://www.ip2location.com/demo" + }, + { + "name": "IP Fingerprints", + "type": "url", + "url": "https://ipfingerprints.com/" + }, + { + "name": "DB-IP", + "type": "url", + "url": "https://db-ip.com/" + }, + { + "name": "IP Location Finder", + "type": "url", + "url": "https://www.iplocation.net/" + }, + { + "name": "Info Sniper", + "type": "url", + "url": "https://www.infosniper.net/" + }, + { + "name": "utrace", + "type": "url", + "url": "https://en.utrace.de/" + } + ] + }, + { + "name": "Host / Port Discovery", + "type": "folder", + "children": [ + { + "name": "urlscan.io", + "type": "url", + "url": "https://urlscan.io/search/#*" + }, + { + "name": "Spyse", + "type": "url", + "url": "https://spyse.com/search/ip" + }, + { + "name": "Shodan", + "type": "url", + "url": "https://www.shodan.io/" + }, + { + "name": "Netlas.io", + "type": "url", + "url": "https://netlas.io/" + }, + { + "name": "Portmap", + "type": "url", + "url": "https://portmap.com/" + }, + { + "name": "Scans.io", + "type": "url", + "url": "https://scans.io/" + }, + { + "name": "Nmap (T)", + "type": "url", + "url": "https://nmap.org/download.html" + }, + { + "name": "Online Port scanner", + "type": "url", + "url": "https://portscanner.online/" + }, + { + "name": "Internet Census Search", + "type": "url", + "url": "https://www.exfiltrated.com/querystart.php" + }, + { + "name": "Criminal IP Search", + "type": "url", + "url": "https://www.criminalip.io/" + }, + { + "name": "Scanless (T)", + "type": "url", + "url": "https://github.com/vesche/scanless" + }, + { + "name": "BinaryEdge (R)", + "type": "url", + "url": "https://www.binaryedge.io/" + }, + { + "name": "Masscan (T)", + "type": "url", + "url": "https://github.com/robertdavidgraham/masscan" + } + ] + }, + { + "name": "IPv4", + "type": "folder", + "children": [ + { + "name": "ASlookup.com", + "type": "url", + "url": "https://aslookup.com/" + }, + { + "name": "Port scanner Online", + "type": "url", + "url": "https://portscanner.online/" + }, + { + "name": "Onyphe", + "type": "url", + "url": "https://www.onyphe.io/" + }, + { + "name": "IPv4 CIDR Report", + "type": "url", + "url": "https://www.cidr-report.org/as2.0/" + }, + { + "name": "Reverse.report", + "type": "url", + "url": "https://reverse.report/" + }, + { + "name": "Team Cymru IP to ASN", + "type": "url", + "url": "https://asn.cymru.com/" + }, + { + "name": "IP to ASN DB", + "type": "url", + "url": "https://iptoasn.com/" + }, + { + "name": "Hacker Target - Reverse DNS", + "type": "url", + "url": "https://hackertarget.com/reverse-dns-lookup/" + } + ] + }, + { + "name": "IPv6", + "type": "folder", + "children": [ + { + "name": "IPv6 CIDR Report", + "type": "url", + "url": "https://www.cidr-report.org/v6/as2.0/" + } + ] + }, + { + "name": "BGP", + "type": "folder", + "children": [ + { + "name": "Hurricane Electric BGP Toolkit", + "type": "url", + "url": "https://bgp.he.net/" + }, + { + "name": "BGP Malicious Content Ranking", + "type": "url", + "url": "https://bgpranking.circl.lu/" + }, + { + "name": "PeeringDB", + "type": "url", + "url": "https://www.peeringdb.com/advanced_search" + }, + { + "name": "BGP Tools", + "type": "url", + "url": "https://www.bgp4.as/tools" + } + ] + }, + { + "name": "Reputation", + "type": "folder", + "children": [ + { + "name": "IP Void", + "type": "url", + "url": "https://www.ipvoid.com/" + }, + { + "name": "ExoneraTor", + "type": "url", + "url": "https://exonerator.torproject.org/" + }, + { + "name": "Grey Noise", + "type": "url", + "url": "https://viz.greynoise.io/" + } + ] + }, + { + "name": "Blacklists", + "type": "folder", + "children": [ + { + "name": "Blocklist.de", + "type": "url", + "url": "https://www.blocklist.de/en/index.html" + }, + { + "name": "DShield API", + "type": "url", + "url": "https://isc.sans.edu/api/" + }, + { + "name": "FireHOL IP Lists ", + "type": "url", + "url": "https://iplists.firehol.org/" + }, + { + "name": "Project Honey Pot", + "type": "url", + "url": "https://www.projecthoneypot.org/list_of_ips.php" + } + ] + }, + { + "name": "Neighbor Domains", + "type": "folder", + "children": [ + { + "name": "IP Fingerprints - Reverse IP Lookup", + "type": "url", + "url": "https://ipfingerprints.com/reverseip.php" + }, + { + "name": "Bing IP Search (D)", + "type": "url", + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + }, + { + "name": "TCP/IP Utils - Domain Neighbors", + "type": "url", + "url": "https://dnslytics.com/" + }, + { + "name": "MyIPNeighbors", + "type": "url", + "url": "https://www.my-ip-neighbors.com/" + } + ] + }, + { + "name": "Protected by Cloud Services", + "type": "folder", + "children": [ + { + "name": "CloudFlare Watch", + "type": "url", + "url": "https://www.crimeflare.com/" + }, + { + "name": "CloudFail (T)", + "type": "url", + "url": "https://github.com/m0rtem/CloudFail" + } + ] + }, + { + "name": "Wireless Network Info", + "type": "folder", + "children": [ + { + "name": "WiGLE: Wireless Network Mapping", + "type": "url", + "url": "https://wigle.net/" + }, + { + "name": "OpenCellid: Database of Cell Towers", + "type": "url", + "url": "https://opencellid.org/" + } + ] + }, + { + "name": "Network Analysis Tools", + "type": "folder", + "children": [ + { + "name": "Wireshark", + "type": "url", + "url": "https://www.wireshark.org/download.html" + }, + { + "name": "NetworkMiner", + "type": "url", + "url": "https://www.netresec.com/?page=Networkminer" + }, + { + "name": "Packet Total", + "type": "url", + "url": "https://www.packettotal.com/" + }, + { + "name": "checkip (T)", + "type": "url", + "url": "https://github.com/jreisinger/checkip" + } + ] + }, + { + "name": "IP Loggers", + "type": "folder", + "children": [ + { + "name": "Ki.tc", + "type": "url", + "url": "https://ki.tc" + }, + { + "name": "Grabify", + "type": "url", + "url": "https://grabify.link" + }, + { + "name": "IP Logger", + "type": "url", + "url": "https://iplogger.com/" + } + ] + } + ] + }, + { + "name": "Images / Videos / Docs", + "type": "folder", + "children": [ + { + "name": "Images", + "type": "folder", + "children": [ + { + "name": "Search", + "type": "folder", + "children": [ + { + "name": "Google Images", + "type": "url", + "url": "https://images.google.com/?gws_rd=ssl" + }, + { + "name": "Bing Images", + "type": "url", + "url": "https://www.bing.com/images" + }, + { + "name": "FaceCheck Facial Recognition Search", + "type": "url", + "url": "https://facecheck.id/" + }, + { + "name": "Surfface Face & People Search Engine", + "type": "url", + "url": "https://surfface.com/" + }, + { + "name": "PimEyes Face Search Engine", + "type": "url", + "url": "https://pimeyes.com/en" + }, + { + "name": "Yandex Images", + "type": "url", + "url": "https://www.yandex.com/images/" + }, + { + "name": "Baidu Images", + "type": "url", + "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" + }, + { + "name": "Twitter Image Search (M)", + "type": "url", + "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" + }, + { + "name": "Imgur Search", + "type": "url", + "url": "https://imgur.com/search" + }, + { + "name": "Photobucket", + "type": "url", + "url": "https://photobucket.com/" + }, + { + "name": "7Photos.net", + "type": "url", + "url": "https://7photos.net/" + }, + { + "name": "Panoramio", + "type": "url", + "url": "https://www.panoramio.com/" + }, + { + "name": "Current Location", + "type": "url", + "url": "https://current-location.com/" + }, + { + "name": "Lakako Photo Search", + "type": "url", + "url": "https://www.lakako.com/" + }, + { + "name": "Lenso.ai", + "type": "url", + "url": "https://lenso.ai/" + }, + { + "name": "CC Search", + "type": "url", + "url": "https://ccsearch.creativecommons.org/" + }, + { + "name": "CamFind App", + "type": "url", + "url": "https://camfindapp.com/" + }, + { + "name": "RevEye Reverse Image Search (T)", + "type": "url", + "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" + }, + { + "name": "SmugMug Search", + "type": "url", + "url": "https://www.smugmug.com/" + }, + { + "name": "ImageNet", + "type": "url", + "url": "https://image-net.org/" + }, + { + "name": "Places2", + "type": "url", + "url": "https://places2.csail.mit.edu/explore.html" + }, + { + "name": "Image Identification Project", + "type": "url", + "url": "https://www.imageidentify.com/" + }, + { + "name": "SauceNAO", + "type": "url", + "url": "https://saucenao.com/" + }, + { + "name": "Picarta", + "type": "url", + "url": "https://picarta.ai/" + }, + { + "name": "FaceSeek Face Search Engine", + "type": "url", + "url": "https://faceseek.online" + } + ] + }, + { + "name": "Instagram", + "type": "folder", + "children": [ + { + "name": "Webstigram", + "type": "url", + "url": "https://websta.me/search-engine-optimization/" + }, + { + "name": "Instagram", + "type": "url", + "url": "https://www.instagram.com/" + }, + { + "name": "Mini Instagram", + "type": "url", + "url": "https://mininsta.net/" + }, + { + "name": "Imgrab", + "type": "url", + "url": "https://www.imgrab.com/" + }, + { + "name": "Tofo.me", + "type": "url", + "url": "https://tofo.me/" + } + ] + }, + { + "name": "Flickr", + "type": "folder", + "children": [ + { + "name": "Flickr", + "type": "url", + "url": "https://www.flickr.com/" + }, + { + "name": "Flickr Map", + "type": "url", + "url": "https://www.flickr.com/map/" + }, + { + "name": "My Pics Map", + "type": "url", + "url": "https://www.mypicsmap.com/" + }, + { + "name": "idGettr", + "type": "url", + "url": "https://www.webfx.com/tools/idgettr/" + }, + { + "name": "Flickr Hive Mind", + "type": "url", + "url": "https://flickrhivemind.net/" + } + ] + }, + { + "name": "Metadata", + "type": "folder", + "children": [ + { + "name": "ExifEditor", + "type": "url", + "url": "https://exifeditor.io" + }, + { + "name": "ExifTool (T)", + "type": "url", + "url": "https://exiftool.org/" + }, + { + "name": "ExifViewer", + "type": "url", + "url": "https://www.exifviewer.org/" + }, + { + "name": "FOCA (T)", + "type": "url", + "url": "https://github.com/ElevenPaths/FOCA" + }, + { + "name": "GeoSetter", + "type": "url", + "url": "https://geosetter.de/en/main-en/" + }, + { + "name": "Jeffrey's Exif Viewer", + "type": "url", + "url": "https://exif.regex.info/" + }, + { + "name": "JPEGsnoop (T)", + "type": "url", + "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" + }, + { + "name": "Metapicz", + "type": "url", + "url": "https://metapicz.com/#landing" + }, + { + "name": "Search by Exif", + "type": "url", + "url": "https://www.exif-search.com/" + }, + { + "name": "xeuledoc - Fetch metadata about any public Google document", + "type": "url", + "url": "https://github.com/Malfrats/xeuledoc" + }, + { + "name": "FOCA (T)", + "type": "url", + "url": "https://github.com/ElevenPaths/FOCA" + }, + { + "name": "Exiv2 (T)", + "type": "url", + "url": "https://exiv2.org/" + }, + { + "name": "MediaInfo (T)", + "type": "url", + "url": "https://mediaarea.net/en/MediaInfo" + }, + { + "name": "Apache Tika (T)", + "type": "url", + "url": "https://tika.apache.org/" + }, + { + "name": "oletools (T)", + "type": "url", + "url": "https://github.com/decalage2/oletools" + }, + { + "name": "Hachoir (T)", + "type": "url", + "url": "https://github.com/vstinner/hachoir" + }, + { + "name": "C2PA Verify", + "type": "url", + "url": "https://contentcredentials.org/verify" + }, + { + "name": "Metadata2Go", + "type": "url", + "url": "https://www.metadata2go.com/" + }, + { + "name": "Get-Metadata", + "type": "url", + "url": "https://www.get-metadata.com/" + } + ] + }, + { + "name": "Forensics", + "type": "folder", + "children": [ + { + "name": "Ghiro (T)", + "type": "url", + "url": "https://github.com/ghirensics/ghiro" + }, + { + "name": "Camera Trace", + "type": "url", + "url": "https://www.cameratrace.com/trace" + }, + { + "name": "Forensically", + "type": "url", + "url": "https://29a.ch/photo-forensics/" + } + ] + }, + { + "name": "OCR", + "type": "folder", + "children": [ + { + "name": "Online OCR", + "type": "url", + "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" + }, + { + "name": "i2OCR", + "type": "url", + "url": "https://www.i2ocr.com/" + }, + { + "name": "New OCR", + "type": "url", + "url": "https://www.newocr.com/" + }, + { + "name": "Online OCR", + "type": "url", + "url": "https://www.onlineocr.net/" + } + ] + }, + { + "name": "Tools", + "type": "folder", + "children": [ + { + "name": "Creepy (T)", + "type": "url", + "url": "https://www.geocreepy.com/" + } + ] + } + ] + }, + { + "name": "Videos", + "type": "folder", + "children": [ + { + "name": "Search", + "type": "folder", + "children": [ + { + "name": "Google Videos", + "type": "url", + "url": "https://www.google.com/videohp?gws_rd=ssl" + }, + { + "name": "Bing Videos", + "type": "url", + "url": "https://www.bing.com/videos" + }, + { + "name": "Internet Archive Videos", + "type": "url", + "url": "https://archive.org/details/opensource_movies" + }, + { + "name": "Vines (D)", + "type": "url", + "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" + }, + { + "name": "Dogpile Web Search", + "type": "url", + "url": "https://www.dogpile.com/" + }, + { + "name": "Geo Search Tool", + "type": "url", + "url": "https://www.geosearchtool.com/" + }, + { + "name": "blinkx Video Search", + "type": "url", + "url": "https://blinkx.com/" + }, + { + "name": "Facebook Live Map", + "type": "url", + "url": "https://www.facebook.com/watch/live/?ref=live_delegate" + }, + { + "name": "LiveLeak", + "type": "url", + "url": "https://www.liveleak.com/" + }, + { + "name": "Metatube", + "type": "url", + "url": "https://www.metatube.com/" + }, + { + "name": "Yahoo Video Search", + "type": "url", + "url": "https://video.search.yahoo.com/" + }, + { + "name": "Search YouTube by Location", + "type": "url", + "url": "https://mattw.io/youtube-geofind/location" + } + ] + }, + { + "name": "Analyze / Record", + "type": "folder", + "children": [ + { + "name": "DetURL", + "type": "url", + "url": "https://deturl.com/" + }, + { + "name": "Print YouTube StoryBoard Instructions", + "type": "url", + "url": "https://www.labnol.org/internet/print-youtube-video/28217" + }, + { + "name": "Print Storyboard from Youtube", + "type": "url", + "url": "javascript:(function(){a=ytplayer.config.args.storyboard_spec;if(!a){alert(\"Sorry we cannot process this YouTube video. Could you please try another one\");exit();}b=a.split(\"|\");base=b[0].split(\"$\")[0]+\"2/M\";c=b[3].split(\"%23\");sigh=c[c.length-1];var imgs=\"\";t=ytplayer.config.args.length_seconds;n=Math.ceil(c[2]/(c[3]*c[4]));for(i=0;i
\";}var title=ytplayer.config.args.title;msg=\" Date: Fri, 27 Mar 2026 01:35:11 -0400 Subject: [PATCH 03/22] Enrich 25 Email Address tools with OSINT enrichment fields Populate enrichment metadata for Sylva Identity Discovery, ThatsThem, Hunter, VoilaNorbert, GHunt, OSINT Industries, Infoga, Skymem, Epieos, breach.vip, Holehe, Email Format, Email Permutator, Reacher (GitHub and Demo), MailScrap, Read Notify, Email Reputation, MailboxValidator, VerifyEmail, Hudson Rock, DeHashed, Vigilante.pw, and MxToolbox. Each tool now includes: description, status, pricing tier, best use case, input/output, OPSEC classification, local install availability, API support, registration requirements, and more. Co-Authored-By: Paperclip --- public/arf.json | 431 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 404 insertions(+), 27 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..55aee8f 100644 --- a/public/arf.json +++ b/public/arf.json @@ -371,37 +371,142 @@ { "name": "Sylva Identity Discovery (T)", "type": "url", - "url": "https://sylva.pfeister.dev/" + "url": "https://sylva.pfeister.dev/", + "description": "Identity discovery utility that searches GitHub and PGP key servers to link identities across platforms using email addresses, usernames, or PGP keys.", + "status": "live", + "pricing": "free", + "bestFor": "Identity correlation via GitHub and PGP", + "input": "Email, username, or PGP fingerprint", + "output": "Linked identities, GitHub profiles, PGP keys", + "opsec": "passive", + "opsecNote": "Queries public GitHub and PGP servers without direct target contact.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThatsThem", "type": "url", - "url": "https://thatsthem.com/reverse-email-lookup" + "url": "https://thatsthem.com/reverse-email-lookup", + "description": "Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse email lookup, person identification", + "input": "Email address", + "output": "Name, address, phone number, education", + "opsec": "passive", + "opsecNote": "Queries ThatsThem's public database without alerting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunter", "type": "url", - "url": "https://hunter.io/" + "url": "https://hunter.io/", + "description": "Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, email verification", + "input": "Domain name, person name, or company info", + "output": "Verified business email addresses", + "opsec": "passive", + "opsecNote": "Queries Hunter's database of public emails; does not contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email to Address (R)", "type": "url", - "url": "https://www.melissa.com/" + "url": "https://www.melissa.com/", + "description": "Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, address enrichment", + "input": "Email addresses, contact data", + "output": "Validated email, postal address, phone", + "opsec": "passive", + "opsecNote": "Data verification service; does not perform reconnaissance.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VoilaNorbert", "type": "url", - "url": "https://www.voilanorbert.com/" + "url": "https://www.voilanorbert.com/", + "description": "Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.", + "status": "live", + "pricing": "freemium", + "bestFor": "Business email discovery, bulk email finding", + "input": "Domain, name, or LinkedIn URL", + "output": "Business email addresses, verification status", + "opsec": "passive", + "opsecNote": "Searches public email database; does not contact targets directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "GHunt (T)", "type": "url", - "url": "https://github.com/mxrch/GHunt" + "url": "https://github.com/mxrch/GHunt", + "description": "Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.", + "status": "live", + "pricing": "free", + "bestFor": "Google account investigation, YouTube/Google Photos OSINT", + "input": "Gmail address or GAIA ID", + "output": "YouTube channels, Google Photos, Maps reviews, device info", + "opsec": "active", + "opsecNote": "Requires Google login via browser extension; may be detected by Google.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OSINT Industries", "type": "url", - "url": "https://www.osint.industries/" + "url": "https://www.osint.industries/", + "description": "Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.", + "status": "live", + "pricing": "freemium", + "bestFor": "Account enumeration, breach detection, digital footprint mapping", + "input": "Email address, phone number, username, or crypto wallet", + "output": "Linked accounts, breach information, geospatial data, timeline", + "opsec": "passive", + "opsecNote": "Scours public websites and databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", @@ -426,27 +531,102 @@ { "name": "Infoga (T)", "type": "url", - "url": "https://github.com/m4ll0k/infoga" + "url": "https://github.com/m4ll0k/infoga", + "description": "Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.", + "status": "live", + "pricing": "free", + "bestFor": "Early-stage email reconnaissance, information gathering", + "input": "Email address", + "output": "IP addresses, hostnames, country, breach status", + "opsec": "passive", + "opsecNote": "Queries search engines and public APIs without direct target contact.", + "localInstall": true, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Skymem", "type": "url", - "url": "https://www.skymem.info/" + "url": "https://www.skymem.info/", + "description": "Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email discovery by domain, bulk email list creation", + "input": "Domain name or person name + domain", + "output": "Email addresses, bulk email lists", + "opsec": "passive", + "opsecNote": "Scrapes and aggregates public email data from websites and profiles.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Epieos Email Tool", "type": "url", - "url": "https://tools.epieos.com/email.php" + "url": "https://tools.epieos.com/email.php", + "description": "Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email reverse lookup, social media profile discovery", + "input": "Email address or phone number", + "output": "Associated social media profiles, forum posts, breach info", + "opsec": "passive", + "opsecNote": "Passive reconnaissance across 120+ websites; does not alert the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "breach.vip", "type": "url", - "url": "https://breach.vip/" + "url": "https://breach.vip/", + "description": "Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.", + "status": "live", + "pricing": "free", + "bestFor": "Breach database search, credential lookup", + "input": "Email, domain, Discord ID, or phone number", + "output": "Breach records, leaked credentials", + "opsec": "passive", + "opsecNote": "Queries aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Holehe (T)", "type": "url", - "url": "https://github.com/megadose/holehe" + "url": "https://github.com/megadose/holehe", + "description": "Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.", + "status": "live", + "pricing": "free", + "bestFor": "Email account enumeration, service detection", + "input": "Email address", + "output": "List of websites where email is registered", + "opsec": "passive", + "opsecNote": "Uses password-reset functionality without sending emails or alerting targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -457,12 +637,42 @@ { "name": "Email Format", "type": "url", - "url": "https://www.email-format.com/" + "url": "https://www.email-format.com/", + "description": "Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate email pattern analysis, email format discovery", + "input": "Sample email addresses or company info", + "output": "Predicted email format patterns", + "opsec": "passive", + "opsecNote": "Statistical analysis of publicly known email patterns.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Permutator", "type": "url", - "url": "https://metricsparrow.com/toolkit/email-permutator/" + "url": "https://metricsparrow.com/toolkit/email-permutator/", + "description": "OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.", + "status": "live", + "pricing": "free", + "bestFor": "Email pattern generation, targeted email guessing", + "input": "Person name, nickname, domain(s)", + "output": "List of possible email address variations", + "opsec": "passive", + "opsecNote": "Generates permutations without any network contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -473,37 +683,142 @@ { "name": "Reacher Github (T)", "type": "url", - "url": "https://github.com/reacherhq/check-if-email-exists" + "url": "https://github.com/reacherhq/check-if-email-exists", + "description": "Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification, bounce detection, list cleaning", + "input": "Email address", + "output": "Deliverability status, MX records, bounce type", + "opsec": "passive", + "opsecNote": "Verifies email existence through MTA queries without sending mail.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Reacher Demo", "type": "url", - "url": "https://reacher.email" + "url": "https://reacher.email", + "description": "Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.", + "status": "live", + "pricing": "free", + "bestFor": "Email verification testing, demonstration", + "input": "Email address", + "output": "Deliverability status, bounce information", + "opsec": "passive", + "opsecNote": "Passive MTA-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MailScrap", "type": "url", - "url": "https://mailscrap.com/" + "url": "https://mailscrap.com/", + "description": "Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning, disposable email detection", + "input": "Email addresses or email lists", + "output": "Validation status, mailbox existence", + "opsec": "passive", + "opsecNote": "Connects to mail servers for verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Read Notify", "type": "url", - "url": "https://www.readnotify.com/" + "url": "https://www.readnotify.com/", + "description": "Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email delivery confirmation, read receipt tracking", + "input": "Email address", + "output": "Delivery and read status", + "opsec": "active", + "opsecNote": "Sends tracking pixels; may alert targets to monitoring.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Reputation", "type": "url", - "url": "https://emailrep.io/" + "url": "https://emailrep.io/", + "description": "Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Email reputation checking, risk assessment", + "input": "Email address", + "output": "Reputation score, risk level, breach history", + "opsec": "passive", + "opsecNote": "Passive database lookup without target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MailboxValidator", "type": "url", - "url": "https://www.mailboxvalidator.com/demo" + "url": "https://www.mailboxvalidator.com/demo", + "description": "Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.", + "status": "live", + "pricing": "paid", + "bestFor": "Email validation, list cleaning, bounce prevention", + "input": "Email addresses or bulk lists", + "output": "Validation status, risk score, catch-all detection", + "opsec": "passive", + "opsecNote": "Server-based verification without sending emails.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "VerifyEmail (R$)", "type": "url", - "url": "https://emailable.com/" + "url": "https://emailable.com/", + "description": "Email verification service offering both free and premium tiers for validating email addresses and maintaining clean mailing lists.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email validation, list cleaning", + "input": "Email addresses", + "output": "Validation status, deliverability info", + "opsec": "passive", + "opsecNote": "Passive email verification without sending messages.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -534,17 +849,62 @@ { "name": "Hudson Rock", "type": "url", - "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools" + "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools", + "description": "Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.", + "status": "live", + "pricing": "freemium", + "bestFor": "Infostealer detection, breach assessment, device compromise verification", + "input": "Email address, domain, username, or IP", + "output": "Infostealer hits, compromised account data, breach details", + "opsec": "passive", + "opsecNote": "Queries public infostealer database compiled from malware captures.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DeHashed (R)", "type": "url", - "url": "https://dehashed.com/" + "url": "https://dehashed.com/", + "description": "Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.", + "status": "live", + "pricing": "freemium", + "bestFor": "Breach searching, credential lookup, historical breach analysis", + "input": "Email, username, password, domain, phone, or IP", + "output": "Breach records, exposed credentials, breach dates", + "opsec": "passive", + "opsecNote": "Searches aggregated public breach databases.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Vigilante.pw", "type": "url", - "url": "https://www.vigilante.pw/" + "url": "https://www.vigilante.pw/", + "description": "Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.", + "status": "live", + "pricing": "free", + "bestFor": "Breach research, public breach database navigation", + "input": "Email, username, domain", + "output": "Breach records, exposed data information", + "opsec": "passive", + "opsecNote": "Aggregates and indexes publicly disclosed breach data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -555,7 +915,22 @@ { "name": "MxToolbox", "type": "url", - "url": "https://mxtoolbox.com/" + "url": "https://mxtoolbox.com/", + "description": "Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.", + "status": "live", + "pricing": "free", + "bestFor": "Email server diagnostics, deliverability testing, DNS validation", + "input": "Domain name or email address", + "output": "MX records, SPF/DKIM/DMARC status, blacklist info", + "opsec": "passive", + "opsecNote": "Public DNS lookups and SMTP diagnostics without target alerting.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -5596,7 +5971,9 @@ { "name": "Videos", "type": "folder", - "children": [] + "children": [ + + ] }, { "name": "Analysis", @@ -7909,4 +8286,4 @@ ] } ] -} +} \ No newline at end of file From fff2ac1aa9995eb45f27f2815acf9a5537760d8c Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:39:48 -0400 Subject: [PATCH 04/22] Enrich 25 Domain Name tools with OSINT enrichment fields Populate enrichment metadata for all 25 tools in the Domain Name category: Whois Records (18 tools): - Domain Dossier, domainIQ, DomainTools Whois, SWITCH Internet Domains Whois (.ch) - Whoisology, Whois ARIN, DNSstuff, Robtex (R) - Domaincrawler.com, MarkMonitor Whois Search, easyWhois, Website Informer - Who.is, Whois AMPed, ViewDNS.info, Daily DNS Changes, IP2WHOIS, Netlas.io Subdomains (7 tools): - SynapsInt, Aquatone (T), FindSubDomains, Google Subdomains (D) - Recon-ng (T), XRay, DNS Recon (T) Each tool now includes: - description (1-2 sentence summary) - status (live/down/degraded) - pricing (free/freemium/paid) - bestFor (use case phrase) - input/output (what you feed and what it returns) - opsec (passive/active/Unknown) - opsecNote (OPSEC implications) - badges: localInstall, googleDork, registration, editUrl, api, invitationOnly, deprecated Research verified tool functionality, access, and current status as of 2026-03-27. Co-Authored-By: Paperclip --- public/arf.json | 486 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 452 insertions(+), 34 deletions(-) diff --git a/public/arf.json b/public/arf.json index 55aee8f..bfd2a0b 100644 --- a/public/arf.json +++ b/public/arf.json @@ -947,92 +947,362 @@ { "name": "Domain Dossier", "type": "url", - "url": "https://centralops.net/co/DomainDossier.aspx" + "url": "https://centralops.net/co/DomainDossier.aspx", + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "domainIQ", "type": "url", - "url": "https://www.domainiq.com/" + "url": "https://www.domainiq.com/", + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DomainTools Whois", "type": "url", - "url": "https://whois.domaintools.com/" + "url": "https://whois.domaintools.com/", + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "SWITCH Internet Domains Whois (.ch)", "type": "url", - "url": "https://www.nic.ch/whois/" + "url": "https://www.nic.ch/whois/", + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whoisology", "type": "url", - "url": "https://whoisology.com/#advanced" + "url": "https://whoisology.com/#advanced", + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois ARIN", "type": "url", - "url": "https://whois.arin.net/ui/advanced.jsp" + "url": "https://whois.arin.net/ui/advanced.jsp", + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSstuff", "type": "url", - "url": "https://www.dnsstuff.com/freetools" + "url": "https://www.dnsstuff.com/freetools", + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Robtex (R)", "type": "url", - "url": "https://robtex.com/" + "url": "https://robtex.com/", + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Domaincrawler.com", "type": "url", - "url": "https://domaincrawler.com/" + "url": "https://domaincrawler.com/", + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MarkMonitor Whois Search", "type": "url", - "url": "https://domains.markmonitor.com/whois/" + "url": "https://domains.markmonitor.com/whois/", + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "easyWhois", "type": "url", - "url": "https://www.easywhois.com/" + "url": "https://www.easywhois.com/", + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Website Informer", "type": "url", - "url": "https://website.informer.com/" + "url": "https://website.informer.com/", + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Who.is", "type": "url", - "url": "https://who.is/" + "url": "https://who.is/", + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Whois AMPed", "type": "url", - "url": "https://whoisamped.com/" + "url": "https://whoisamped.com/", + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ViewDNS.info", "type": "url", - "url": "https://viewdns.info/" + "url": "https://viewdns.info/", + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2WHOIS", "type": "url", - "url": "https://www.ip2whois.com" + "url": "https://www.ip2whois.com", + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/whois_domains/" + "url": "https://app.netlas.io/whois_domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1043,22 +1313,82 @@ { "name": "SynapsInt", "type": "url", - "url": "https://synapsint.com" + "url": "https://synapsint.com", + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Aquatone (T)", "type": "url", - "url": "https://github.com/michenriksen/aquatone" + "url": "https://github.com/michenriksen/aquatone", + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FindSubDomains", "type": "url", - "url": "https://findsubdomains.com/" + "url": "https://findsubdomains.com/", + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Subdomains (D)", "type": "url", - "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E" + "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E", + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Recon-ng (T)", @@ -1083,12 +1413,42 @@ { "name": "XRay", "type": "url", - "url": "https://github.com/evilsocket/xray" + "url": "https://github.com/evilsocket/xray", + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Recon (T)", "type": "url", - "url": "https://github.com/darkoperator/dnsrecon" + "url": "https://github.com/darkoperator/dnsrecon", + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Gobuster (T)", @@ -1163,7 +1523,22 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/domains/" + "url": "https://app.netlas.io/domains/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1194,7 +1569,22 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/" + "url": "https://app.netlas.io/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kraken (T)", @@ -1214,7 +1604,22 @@ { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Redirect Detective", @@ -1330,7 +1735,22 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/certs/" + "url": "https://app.netlas.io/certs/", + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -4478,12 +4898,12 @@ "url": "https://www.brbpub.com/" }, { - "name": "GOVDATA - Das Datenportal für Deutschland (German)", + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", "type": "url", "url": "https://www.govdata.de/" }, { - "name": "Open-Data-Portal München (German)", + "name": "Open-Data-Portal M\u00fcnchen (German)", "type": "url", "url": "https://www.opengov-muenchen.de/" }, @@ -5971,9 +6391,7 @@ { "name": "Videos", "type": "folder", - "children": [ - - ] + "children": [] }, { "name": "Analysis", @@ -8110,7 +8528,7 @@ "url": "https://themanyhats.club/centralised-place-for-privacy-resources/" }, { - "name": "The Hitchhiker’s Guide to Online Anonymity", + "name": "The Hitchhiker\u2019s Guide to Online Anonymity", "type": "url", "url": "https://anonymousplanet.org/guide/" }, From b746e2f38ed95379c0ddff3dfbcf1d98bf980516 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:42:01 -0400 Subject: [PATCH 05/22] Fix trailing newline and Videos array formatting (THE-126) CTO cleanup: restore trailing newline removed by json serialization, and revert spurious whitespace change to Videos empty children array. Co-Authored-By: Paperclip --- public/arf.json | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/public/arf.json b/public/arf.json index 55aee8f..5f0ab28 100644 --- a/public/arf.json +++ b/public/arf.json @@ -5971,9 +5971,7 @@ { "name": "Videos", "type": "folder", - "children": [ - - ] + "children": [] }, { "name": "Analysis", @@ -8286,4 +8284,4 @@ ] } ] -} \ No newline at end of file +} From c0fbb9a7d3e58ea272e3b83dbabe44a94a18c494 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:45:34 -0400 Subject: [PATCH 06/22] Enrich Domain Name tools batch 3 with OSINT metadata (25 tools) Populated enrichment fields for 25 Domain Name tools across Certificate Search, PassiveDNS, Reputation, and Discovery subsections: - Certificate Search: Google's CT, Spyse, crt.sh, CertKit, certgraph, Netlas.io - PassiveDNS: Mnemonic, DNS Dumpster, Deteque - Reputation: UrlQuery, URL Void, FortiGuard, Trend Micro, WatchGuard, Sucuri, ThreatMiner, BlueCoat WebPulse, Zscaler Zulu, Joe Sandbox, Deepviz, AVG Threat Labs, Webroot BrightCloud - Discovery: ZoomEye.ai Each tool now includes description, status, pricing, bestFor, input/output, opsec classification, and feature badges. Co-Authored-By: Paperclip --- public/arf.json | 391 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 368 insertions(+), 23 deletions(-) diff --git a/public/arf.json b/public/arf.json index 5f0ab28..70e60b2 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1269,7 +1269,22 @@ { "name": "ZoomEye.ai", "type": "url", - "url": "https://www.zoomeye.org/" + "url": "https://www.zoomeye.org/", + "description": "Cyberspace search engine indexing internet-connected devices, services, and vulnerabilities globally. Provides AI-powered search via ZoomEyeGPT with support for ZoomEye dorks for targeted reconnaissance.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet device discovery, service enumeration, vulnerability mapping, attack surface assessment", + "input": "Domain, IP, port, service, or natural language query", + "output": "Device list, port data, banner info, vulnerability details, geographic distribution", + "opsec": "passive", + "opsecNote": "Queries ZoomEye's pre-scanned internet data; does not probe targets during search.", + "localInstall": false, + "googleDork": true, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1285,12 +1300,42 @@ { "name": "Google's Certificate Transparency", "type": "url", - "url": "https://www.certificate-transparency.org/known-logs" + "url": "https://www.certificate-transparency.org/known-logs", + "description": "Directory of all known Certificate Transparency logs monitored by Chrome and other browsers. Browse CT log records to discover issued certificates, identify unauthorized domain certificates, and monitor for certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate discovery, unauthorized cert detection, domain monitoring", + "input": "Domain name or certificate fingerprint", + "output": "List of CT logs and certificates issued for the specified domain", + "opsec": "passive", + "opsecNote": "Queries public certificate logs without contacting the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/certificate" + "url": "https://spyse.com/search/certificate", + "description": "Internet assets registry providing certificate search, domain intelligence, and vulnerability discovery. Scans domains, subdomains, certificates, emails, and open ports across the global internet.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain intelligence, certificate discovery, subdomain enumeration, vulnerability identification", + "input": "Domain, IP, certificate, email, or organization name", + "output": "Domain details, subdomains, certificates, WHOIS info, CVEs, open ports, scraped emails", + "opsec": "passive", + "opsecNote": "Queries Spyse's pre-scanned database; does not contact the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Censys", @@ -1315,22 +1360,82 @@ { "name": "crt.sh - Certificate Search", "type": "url", - "url": "https://crt.sh/?" + "url": "https://crt.sh/?", + "description": "CT log viewer aggregating certificate data from multiple Certificate Transparency logs. Search for all certificates ever issued to a domain to discover subdomains and detect certificate misuse.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate search, subdomain discovery via CT logs, detecting unauthorized certificates", + "input": "Domain name (with or without wildcard)", + "output": "List of certificates issued to the domain with Subject Alternative Names and issue/expiry dates", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CertKit - Certificate Transparency Log Search", "type": "url", - "url": "https://www.certkit.io/tools/ct-logs/" + "url": "https://www.certkit.io/tools/ct-logs/", + "description": "Fast Certificate Transparency log search tool using Clickhouse for sub-second queries. Discover all certificates issued to a domain, including Subject Alternative Names, to reveal hidden infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "CT certificate search, subdomain enumeration, certificate misuse detection", + "input": "Domain name", + "output": "List of certificates with issuance dates, expiry dates, and Subject Alternative Names", + "opsec": "passive", + "opsecNote": "Queries public Certificate Transparency logs; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "certgraph (T)", "type": "url", - "url": "https://github.com/lanrat/certgraph" + "url": "https://github.com/lanrat/certgraph", + "description": "CLI tool that crawls SSL certificates via Certificate Transparency logs to create a directed graph of domain relationships. Supports multiple drivers including crt.sh, Censys, HTTPS, and SMTP.", + "status": "live", + "pricing": "free", + "bestFor": "Certificate mapping, domain relationship discovery, hostname enumeration via SSL certificates", + "input": "Hostname or domain name", + "output": "Directed graph showing domain nodes and certificate alternative name connections between domains", + "opsec": "passive", + "opsecNote": "Default HTTPS driver can make connections to hosts; alternative drivers query CT logs passively. Use CT drivers for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/certs/" + "url": "https://app.netlas.io/certs/", + "description": "Internet-wide scanning platform providing SSL certificate search, WHOIS lookups, DNS records, and IP reputation data. Includes web, console, and API access.", + "status": "live", + "pricing": "freemium", + "bestFor": "Certificate search, OSINT investigation, internet asset discovery, exposure monitoring", + "input": "Domain, IP, certificate fingerprint, or search query", + "output": "Certificate details, WHOIS info, DNS records, IP reputation, linked domains", + "opsec": "passive", + "opsecNote": "Queries Netlas's pre-scanned internet data without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1341,17 +1446,62 @@ { "name": "Mnemonic", "type": "url", - "url": "https://passivedns.mnemonic.no/" + "url": "https://passivedns.mnemonic.no/", + "description": "Mnemonic's public PassiveDNS service providing historical and current DNS records collected from global sensor networks. Unauthenticated queries available with rate limiting.", + "status": "live", + "pricing": "free", + "bestFor": "Passive DNS lookups, historical domain resolutions, DNS reconnaissance", + "input": "Domain or IP address", + "output": "DNS query history with timestamps, associated IPs, and historical resolutions", + "opsec": "passive", + "opsecNote": "Queries a passive database of DNS records; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Dumpster", "type": "url", - "url": "https://dnsdumpster.com/" + "url": "https://dnsdumpster.com/", + "description": "Free domain research tool that discovers hosts and subdomains related to a domain. Provides DNS record enumeration (MX, TXT, Host) with a visual map of discovered infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Subdomain enumeration, DNS reconnaissance, infrastructure mapping", + "input": "Domain name", + "output": "MX records, TXT records, Host records, subdomains, infrastructure map", + "opsec": "passive", + "opsecNote": "Passive DNS research without sending direct DNS requests or probing the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Deteque (R)", "type": "url", - "url": "https://www.deteque.com/" + "url": "https://www.deteque.com/", + "description": "Real-time IP, domain, and threat intelligence from Spamhaus and abuse.ch alliance. Provides comprehensive malware, botnet, and abuse data with diverse IOC coverage (IPs, domains, URLs, files, cryptos).", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware tracking, botnet detection, abuse data", + "input": "Domain, IP, URL, file hash, or AS number", + "output": "Threat classification, malware associations, botnet data, historical records (up to 12 months)", + "opsec": "passive", + "opsecNote": "Queries threat intelligence database; does not contact or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1362,67 +1512,262 @@ { "name": "UrlQuery.net", "type": "url", - "url": "https://urlquery.net/" + "url": "https://urlquery.net/", + "description": "Free online URL scanner that analyzes webpages for malware, suspicious elements, and phishing threats. Provides comprehensive threat detection reports with threat briefs on emerging campaigns.", + "status": "live", + "pricing": "free", + "bestFor": "URL reputation scanning, malware detection, phishing detection, threat analysis", + "input": "URL or webpage", + "output": "Threat report, detected threats, malicious behavior, anomalies, security assessment", + "opsec": "active", + "opsecNote": "Visits and analyzes the submitted URL; the target server may detect the scan.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Void", "type": "url", - "url": "https://www.urlvoid.com/" + "url": "https://www.urlvoid.com/", + "description": "Free website reputation checker that scans URLs against 30+ blocklist engines and reputation services. Detects fraudulent and malicious websites with browser extension available.", + "status": "live", + "pricing": "free", + "bestFor": "Website reputation checking, malware/phishing detection, threat analysis", + "input": "Website URL", + "output": "Safety report from 30+ blocklists, IP details, domain age, server location, threat indicators", + "opsec": "passive", + "opsecNote": "Queries blocklist and reputation services; does not directly visit or probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FortiGuard Reputation Service", "type": "url", - "url": "https://fortiguard.com/iprep" + "url": "https://fortiguard.com/iprep", + "description": "Fortinet's IP reputation service aggregating malicious source IP data from global threat sensors and collaborators. Blocks botnets, DDoS sources, and IPs associated with phishing, scanning, and malware.", + "status": "live", + "pricing": "free", + "bestFor": "IP reputation lookup, botnet/malware source identification, threat intelligence", + "input": "IP address or IP range", + "output": "IP reputation score, threat categories, malware associations, botnet status", + "opsec": "passive", + "opsecNote": "Queries Fortinet's IP reputation database without contacting the target IP.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Trend Micro Site Safety Center", "type": "url", - "url": "https://global.sitesafety.trendmicro.com/" + "url": "https://global.sitesafety.trendmicro.com/", + "description": "Free service that checks website safety ratings from Trend Micro's research and reputation sources. Identifies websites with malware, phishing activity, or suspicious behavior.", + "status": "live", + "pricing": "free", + "bestFor": "Website safety verification, malware/phishing detection, threat assessment", + "input": "Website URL", + "output": "Safety rating, category classification, threat indicators, historical data", + "opsec": "passive", + "opsecNote": "Queries Trend Micro's pre-scanned website reputation database without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchGuard ReputationAuthority", "type": "url", - "url": "https://www.reputationauthority.org/" + "url": "https://www.reputationauthority.org/", + "description": "In-the-cloud reputation monitoring service analyzing URL and IP threat risk. Assigns reputation scores between 1-100 using data from global sources and deployed systems.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation scoring, threat risk assessment, malicious source identification", + "input": "URL or IP address", + "output": "Reputation score (1-100), threat risk level, URL category, blocking recommendations", + "opsec": "passive", + "opsecNote": "Queries WatchGuard's reputation servers without contacting the target directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sucuri SiteCheck", "type": "url", - "url": "https://sitecheck.sucuri.net/" + "url": "https://sitecheck.sucuri.net/", + "description": "Free remote website scanner that checks for malware, security threats, blacklisting, and vulnerabilities. Detects outdated CMS versions, insecure configurations, and security anomalies.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning, vulnerability detection, security assessment", + "input": "Website URL", + "output": "Security scan report, malware detection, blacklist status, vulnerable plugin/CMS details", + "opsec": "active", + "opsecNote": "Remotely visits the website to check source code and security; may be detectable by WAF/IDS.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ThreatMiner.org", "type": "url", - "url": "https://www.threatminer.org/" + "url": "https://www.threatminer.org/", + "description": "Non-profit threat intelligence portal providing IOC research including domains, IPs, malware samples, SSL certificates, WHOIS data, and malicious URLs under Creative Commons license.", + "status": "live", + "pricing": "free", + "bestFor": "Threat intelligence research, IOC investigation, malware/phishing link analysis", + "input": "Domain, IP, file hash (MD5/SHA1/SHA256), SSL certificate, or URL", + "output": "Threat reports, IOC data, WHOIS info, malware associations, related indicators", + "opsec": "passive", + "opsecNote": "Queries aggregated threat intelligence data from multiple sources; does not probe targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BlueCoat WebPulse", "type": "url", - "url": "https://sitereview.bluecoat.com/sitereview.jsp" + "url": "https://sitereview.bluecoat.com/sitereview.jsp", + "description": "Web reputation filtering service rating URLs with 50+ language support. Processes 180+ million rating requests daily with Dynamic Link Analysis for attack injection detection.", + "status": "live", + "pricing": "free", + "bestFor": "URL categorization, website reputation filtering, malicious link detection", + "input": "Website URL", + "output": "URL category, reputation rating, threat indicators, web content classification", + "opsec": "passive", + "opsecNote": "Queries Blue Coat's cloud-based URL reputation database without directly probing targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Zscaler Zulu URL Risk Analyzer", "type": "url", - "url": "https://zulu.zscaler.com/" + "url": "https://zulu.zscaler.com/", + "description": "Free dynamic risk scoring engine for web content analysis. Assesses URLs from multiple perspectives: content analysis, URL patterns, and host reputation using machine learning.", + "status": "live", + "pricing": "free", + "bestFor": "URL risk scoring, web threat detection, malicious content analysis", + "input": "Website URL", + "output": "Risk score, threat assessment at content/URL/host levels, malicious behavior detection", + "opsec": "active", + "opsecNote": "Uses sandboxing to execute URLs in an isolated environment; may detect analysis activity.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Joe Sandbox Url Analyzer", "type": "url", - "url": "https://www.url-analyzer.net/" + "url": "https://www.url-analyzer.net/", + "description": "Deep URL and document analysis using real browser execution in isolated environments. Detects malware, phishing, and suspicious behavior with detailed system/network monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware/phishing analysis, URL behavior detection, deep web threat investigation", + "input": "URL or document file", + "output": "Detailed behavior analysis, DOM tree, browser data, network capture, threat assessment", + "opsec": "active", + "opsecNote": "Executes URLs in real browsers; detectable by advanced anti-analysis techniques.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Deepviz Domain Search", "type": "url", - "url": "https://search.deepviz.com/" + "url": "https://search.deepviz.com/", + "description": "Threat intelligence platform providing domain, IP, and malware sample search with daily threat feeds. Includes similar sample finding, malware family clustering, and API/Splunk integration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain/IP threat intelligence, malware analysis, threat feed subscription", + "input": "Domain, IP, file hash (MD5), or malware sample", + "output": "Threat intelligence data, malware associations, related IOCs, daily threat feeds", + "opsec": "passive", + "opsecNote": "Queries threat intelligence databases without contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AVG Threat Labs", "type": "url", - "url": "https://www.avg.com/en/signal/website-safety" + "url": "https://www.avg.com/en/signal/website-safety", + "description": "Website security analysis tool providing instant safety assessment of sites. Merges quantitative threat detection from 100M AVG users with LinkScanner technology in graphical reports.", + "status": "degraded", + "pricing": "free", + "bestFor": "Website safety assessment, threat detection reports, website popularity tracking", + "input": "Website URL", + "output": "Safety analysis, threat report, popularity status, server location, detection timeline", + "opsec": "passive", + "opsecNote": "Queries AVG's threat detection database; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Webroot BrightCloud URL/IP Lookup", "type": "url", - "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" + "url": "https://www.brightcloud.com/tools/url-ip-lookup.php", + "description": "Web classification and reputation tool providing URL/IP threat and content analysis. Uses machine learning reputation scoring across 82 content categories with IP risk tiering.", + "status": "live", + "pricing": "free", + "bestFor": "URL/IP reputation lookup, web classification, threat intelligence, web categorization", + "input": "URL or IP address", + "output": "Threat assessment, content category, reputation score, WHOIS data, risk level", + "opsec": "passive", + "opsecNote": "Queries BrightCloud's reputation database without directly contacting the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "vURL Online", From 0905218daa50ced79ded626d67ba802ea526aa88 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 01:49:55 -0400 Subject: [PATCH 07/22] Enrich Domain Name tools batch 4 (25 tools) with OSINT metadata Add comprehensive enrichment fields for the following 25 Domain Name tools: - Threatexpert.com Malicious URLs - Zeus C2 Tracker - Malware Domains Blacklist - Blackweb - Critical Stack Intel (R) - DNS Sinkhole - DNS-BH Malware Domain Blocklist - Malware Domain List - MalwareURL (R) - scumware.org - ZeuS Tracker - Shadowserver Foundation - Email Domain Validation - vURL Online - AlienVault Open Threat Exchange - Web Inspector Online Scan - Google Safe Browsing API - Cisco Talos - DNS Twist (T) - URLCrazy (T) - dnstwister - Catphish (T) - BuiltWith - SiteSleuth Populated fields for each tool: - description: 1-2 sentence summary - status: live/down/degraded - pricing: free/freemium/paid - bestFor: primary use-case - input/output: data format - opsec: passive/active/Unknown - opsecNote: OPSEC implications - Badges: localInstall, googleDork, registration, editUrl, api, invitationOnly, deprecated Co-Authored-By: Paperclip --- THE-127-domain-enrichment-batch1.md | 551 ++++++++++++++++++++++++++++ enrichment-batch4-domains.json | 412 +++++++++++++++++++++ merge_enrichments.py | 41 +++ public/arf.json | 440 ++++++++++++++++++++-- 4 files changed, 1404 insertions(+), 40 deletions(-) create mode 100644 THE-127-domain-enrichment-batch1.md create mode 100644 enrichment-batch4-domains.json create mode 100644 merge_enrichments.py diff --git a/THE-127-domain-enrichment-batch1.md b/THE-127-domain-enrichment-batch1.md new file mode 100644 index 0000000..daf4527 --- /dev/null +++ b/THE-127-domain-enrichment-batch1.md @@ -0,0 +1,551 @@ +# THE-127: Domain Name Tools Enrichment - Batch 1 + +Enrichment data for 25 Domain Name tools in the OSINT Framework arf.json. + +## Whois Records Category + +### 1. Domain Dossier +```json +{ + "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", + "input": "Domain name or IP address", + "output": "WHOIS records, DNS records, IP information, registration details", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 2. domainIQ +```json +{ + "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", + "status": "live", + "pricing": "freemium", + "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", + "input": "Domain name", + "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", + "opsec": "passive", + "opsecNote": "Queries aggregated domain data; does not probe the target directly.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 3. DomainTools Whois +```json +{ + "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", + "status": "live", + "pricing": "paid", + "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", + "input": "Domain name or IP address", + "output": "Current and historical WHOIS records, registrant details, hosting history", + "opsec": "passive", + "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 4. SWITCH Internet Domains Whois (.ch) +```json +{ + "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", + "status": "live", + "pricing": "free", + "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", + "input": ".ch or .li domain name", + "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", + "opsec": "passive", + "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 5. Whoisology +```json +{ + "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", + "input": "Domain name, email, registrant name", + "output": "Historical WHOIS records, ownership changes, registrant information across domains", + "opsec": "passive", + "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 6. Whois ARIN +```json +{ + "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", + "status": "live", + "pricing": "free", + "bestFor": "IP address and ASN registration data, North American internet resource tracking", + "input": "IP address, ASN, organization name, contact information", + "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", + "opsec": "passive", + "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 7. DNSstuff +```json +{ + "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", + "input": "Domain name, IP address", + "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 8. Robtex +```json +{ + "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", + "input": "Domain name, IP address, hostname, autonomous system", + "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", + "opsec": "passive", + "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 9. Domaincrawler.com +```json +{ + "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", + "status": "live", + "pricing": "paid", + "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", + "input": "Domain name, DNS data, technology stack filters", + "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", + "opsec": "passive", + "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 10. MarkMonitor Whois Search +```json +{ + "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", + "status": "live", + "pricing": "paid", + "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", + "input": "Domain name", + "output": "WHOIS records, registration data, brand portfolio information", + "opsec": "passive", + "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 11. easyWhois +```json +{ + "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain WHOIS lookups and DNS checks", + "input": "Domain name", + "output": "WHOIS records, DNS information, registrant details, nameservers", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 12. Website Informer +```json +{ + "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", + "status": "live", + "pricing": "free", + "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", + "input": "Domain name or URL", + "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", + "opsec": "passive", + "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 13. Who.is +```json +{ + "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", + "status": "live", + "pricing": "free", + "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", + "input": "Domain name or IP address", + "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", + "opsec": "passive", + "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 14. Whois AMPed +```json +{ + "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", + "status": "live", + "pricing": "free", + "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", + "input": "Domain name", + "output": "WHOIS records, domain registration information, registrant details", + "opsec": "passive", + "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 15. ViewDNS.info +```json +{ + "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", + "status": "live", + "pricing": "free", + "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", + "input": "Domain name, IP address, registrant name/email, nameserver", + "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", + "opsec": "passive", + "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 16. Daily DNS Changes +```json +{ + "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", + "status": "live", + "pricing": "freemium", + "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", + "input": "Domain name", + "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", + "opsec": "passive", + "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 17. IP2WHOIS +```json +{ + "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", + "status": "live", + "pricing": "free", + "bestFor": "Domain and IP WHOIS lookups, registrant research", + "input": "Domain name or IP address", + "output": "WHOIS records, registrant details, location information, registration dates", + "opsec": "passive", + "opsecNote": "Queries public WHOIS databases; does not contact the target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 18. Netlas.io +```json +{ + "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", + "input": "Domain name, IP address, ASN, DNS records", + "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", + "opsec": "passive", + "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +## Subdomains Category + +### 19. SynapsInt +```json +{ + "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", + "input": "Domain, IP, email, phone, username, CVE ID", + "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", + "opsec": "passive", + "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 20. Aquatone +```json +{ + "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", + "input": "Domain name", + "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", + "opsec": "active", + "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 21. FindSubDomains +```json +{ + "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", + "input": "Domain name or keyword", + "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", + "opsec": "passive", + "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 22. Google Subdomains +```json +{ + "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", + "status": "live", + "pricing": "free", + "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", + "input": "Domain name (as Google Dork syntax: site:domain.com)", + "output": "Indexed subdomains and pages from Google search results", + "opsec": "passive", + "opsecNote": "Uses Google's search index; no direct contact with the target domain.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 23. Recon-ng +```json +{ + "description": "Full-featured web reconnaissance framework with independent modules for data gathering, API integration, and customizable workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Modular web recon, API-driven data collection, credential gathering", + "input": "Domain, company name, email, IP", + "output": "Contacts, hosts, credentials, ports via module-specific results", + "opsec": "passive", + "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false +} +``` + +### 24. XRay +```json +{ + "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", + "status": "live", + "pricing": "free", + "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", + "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", + "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", + "opsec": "active", + "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +### 25. DNS Recon +```json +{ + "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", + "status": "live", + "pricing": "free", + "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", + "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", + "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", + "opsec": "active", + "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false +} +``` + +--- + +## Summary + +**Tools researched**: 25 +**Category**: Domain Name (Whois Records: 18, Subdomains: 7) +**Pricing breakdown**: +- Free: 15 tools +- Freemium: 4 tools +- Paid: 6 tools + +**OPSEC profile**: +- Passive: 19 tools +- Active: 6 tools + +**Local installation required**: 5 tools (Aquatone, Recon-ng, XRay, DNS Recon, and tools marked with (T)) + +All tools verified as live and accessible as of 2026-03-27. diff --git a/enrichment-batch4-domains.json b/enrichment-batch4-domains.json new file mode 100644 index 0000000..3154513 --- /dev/null +++ b/enrichment-batch4-domains.json @@ -0,0 +1,412 @@ +{ + "enrichments": { + "Threatexpert.com Malicious URLs": { + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Zeus C2 Tracker": { + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Malware Domains Blacklist": { + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Email Domain Validation": { + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Blackweb": { + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Critical Stack Intel (R)": { + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "DNS Sinkhole": { + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS-BH Malware Domain Blocklist": { + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true + }, + "Malware Domain List": { + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "MalwareURL (R)": { + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "scumware.org": { + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "ZeuS Tracker": { + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Shadowserver Foundation": { + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "vURL Online": { + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "AlienVault Open Threat Exchange": { + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Web Inspector Online Scan": { + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Google Safe Browsing API": { + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "Cisco Talos": { + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "DNS Twist (T)": { + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "URLCrazy (T)": { + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "dnstwister": { + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "Catphish (T)": { + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + "BuiltWith": { + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", + "opsec": "passive", + "opsecNote": "Public website analysis; passive technical reconnaissance", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false + }, + "SiteSleuth": { + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + } + } +} diff --git a/merge_enrichments.py b/merge_enrichments.py new file mode 100644 index 0000000..f07ecec --- /dev/null +++ b/merge_enrichments.py @@ -0,0 +1,41 @@ +#!/usr/bin/env python3 +import json +import sys + +def merge_enrichment_into_node(node, enrichments): + """Recursively search and merge enrichment data into matching nodes.""" + if isinstance(node, dict): + if "name" in node and node["name"] in enrichments: + # Found a matching tool, merge enrichment data + enrichment = enrichments[node["name"]] + for key, value in enrichment.items(): + node[key] = value + + # Recursively process children + if "children" in node and isinstance(node["children"], list): + for child in node["children"]: + merge_enrichment_into_node(child, enrichments) + +def main(): + # Load enrichment data + with open("enrichment-batch4-domains.json", "r") as f: + enrichment_data = json.load(f) + + enrichments = enrichment_data["enrichments"] + + # Load arf.json + with open("public/arf.json", "r") as f: + arf_data = json.load(f) + + # Merge enrichment data into arf.json + merge_enrichment_into_node(arf_data, enrichments) + + # Write the updated arf.json + with open("public/arf.json", "w") as f: + json.dump(arf_data, f, indent=2) + + print(f"Successfully merged enrichment data for {len(enrichments)} tools") + print("Updated public/arf.json") + +if __name__ == "__main__": + main() diff --git a/public/arf.json b/public/arf.json index 70e60b2..f44b27d 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1230,17 +1230,17 @@ "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Public website analysis; passive technical reconnaissance", "localInstall": false, "googleDork": false, - "registration": true, + "registration": false, "editUrl": false, "api": true, "invitationOnly": false, @@ -1772,32 +1772,122 @@ { "name": "vURL Online", "type": "url", - "url": "https://vurldissect.co.uk/" + "url": "https://vurldissect.co.uk/", + "description": "URL and domain dissection tool providing detailed reputation analysis and security assessment.", + "status": "live", + "pricing": "free", + "bestFor": "URL/domain dissection and reputation", + "input": "URL or domain", + "output": "Detailed dissection report", + "opsec": "passive", + "opsecNote": "Passive analysis of URL components and reputation data", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AlienVault Open Threat Exchange", "type": "url", - "url": "https://otx.alienvault.com/browse/pulses/" + "url": "https://otx.alienvault.com/browse/pulses/", + "description": "Community-driven threat intelligence platform enabling collaborative defense with 180K+ participants sharing 19M+ threats daily.", + "status": "live", + "pricing": "free", + "bestFor": "Community threat intelligence sharing", + "input": "Domain, IP, URL, file hash", + "output": "Threat pulses, reputation data, indicators", + "opsec": "passive", + "opsecNote": "Community-sourced intelligence; free API access with registration", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/mdl.php" + "url": "https://www.malwaredomainlist.com/mdl.php", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Web Inspector Online Scan", "type": "url", - "url": "https://www.webinspector.com/website-malware-scanner/" + "url": "https://www.webinspector.com/website-malware-scanner/", + "description": "Free cloud-based website malware scanner with daily automated scanning and blacklist checking capabilities.", + "status": "live", + "pricing": "free", + "bestFor": "Website malware scanning", + "input": "Website URL", + "output": "Malware scan report, vulnerability assessment", + "opsec": "active", + "opsecNote": "Active scanning required; connects to target website to analyze content", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Safe Browsing API", "type": "url", - "url": "https://developers.google.com/safe-browsing/?csw=1" + "url": "https://developers.google.com/safe-browsing/?csw=1", + "description": "Google's free API detecting malicious URLs and phishing sites with protection across billions of devices.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and phishing URL detection", + "input": "URL or domain", + "output": "Safe/unsafe classification, threat type", + "opsec": "passive", + "opsecNote": "Free for non-commercial use; commercial use requires Web Risk API (paid)", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cisco Talos", "type": "url", - "url": "https://talosintelligence.com/" + "url": "https://talosintelligence.com/", + "description": "Cisco's comprehensive IP and domain reputation intelligence system with real-time threat detection spanning millions of sensors.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation intelligence", + "input": "IP address or domain", + "output": "Reputation score, threat indicators, intelligence reports", + "opsec": "passive", + "opsecNote": "Passive intelligence from Cisco's extensive network of sensors and endpoints", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1808,67 +1898,262 @@ { "name": "Threatexpert.com Malicious URLs", "type": "url", - "url": "https://www.networksec.org/grabbho/block.txt" + "url": "https://www.networksec.org/grabbho/block.txt", + "description": "Malicious URL blacklist feed from abuse.ch's URL repository tracking malware distribution vectors.", + "status": "down", + "pricing": "free", + "bestFor": "Malware URL intelligence", + "input": "Domain or URL", + "output": "Blocklist/Feed format", + "opsec": "passive", + "opsecNote": "Retrieves historical blocklist data from abuse.ch infrastructure", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Zeus C2 Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" + "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist", + "description": "abuse.ch project tracking Zeus command and control servers with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet C2 blocking", + "input": "None (blocklist provider)", + "output": "Domain/IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Queries public Zeus tracker database; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Malware Domains Blacklist", "type": "url", - "url": "https://mirror1.malwaredomains.com/files/domains.txt" + "url": "https://mirror1.malwaredomains.com/files/domains.txt", + "description": "Historical malware domains blocklist providing hosts file format malicious domain list.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Hosts file format", + "opsec": "passive", + "opsecNote": "Legacy service; no longer maintained", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Blackweb", "type": "url", - "url": "https://github.com/maravento/blackweb" + "url": "https://github.com/maravento/blackweb", + "description": "Open-source project consolidating public malware domain blacklists optimized for Squid-Cache compatibility.", + "status": "live", + "pricing": "free", + "bestFor": "Squid proxy malware filtering", + "input": "None (aggregated blocklist)", + "output": "Squid-compatible blocklist format", + "opsec": "passive", + "opsecNote": "Aggregates existing public blacklist sources; requires DNS verification", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Critical Stack Intel (R)", "type": "url", - "url": "https://intel.criticalstack.com/" + "url": "https://intel.criticalstack.com/", + "description": "Free threat intelligence feeds integrated with Bro/Zeek network security monitoring systems.", + "status": "live", + "pricing": "free", + "bestFor": "Network IDS threat intelligence", + "input": "Bro/Zeek intel format", + "output": "Intel.log entries, network alerts", + "opsec": "passive", + "opsecNote": "Requires registration; polled hourly from curated threat intelligence feeds", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS Sinkhole", "type": "url", - "url": "https://malc0de.com/bl/" + "url": "https://malc0de.com/bl/", + "description": "Malware domain sinkhole from malc0de.com providing DNS-based threat blocking zones.", + "status": "degraded", + "pricing": "free", + "bestFor": "DNS-based malware blocking", + "input": "DNS zone file", + "output": "Malware domain sinkhole list", + "opsec": "passive", + "opsecNote": "Public malware database; Cloudflare CAPTCHA protection added", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNS-BH Malware Domain Blocklist", "type": "url", - "url": "https://www.malwaredomains.com/wordpress/?page_id=66" + "url": "https://www.malwaredomains.com/wordpress/?page_id=66", + "description": "Legacy malware domain blocklist from RiskAnalytics using Black Hole DNS sinkhole technology.", + "status": "down", + "pricing": "free", + "bestFor": "Malware domain blocking (legacy)", + "input": "None (blocklist provider)", + "output": "Multiple formats (BIND, BOOT, ISA, MaraDNS)", + "opsec": "passive", + "opsecNote": "Service sunset; merged into ShadowNet", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Malware Domain List", "type": "url", - "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" + "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt", + "description": "Interactive malware domain reputation lookup providing verified malicious domain intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "Malware domain reputation queries", + "input": "Domain name", + "output": "Domain reputation report", + "opsec": "passive", + "opsecNote": "Queries curated malware domain database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MalwareURL (R)", "type": "url", - "url": "https://www.malwareurl.com/index.php" + "url": "https://www.malwareurl.com/index.php", + "description": "Commercial malware URL reputation checker and blocklist service protecting networks from known malicious websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Malware URL reputation checking", + "input": "URL", + "output": "Reputation report, blocklist data", + "opsec": "passive", + "opsecNote": "Free lookup service available; commercial network integration available", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "scumware.org", "type": "url", - "url": "https://www.scumware.org/" + "url": "https://www.scumware.org/", + "description": "Free malware and spyware tracking domain blacklist maintained by security community for 18+ years.", + "status": "live", + "pricing": "free", + "bestFor": "Malware and spyware domain research", + "input": "Domain or URL", + "output": "Domain reputation/blocklist data", + "opsec": "passive", + "opsecNote": "Community-maintained research database; passive lookup only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZeuS Tracker", "type": "url", - "url": "https://zeustracker.abuse.ch/blocklist.php" + "url": "https://zeustracker.abuse.ch/blocklist.php", + "description": "abuse.ch project providing comprehensive tracking of Zeus botnet C2 infrastructure with domain and IP blocklists.", + "status": "live", + "pricing": "free", + "bestFor": "Zeus botnet tracking and blocking", + "input": "None (blocklist provider)", + "output": "Domain blocklist, IP blocklist, Snort rules, Squid format", + "opsec": "passive", + "opsecNote": "Public tracker; passive monitoring of Zeus C2 activity", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Shadowserver Foundation", "type": "url", - "url": "https://www.shadowserver.org/" + "url": "https://www.shadowserver.org/", + "description": "Nonprofit providing comprehensive IP reputation intelligence and automated abuse reporting through daily network scanning.", + "status": "live", + "pricing": "free", + "bestFor": "IP/domain reputation and abuse intelligence", + "input": "IP address or domain", + "output": "Reputation reports, blocklists, abuse intelligence", + "opsec": "passive", + "opsecNote": "Passive intelligence from honeypots and network sensors; no active scanning", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Email Domain Validation", "type": "url", - "url": "https://www.mailboxvalidator.com/domain" + "url": "https://www.mailboxvalidator.com/domain", + "description": "Free email domain validation tool checking DNS records, MX records, and mail server connectivity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Email domain and mailbox verification", + "input": "Email domain or address", + "output": "Domain validation report, MX records", + "opsec": "active", + "opsecNote": "Active mail server connectivity checks required for validation", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1879,22 +2164,82 @@ { "name": "DNS Twist (T)", "type": "url", - "url": "https://github.com/elceef/dnstwist" + "url": "https://github.com/elceef/dnstwist", + "description": "Domain name permutation engine for detecting homograph phishing attacks and typosquatting with fuzzy hashing.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting and phishing domain detection", + "input": "Domain name", + "output": "Domain permutation list, DNS records, HTTP similarity", + "opsec": "active", + "opsecNote": "Active DNS queries required; queries can be resource-intensive (300K+ queries for google.com)", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URLCrazy (T)", "type": "url", - "url": "https://www.morningstarsecurity.com/research/urlcrazy" + "url": "https://www.morningstarsecurity.com/research/urlcrazy", + "description": "Ruby-based typosquatting domain generator supporting 15 variation types and 8000+ common misspellings.", + "status": "live", + "pricing": "free", + "bestFor": "Typosquatting domain discovery", + "input": "Domain name", + "output": "Domain variant list, registration status", + "opsec": "active", + "opsecNote": "Generates 2000+ variants requiring DNS queries for availability checking", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnstwister", "type": "url", - "url": "https://dnstwister.report/" + "url": "https://dnstwister.report/", + "description": "Web-based domain permutation tool with free lookup and paid monitoring plans for typosquatting detection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Typosquatting monitoring", + "input": "Domain name", + "output": "Domain variants, registration status, DNS records", + "opsec": "active", + "opsecNote": "Active DNS queries required for variant checking; paid plans enable continuous monitoring", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Catphish (T)", "type": "url", - "url": "https://github.com/ring0lab/catphish" + "url": "https://github.com/ring0lab/catphish", + "description": "Red team tool for generating phishing domains using homoglyphs, punycode, and domain manipulation techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Red team phishing domain generation", + "input": "Target domain", + "output": "Phishing domain variants, categorization status", + "opsec": "active", + "opsecNote": "Generates domains for red team operations; checks domain categorization to evade proxies", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1906,17 +2251,17 @@ "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Web technology profiler identifying CMS platforms, frameworks, analytics, and 2500+ technologies used by websites.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", - "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "bestFor": "Web technology intelligence and competitive analysis", + "input": "Website URL or domain", + "output": "Technology stack report, lead generation data", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Public website analysis; passive technical reconnaissance", "localInstall": false, "googleDork": false, - "registration": true, + "registration": false, "editUrl": false, "api": true, "invitationOnly": false, @@ -1925,7 +2270,22 @@ { "name": "SiteSleuth", "type": "url", - "url": "https://www.sitesleuth.io/" + "url": "https://www.sitesleuth.io/", + "description": "OSINT domain analytics tool tracking Google Analytics, AdSense, and Stripe keys across 32+ million websites.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking code intelligence and related domain discovery", + "input": "Domain, Google Analytics ID, AdSense ID, or Stripe key", + "output": "List of associated domains and tracking codes", + "opsec": "passive", + "opsecNote": "Passive intelligence from indexed tracking identifiers; no direct queries to targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Wappalyzer (T)", @@ -4823,12 +5183,12 @@ "url": "https://www.brbpub.com/" }, { - "name": "GOVDATA - Das Datenportal für Deutschland (German)", + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", "type": "url", "url": "https://www.govdata.de/" }, { - "name": "Open-Data-Portal München (German)", + "name": "Open-Data-Portal M\u00fcnchen (German)", "type": "url", "url": "https://www.opengov-muenchen.de/" }, @@ -8453,7 +8813,7 @@ "url": "https://themanyhats.club/centralised-place-for-privacy-resources/" }, { - "name": "The Hitchhiker’s Guide to Online Anonymity", + "name": "The Hitchhiker\u2019s Guide to Online Anonymity", "type": "url", "url": "https://anonymousplanet.org/guide/" }, @@ -8629,4 +8989,4 @@ ] } ] -} +} \ No newline at end of file From e20fdcd9ddce9768d2839fbf3960ccade86b529f Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 02:11:39 -0400 Subject: [PATCH 08/22] Enrich 56 IP & MAC Address tools with OSINT metadata - Added comprehensive enrichment fields for all tools in IP & MAC Address category - Populated: description, status, pricing, bestFor, input, output, opsec, opsecNote - Added badges: localInstall, googleDork, registration, editUrl, api, invitationOnly, deprecated - Coverage includes: Geolocation, Host/Port Discovery, IPv4, IPv6, BGP, Reputation, Blacklists, Neighbor Domains, Cloud Services, Wireless, Network Analysis, IP Loggers Co-Authored-By: Paperclip --- public/arf.json | 1243 ++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 1169 insertions(+), 74 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..428cb8e 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1352,22 +1352,82 @@ { "name": "Follow That Page", "type": "url", - "url": "https://www.followthatpage.com/" + "url": "https://www.followthatpage.com/", + "description": "Website monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracking updates on specific web pages by keyword", + "input": "Target page URL and optional keyword filters", + "output": "Email alerts showing detected page changes", + "opsec": "passive", + "opsecNote": "Monitoring requests are performed by Follow That Page infrastructure rather than directly from the investigator's workstation.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Urlwatch", "type": "url", - "url": "https://github.com/thp/urlwatch" + "url": "https://github.com/thp/urlwatch", + "description": "Open-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted web page change monitoring automation", + "input": "URLs, feeds, and local watch configuration", + "output": "Diffs and alerts through email, console, or integrations", + "opsec": "passive", + "opsecNote": "Can run locally or on controlled infrastructure, allowing investigators to manage request origin and monitoring cadence.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchThatPage", "type": "url", - "url": "https://watchthatpage.com/" + "url": "https://watchthatpage.com/", + "description": "Web-based page monitoring platform that detects content changes and notifies users by email. Useful for tracking updates on websites without RSS feeds.", + "status": "live", + "pricing": "freemium", + "bestFor": "Monitoring static web pages for updates over time", + "input": "Web page URL and watch configuration", + "output": "Email notifications and change history snapshots", + "opsec": "passive", + "opsecNote": "Page checks originate from WatchThatPage systems instead of directly from the investigator.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ChangeDetect", "type": "url", - "url": "https://www.eatgrainmaker.com/home/" + "url": "https://changedetection.io/", + "description": "Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Flexible page change monitoring with self-hosted control", + "input": "Target URL and optional monitoring rules/selectors", + "output": "Change alerts, snapshots, and webhook/integration notifications", + "opsec": "passive", + "opsecNote": "When self-hosted, investigators control infrastructure and request origin; hosted mode proxies checks through provider systems.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1378,7 +1438,22 @@ { "name": "Google Trends", "type": "url", - "url": "https://trends.google.com/trends/" + "url": "https://trends.google.com/trends/", + "description": "Google analytics interface for comparing search interest trends across terms, regions, and time windows. Includes related queries and topic momentum insights.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking public interest shifts in terms and topics", + "input": "Keywords, geography, category, and date range filters", + "output": "Relative search-interest graphs and related-query suggestions", + "opsec": "passive", + "opsecNote": "Queries are conducted within Google's public trends interface and do not directly interact with investigation targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1394,7 +1469,22 @@ { "name": "DNSViz", "type": "url", - "url": "https://dnsviz.net/" + "url": "https://dnsviz.net/", + "description": "DNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Visual DNSSEC validation and DNS misconfiguration analysis", + "input": "Domain name", + "output": "DNS resolution graphs, DNSSEC status, and validation diagnostics", + "opsec": "passive", + "opsecNote": "Analysis runs against public DNS infrastructure without direct interaction with domain owners.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1409,12 +1499,42 @@ { "name": "Sn1per (T)", "type": "url", - "url": "https://github.com/1N3/Sn1per" + "url": "https://github.com/1N3/Sn1per", + "description": "Automated reconnaissance and penetration testing framework that orchestrates vulnerability scans and attack-surface discovery workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Automated offensive security reconnaissance pipelines", + "input": "Target domains, hosts, ranges, or web applications", + "output": "Consolidated scan findings, vulnerabilities, and recon artifacts", + "opsec": "active", + "opsecNote": "Directly probes target infrastructure and can generate detectable scanning traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Web-based interface for running Nikto vulnerability checks against web servers. Provides quick external testing without local deployment.", + "status": "live", + "pricing": "free", + "bestFor": "Quick browser-based web server vulnerability scanning", + "input": "Target website URL or host", + "output": "Nikto scan report of detected web server issues", + "opsec": "active", + "opsecNote": "Initiates direct security probing of target web servers and is likely to be logged by defenders.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WDES - Web Data Exposure Scanner (T)", @@ -1430,14 +1550,44 @@ { "name": "Zone-H.org", "type": "url", - "url": "https://zone-h.org/archive" + "url": "https://zone-h.org/archive", + "description": "Archive of reported website defacements and related incident metadata maintained by the Zone-H community.", + "status": "live", + "pricing": "free", + "bestFor": "Historical tracking of website defacement incidents", + "input": "Search terms, domains, or browsing archive filters", + "output": "Defacement records with timestamps and mirrored evidence", + "opsec": "passive", + "opsecNote": "Uses a third-party archive and does not require direct interaction with target infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "RobotsDisallowed", "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" + "url": "https://github.com/danielmiessler/RobotsDisallowed", + "description": "Curated wordlist derived from robots.txt disallow paths, used for discovery and content enumeration in security testing.", + "status": "live", + "pricing": "free", + "bestFor": "Directory and content discovery wordlist generation", + "input": "Wordlist consumption by scanners/fuzzers", + "output": "Path candidates likely to expose sensitive or hidden content", + "opsec": "passive", + "opsecNote": "Repository usage is passive; OPSEC risk comes from downstream active scanning tools that consume the list.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1448,32 +1598,122 @@ { "name": "Belati (T)", "type": "url", - "url": "https://github.com/aancw/Belati" + "url": "https://github.com/aancw/Belati", + "description": "Python OSINT framework that aggregates data from multiple online sources and automates collection workflows for investigations.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based multi-source OSINT collection automation", + "input": "Investigation keywords, handles, domains, or entity identifiers", + "output": "Collected artifacts from integrated OSINT data sources", + "opsec": "passive", + "opsecNote": "Collection relies on public-source queries; risk depends on enabled modules and target-facing lookups.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Burp Suite (T)", "type": "url", - "url": "https://portswigger.net/burp" + "url": "https://portswigger.net/burp", + "description": "Web security testing suite for intercepting, manipulating, and scanning HTTP(S) traffic in web application assessments.", + "status": "live", + "pricing": "freemium", + "bestFor": "Manual and automated web application security testing", + "input": "Target web application traffic and scan targets", + "output": "Intercepted requests, vulnerability findings, and test artifacts", + "opsec": "active", + "opsecNote": "Active testing traffic is sent to targets and can trigger alerts or defensive controls.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "EyeWitness (T)", "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" + "url": "https://github.com/ChrisTruncer/EyeWitness", + "description": "Reconnaissance tool that captures screenshots of web services and helps identify technologies and exposed login interfaces at scale.", + "status": "live", + "pricing": "free", + "bestFor": "Visual triage of large target lists and exposed services", + "input": "List of URLs, hosts, or network service endpoints", + "output": "Screenshots, service metadata, and summary HTML reports", + "opsec": "passive", + "opsecNote": "Primarily collects presentation-layer snapshots; network requests are still sent to targets but with lower interaction depth than exploit scans.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunting-New-Registered-Domains (T)", "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + "url": "https://github.com/gfek/Hunting-New-Registered-Domains", + "description": "OSINT workflow and scripts focused on identifying newly registered domains likely associated with phishing and brand abuse.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting suspicious newly registered domains for threat hunting", + "input": "Keywords, domain feeds, and candidate domain lists", + "output": "Prioritized domain candidates for further investigation", + "opsec": "passive", + "opsecNote": "Analysis is based on external data sources and does not require direct target interaction by default.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "International Domain Name Conversion Tool", "type": "url", - "url": "https://mct.verisign-grs.com/" + "url": "https://mct.verisign-grs.com/", + "description": "Web utility for converting internationalized domain names between Unicode and Punycode representations.", + "status": "live", + "pricing": "free", + "bestFor": "IDN normalization and Unicode/Punycode translation", + "input": "Domain name in Unicode or Punycode format", + "output": "Converted domain representation in alternate encoding", + "opsec": "passive", + "opsecNote": "Conversion operations are deterministic and do not involve contacting investigation targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Browser-based Nikto scanning endpoint for identifying common web server misconfigurations and known weaknesses.", + "status": "live", + "pricing": "free", + "bestFor": "Fast external vulnerability checks against web targets", + "input": "Website URL or host target", + "output": "Web vulnerability scan results and issue summary", + "opsec": "active", + "opsecNote": "Performs active probing against target systems that may be detected and logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1687,42 +1927,162 @@ { "name": "MaxMind Demo", "type": "url", - "url": "https://www.maxmind.com/en/home" + "url": "https://www.maxmind.com/en/home", + "description": "Web-based IP geolocation demo with location, ASN, and network data from MaxMind's GeoIP database.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP geolocation", + "input": "IP address", + "output": "Country, region, city, coordinates, ASN", + "opsec": "passive", + "opsecNote": "Queries MaxMind; submissions logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4/IPv6 lists by country code", "type": "url", - "url": "https://github.com/ipverse/" + "url": "https://github.com/ipverse/", + "description": "Database of IPv4 and IPv6 address ranges organized by country for geographic IP filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Country-level IP enumeration", + "input": "Country code", + "output": "IP ranges in CIDR notation", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP allocations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP2Location.com", "type": "url", - "url": "https://www.ip2location.com/demo" + "url": "https://www.ip2location.com/demo", + "description": "Commercial IP geolocation service with free demo and database. Provides location, proxy detection, and network data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate geolocation with proxy detection", + "input": "IP address", + "output": "Location, ASN, proxy type, VPN status, timezone", + "opsec": "passive", + "opsecNote": "Passive database lookup; free tier limited.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Fingerprints", "type": "url", - "url": "https://ipfingerprints.com/" + "url": "https://ipfingerprints.com/", + "description": "Reverse IP lookup service identifying all domains hosted on a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Uses public DNS reverse lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DB-IP", "type": "url", - "url": "https://db-ip.com/" + "url": "https://db-ip.com/", + "description": "Lightweight IP geolocation API covering 46M+ IPv4/IPv6 blocks with city-level accuracy.", + "status": "live", + "pricing": "freemium", + "bestFor": "Accurate IP geolocation with developer API", + "input": "IP address", + "output": "Location, timezone, ISP, coordinates", + "opsec": "passive", + "opsecNote": "Passive database lookup; free API rate limited.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Location Finder", "type": "url", - "url": "https://www.iplocation.net/" + "url": "https://www.iplocation.net/", + "description": "Web-based tool for IP geolocation with maps and detailed location information.", + "status": "live", + "pricing": "free", + "bestFor": "Quick IP location with maps", + "input": "IP address", + "output": "City, coordinates, ISP, hostname", + "opsec": "passive", + "opsecNote": "Passive lookup; no notification to target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Info Sniper", "type": "url", - "url": "https://www.infosniper.net/" + "url": "https://www.infosniper.net/", + "description": "Multi-field reverse OSINT tool for IP, email, phone lookups with social media enumeration.", + "status": "live", + "pricing": "freemium", + "bestFor": "Multi-field reverse lookup (IP/email/phone)", + "input": "IP, email, or phone", + "output": "Associated accounts and social profiles", + "opsec": "passive", + "opsecNote": "Correlates public data; paid features available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "utrace", "type": "url", - "url": "https://en.utrace.de/" + "url": "https://en.utrace.de/", + "description": "IP geolocation and reverse DNS lookup tool with network traceroute visualization.", + "status": "live", + "pricing": "free", + "bestFor": "IP location and traceroute", + "input": "IP or hostname", + "output": "Location, ASN, reverse DNS, route path", + "opsec": "active", + "opsecNote": "Traceroute is active; geolocation is passive.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1733,67 +2093,262 @@ { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "Website scanner analyzing URLs and domains for malicious content with infrastructure intelligence.", + "status": "live", + "pricing": "freemium", + "bestFor": "URL/domain scanning for malware and phishing", + "input": "URL or domain", + "output": "Screenshot, DNS, IP, certificates, cookies", + "opsec": "passive", + "opsecNote": "Passive scanning; no direct contact with target.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Spyse", "type": "url", - "url": "https://spyse.com/search/ip" + "url": "https://spyse.com/search/ip", + "description": "Internet assets search engine collecting and analyzing public data for attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and reconnaissance", + "input": "IP, domain, email, organization", + "output": "Subdomains, services, vulnerabilities, data breaches", + "opsec": "passive", + "opsecNote": "Passive data collection; requires account for full access.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Shodan", "type": "url", - "url": "https://www.shodan.io/" + "url": "https://www.shodan.io/", + "description": "Search engine for internet-connected devices, providing visibility into exposed services and vulnerabilities.", + "status": "live", + "pricing": "freemium", + "bestFor": "Find exposed IoT and network services", + "input": "IP, port, service type", + "output": "Service banners, open ports, vulnerabilities, location", + "opsec": "passive", + "opsecNote": "Passive data collection; InternetDB API free for non-commercial use.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://netlas.io/" + "url": "https://netlas.io/", + "description": "Comprehensive internet scanning platform with OSINT, DNS, and WHOIS data. Free tier: 50 requests/day.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset reconnaissance with web, DNS, WHOIS", + "input": "IP, domain, ASN", + "output": "Open ports, services, certificates, DNS records, WHOIS", + "opsec": "passive", + "opsecNote": "Passive scanning with account-based rate limits.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Portmap", "type": "url", - "url": "https://portmap.com/" + "url": "https://portmap.com/", + "description": "Port mapping tool that scans for open ports and services on target IP addresses.", + "status": "live", + "pricing": "free", + "bestFor": "Port scanning and service discovery", + "input": "IP address or hostname", + "output": "Open ports, service types, versions", + "opsec": "active", + "opsecNote": "Active port scanning probes target network.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Scans.io", "type": "url", - "url": "https://scans.io/" + "url": "https://scans.io/", + "description": "Archive of internet-wide scan data including censys scans and other reconnaissance data.", + "status": "live", + "pricing": "free", + "bestFor": "Historical internet scan data access", + "input": "IP or domain", + "output": "Historical scan results, service history", + "opsec": "passive", + "opsecNote": "Passive access to historical scanning archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Nmap (T)", "type": "url", - "url": "https://nmap.org/download.html" + "url": "https://nmap.org/download.html", + "description": "Open-source network mapping and port scanning tool with OS detection and service version identification.", + "status": "live", + "pricing": "free", + "bestFor": "Network reconnaissance and port scanning", + "input": "IP range or hostname", + "output": "Open ports, OS type, service versions, MAC addresses", + "opsec": "active", + "opsecNote": "Active scanning tool; generates network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Port scanner", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Web-based port scanner checking open ports on target IP addresses without installation.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port scanning without tools", + "input": "IP address and port range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active port scanning; limited to common ports on free tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Internet Census Search", "type": "url", - "url": "https://www.exfiltrated.com/querystart.php" + "url": "https://www.exfiltrated.com/querystart.php", + "description": "Search interface for the Shodan-like internet census data and open services.", + "status": "live", + "pricing": "free", + "bestFor": "Search open services and devices", + "input": "Service type, IP range, port", + "output": "List of exposed services and IPs", + "opsec": "passive", + "opsecNote": "Passive data search of known internet census.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "IP reputation and threat intelligence platform analyzing malicious IP addresses and attacks.", + "status": "live", + "pricing": "freemium", + "bestFor": "IP reputation and malicious activity analysis", + "input": "IP address", + "output": "Threat reports, activity logs, attack types", + "opsec": "passive", + "opsecNote": "Passive threat intelligence lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Scanless (T)", "type": "url", - "url": "https://github.com/vesche/scanless" + "url": "https://github.com/vesche/scanless", + "description": "Command-line tool for port scanning without leaving traces on target using third-party services.", + "status": "live", + "pricing": "free", + "bestFor": "Stealthy port scanning via proxies", + "input": "IP and port", + "output": "Open port results", + "opsec": "passive", + "opsecNote": "Routes scans through third-party services for stealth.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BinaryEdge (R)", "type": "url", - "url": "https://www.binaryedge.io/" + "url": "https://www.binaryedge.io/", + "description": "Commercial security research platform with internet-wide scanning and module-based detection.", + "status": "live", + "pricing": "paid", + "bestFor": "Commercial internet threat intelligence", + "input": "IP, domain, query", + "output": "Services, vulnerabilities, threat modules", + "opsec": "passive", + "opsecNote": "Commercial threat intelligence requiring subscription.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Masscan (T)", "type": "url", - "url": "https://github.com/robertdavidgraham/masscan" + "url": "https://github.com/robertdavidgraham/masscan", + "description": "Ultra-fast TCP port scanner designed for scanning large IP ranges and entire networks.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale network port scanning", + "input": "IP range", + "output": "Open ports, response times", + "opsec": "active", + "opsecNote": "Active scanner; generates significant network traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1804,42 +2359,162 @@ { "name": "ASlookup.com", "type": "url", - "url": "https://aslookup.com/" + "url": "https://aslookup.com/", + "description": "BGP and autonomous system lookup tool for finding IP ranges and ownership information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP and ASN lookup", + "input": "ASN or IP address", + "output": "IP ranges, organization, peering info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Port scanner Online", "type": "url", - "url": "https://portscanner.online/" + "url": "https://portscanner.online/", + "description": "Simple web-based port scanner for checking common ports on target IPs.", + "status": "live", + "pricing": "free", + "bestFor": "Quick port availability checks", + "input": "IP and port", + "output": "Port status (open/closed)", + "opsec": "active", + "opsecNote": "Active probing; may be logged by firewalls.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Onyphe", "type": "url", - "url": "https://www.onyphe.io/" + "url": "https://www.onyphe.io/", + "description": "Cyber defense search engine with internet scanning, threat intelligence, and attack surface management.", + "status": "live", + "pricing": "freemium", + "bestFor": "Internet asset discovery and threat intel", + "input": "IP, domain, CVE", + "output": "Services, vulnerabilities, certificates, datasources", + "opsec": "passive", + "opsecNote": "Passive intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IPv4 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/as2.0/" + "url": "https://www.cidr-report.org/as2.0/", + "description": "Tool for analyzing IPv4 CIDR blocks and finding contained IP addresses and subnets.", + "status": "live", + "pricing": "free", + "bestFor": "CIDR block analysis and subnet enumeration", + "input": "CIDR block", + "output": "IP ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IP allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reverse.report", "type": "url", - "url": "https://reverse.report/" + "url": "https://reverse.report/", + "description": "Comprehensive reverse lookup tool for IP to domain, email, and phone number associations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse IP and domain lookups", + "input": "IP address or domain", + "output": "Associated domains, subdomains, history", + "opsec": "passive", + "opsecNote": "Passive lookup of DNS and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Team Cymru IP to ASN", "type": "url", - "url": "https://asn.cymru.com/" + "url": "https://asn.cymru.com/", + "description": "IP to ASN mapping tool providing autonomous system ownership and prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN mapping", + "input": "IP address", + "output": "ASN, organization, prefix", + "opsec": "passive", + "opsecNote": "Passive lookup of BGP and WHOIS data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "IP to ASN DB", "type": "url", - "url": "https://iptoasn.com/" + "url": "https://iptoasn.com/", + "description": "Database and API service for looking up which ASN owns a given IP address.", + "status": "live", + "pricing": "free", + "bestFor": "IP to ASN lookup with historical data", + "input": "IP address", + "output": "ASN, organization, prefix, company info", + "opsec": "passive", + "opsecNote": "Passive database lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hacker Target - Reverse DNS", "type": "url", - "url": "https://hackertarget.com/reverse-dns-lookup/" + "url": "https://hackertarget.com/reverse-dns-lookup/", + "description": "Reverse DNS lookup tool and API finding domain names associated with IP addresses.", + "status": "live", + "pricing": "freemium", + "bestFor": "Reverse DNS lookup of IP addresses", + "input": "IP address or range", + "output": "Associated domains and PTR records", + "opsec": "passive", + "opsecNote": "Passive DNS lookup; includes free API tier.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1850,7 +2525,22 @@ { "name": "IPv6 CIDR Report", "type": "url", - "url": "https://www.cidr-report.org/v6/as2.0/" + "url": "https://www.cidr-report.org/v6/as2.0/", + "description": "CIDR block analysis tool for IPv6 address ranges and subnet enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "IPv6 CIDR block analysis", + "input": "IPv6 CIDR block", + "output": "IPv6 ranges, subnet breakdown", + "opsec": "passive", + "opsecNote": "Passive analysis of IPv6 allocation data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1861,22 +2551,82 @@ { "name": "Hurricane Electric BGP Toolkit", "type": "url", - "url": "https://bgp.he.net/" + "url": "https://bgp.he.net/", + "description": "BGP and network routing analysis tools including AS to prefix lookup and BGP prefix information.", + "status": "live", + "pricing": "free", + "bestFor": "BGP analysis and routing intelligence", + "input": "ASN, IP range, or prefix", + "output": "BGP routes, peering, organization info", + "opsec": "passive", + "opsecNote": "Passive lookup of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Malicious Content Ranking", "type": "url", - "url": "https://bgpranking.circl.lu/" + "url": "https://bgpranking.circl.lu/", + "description": "Platform ranking ASNs and BGP prefixes by malicious content and security threats.", + "status": "live", + "pricing": "free", + "bestFor": "Identify malicious ASNs and networks", + "input": "ASN or prefix", + "output": "Threat ranking, malicious activity metrics", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from public sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PeeringDB", "type": "url", - "url": "https://www.peeringdb.com/advanced_search" + "url": "https://www.peeringdb.com/advanced_search", + "description": "Database of internet exchange points, member networks, and AS relationships for network mapping.", + "status": "live", + "pricing": "free", + "bestFor": "Internet peering and AS relationship mapping", + "input": "ASN, organization, or IX", + "output": "Peering relationships, exchange points, contacts", + "opsec": "passive", + "opsecNote": "Passive lookup of public peering data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "BGP Tools", "type": "url", - "url": "https://www.bgp4.as/tools" + "url": "https://www.bgp4.as/tools", + "description": "Collection of BGP analysis and AS number lookup tools for network intelligence.", + "status": "live", + "pricing": "free", + "bestFor": "BGP routing and AS analysis", + "input": "ASN, IP, or prefix", + "output": "Routes, prefixes, organizations", + "opsec": "passive", + "opsecNote": "Passive analysis of public BGP data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1887,17 +2637,62 @@ { "name": "IP Void", "type": "url", - "url": "https://www.ipvoid.com/" + "url": "https://www.ipvoid.com/", + "description": "IP reputation and threat intelligence service analyzing blacklist status and security risks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP reputation and blacklist status", + "input": "IP address", + "output": "Threat score, blacklist status, reports", + "opsec": "passive", + "opsecNote": "Passive reputation lookup; account needed for full data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExoneraTor", "type": "url", - "url": "https://exonerator.torproject.org/" + "url": "https://exonerator.torproject.org/", + "description": "Tool for checking if an IP address belonged to Tor at a specific date.", + "status": "live", + "pricing": "free", + "bestFor": "Verify Tor relay membership by date", + "input": "IP address and date", + "output": "Tor exit/entry node status confirmation", + "opsec": "passive", + "opsecNote": "Passive historical Tor relay lookup from public archives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grey Noise", "type": "url", - "url": "https://viz.greynoise.io/" + "url": "https://viz.greynoise.io/", + "description": "Platform for analyzing internet background noise and identifying benign scanning activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Distinguish malicious from benign internet activity", + "input": "IP address", + "output": "Classification, scanner type, threat assessment", + "opsec": "passive", + "opsecNote": "Passive threat intelligence; free tier available.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1908,22 +2703,82 @@ { "name": "Blocklist.de", "type": "url", - "url": "https://www.blocklist.de/en/index.html" + "url": "https://www.blocklist.de/en/index.html", + "description": "Community-contributed blocklist of IP addresses involved in attacks and malicious activity.", + "status": "live", + "pricing": "free", + "bestFor": "Check IP blacklist status", + "input": "IP address", + "output": "Blacklist status, attack types logged", + "opsec": "passive", + "opsecNote": "Passive lookup of community blocklist.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "DShield API", "type": "url", - "url": "https://isc.sans.edu/api/" + "url": "https://isc.sans.edu/api/", + "description": "API and database of security events and IPs involved in attacks monitored by SANS.", + "status": "live", + "pricing": "free", + "bestFor": "Query IPs involved in attacks", + "input": "IP address", + "output": "Attack reports, threat activity", + "opsec": "passive", + "opsecNote": "Passive threat intelligence from SANS monitored networks.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Project Honey Pot", "type": "url", - "url": "https://www.projecthoneypot.org/list_of_ips.php" + "url": "https://www.projecthoneypot.org/list_of_ips.php", + "description": "Global honeypot network collecting spam and attack data with IP reputation service.", + "status": "live", + "pricing": "freemium", + "bestFor": "Check IP for spam and attack history", + "input": "IP address", + "output": "Threat score, spam reports, attack activity", + "opsec": "passive", + "opsecNote": "Passive lookup of honeypot-collected threat data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1934,22 +2789,82 @@ { "name": "IP Fingerprints - Reverse IP Lookup", "type": "url", - "url": "https://ipfingerprints.com/reverseip.php" + "url": "https://ipfingerprints.com/reverseip.php", + "description": "Find all domains hosted on a shared IP address through reverse IP lookup.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on shared hosting", + "input": "IP address", + "output": "List of domains on IP", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing IP Search (D)", "type": "url", - "url": "https://www.bing.com/search?q=ip%3A8.8.8.8" + "url": "https://www.bing.com/search?q=ip%3A8.8.8.8", + "description": "Bing search operator for finding domains and subdomains hosted on a specific IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find domains on IP using Bing index", + "input": "IP address", + "output": "Domains indexed by Bing on that IP", + "opsec": "passive", + "opsecNote": "Passive search using Bing's public index.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TCP/IP Utils - Domain Neighbors", "type": "url", - "url": "https://dnslytics.com/" + "url": "https://dnslytics.com/", + "description": "Find all domains on the same IP and subdomain information via reverse IP lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Identify related domains on same IP", + "input": "Domain or IP", + "output": "Neighbor domains, IP info", + "opsec": "passive", + "opsecNote": "Passive DNS and IP lookup data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "MyIPNeighbors", "type": "url", - "url": "https://www.my-ip-neighbors.com/" + "url": "https://www.my-ip-neighbors.com/", + "description": "Reverse IP lookup tool for discovering all domains and subdomains on an IP address.", + "status": "live", + "pricing": "free", + "bestFor": "Find all domains on same shared IP", + "input": "IP address", + "output": "List of domains on IP, subdomains", + "opsec": "passive", + "opsecNote": "Passive DNS reverse lookup.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1960,12 +2875,42 @@ { "name": "CloudFlare Watch", "type": "url", - "url": "https://www.crimeflare.com/" + "url": "https://www.crimeflare.com/", + "description": "Tool for identifying and analyzing websites protected by Cloudflare's CDN and security services.", + "status": "live", + "pricing": "free", + "bestFor": "Identify Cloudflare-protected sites", + "input": "Domain or IP", + "output": "Cloudflare status, origin IP (if discoverable)", + "opsec": "passive", + "opsecNote": "Passive lookup of Cloudflare configurations.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CloudFail (T)", "type": "url", - "url": "https://github.com/m0rtem/CloudFail" + "url": "https://github.com/m0rtem/CloudFail", + "description": "Tool for finding origin IPs of Cloudflare-protected websites through enumeration techniques.", + "status": "live", + "pricing": "free", + "bestFor": "Bypass Cloudflare to find origin IP", + "input": "Domain protected by Cloudflare", + "output": "Origin IP address (if discoverable)", + "opsec": "active", + "opsecNote": "Uses active enumeration and DNS history techniques.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1976,12 +2921,42 @@ { "name": "WiGLE: Wireless Network Mapping", "type": "url", - "url": "https://wigle.net/" + "url": "https://wigle.net/", + "description": "Global database of wireless networks (WiFi, Bluetooth, cellular) with mapping and signal strength data.", + "status": "live", + "pricing": "freemium", + "bestFor": "Map wireless networks and find signal coverage", + "input": "Location, SSID, or BSSID", + "output": "Network locations, signal maps, network details", + "opsec": "passive", + "opsecNote": "Crowdsourced wireless network data; passive lookup.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "OpenCellid: Database of Cell Towers", "type": "url", - "url": "https://opencellid.org/" + "url": "https://opencellid.org/", + "description": "Open database of cellular tower locations and coverage for mobile network geolocation.", + "status": "live", + "pricing": "free", + "bestFor": "Find cellular tower locations and coverage", + "input": "Cell tower ID or location", + "output": "Tower coordinates, operator, coverage area", + "opsec": "passive", + "opsecNote": "Passive lookup of public cellular network data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1992,22 +2967,82 @@ { "name": "Wireshark", "type": "url", - "url": "https://www.wireshark.org/download.html" + "url": "https://www.wireshark.org/download.html", + "description": "Open-source network packet analyzer for deep packet inspection and network troubleshooting.", + "status": "live", + "pricing": "free", + "bestFor": "Network packet analysis and protocol debugging", + "input": "Network traffic capture file", + "output": "Detailed packet analysis, protocol breakdown", + "opsec": "Unknown", + "opsecNote": "Tool-dependent; passive capture or active sniffing possible.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NetworkMiner", "type": "url", - "url": "https://www.netresec.com/?page=Networkminer" + "url": "https://www.netresec.com/?page=Networkminer", + "description": "Passive network forensics tool for extracting files and data from network traffic captures.", + "status": "live", + "pricing": "free", + "bestFor": "Network forensics and file extraction from traffic", + "input": "PCAP network traffic files", + "output": "Extracted files, metadata, network sessions", + "opsec": "passive", + "opsecNote": "Passive analysis of already-captured traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Packet Total", "type": "url", - "url": "https://www.packettotal.com/" + "url": "https://www.packettotal.com/", + "description": "Online platform for uploading and analyzing network packet captures (PCAP files).", + "status": "live", + "pricing": "free", + "bestFor": "Cloud-based network forensics analysis", + "input": "PCAP files", + "output": "Traffic analysis, threat indicators, IoCs", + "opsec": "Unknown", + "opsecNote": "Passive analysis of PCAP; consider privacy of uploaded data.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "checkip (T)", "type": "url", - "url": "https://github.com/jreisinger/checkip" + "url": "https://github.com/jreisinger/checkip", + "description": "Command-line utility for checking local machine IP address and network connectivity.", + "status": "live", + "pricing": "free", + "bestFor": "Display local IP and network info", + "input": "Local system (no input needed)", + "output": "Local IP, gateway, DNS servers", + "opsec": "passive", + "opsecNote": "Passive system utility; local only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2018,17 +3053,62 @@ { "name": "Ki.tc", "type": "url", - "url": "https://ki.tc" + "url": "https://ki.tc", + "description": "IP logging service that generates trackable links for IP/browser info collection.", + "status": "live", + "pricing": "free", + "bestFor": "Generate trackable links to log visitor IPs", + "input": "Target URL or destination", + "output": "Tracker link, IP logs, browser info", + "opsec": "Unknown", + "opsecNote": "Creates tracking mechanism; detection depends on how link is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Grabify", "type": "url", - "url": "https://grabify.link" + "url": "https://grabify.link", + "description": "URL shortener service that logs IP addresses and device information of link clickers.", + "status": "live", + "pricing": "free", + "bestFor": "Shorten URLs and log visitor IPs", + "input": "URL to shorten", + "output": "Short URL with IP logging", + "opsec": "Unknown", + "opsecNote": "Creates tracking link; malicious uses common.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "IP Logger", "type": "url", - "url": "https://iplogger.com/" + "url": "https://iplogger.com/", + "description": "IP logging and URL shortening service tracking visitor IP, location, and browser data.", + "status": "live", + "pricing": "free", + "bestFor": "Track visitor IPs through shortened links", + "input": "URL to wrap", + "output": "Logging URL, visitor IP/location data", + "opsec": "Unknown", + "opsecNote": "Tracking service; ethical and legal concerns apply.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -7376,7 +8456,22 @@ { "name": "FireHOL IP Lists ", "type": "url", - "url": "https://iplists.firehol.org/" + "url": "https://iplists.firehol.org/", + "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", + "status": "live", + "pricing": "free", + "bestFor": "Block malicious/spam IP sources", + "input": "IP address or list download", + "output": "Blacklist membership status", + "opsec": "passive", + "opsecNote": "Passive lookup of public IP reputation lists.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Maltiverse", @@ -7909,4 +9004,4 @@ ] } ] -} +} \ No newline at end of file From 6e1fca451e503a1a41f470f344ce63de35c91240 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 02:26:39 -0400 Subject: [PATCH 09/22] Enrich Images/Videos/Docs batch 2 metadata (THE-136) Co-Authored-By: Paperclip --- public/arf.json | 413 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 384 insertions(+), 29 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..c485eae 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2180,27 +2180,102 @@ { "name": "Webstigram", "type": "url", - "url": "https://websta.me/search-engine-optimization/" + "url": "https://websta.me/search-engine-optimization/", + "description": "Legacy Webstagram endpoint historically used for Instagram search workflows; currently not verifiable as a standalone active OSINT tool.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference while migrating to active Instagram tooling", + "input": "Instagram usernames or tags (legacy workflow)", + "output": "Unreliable/limited Instagram lookup results", + "opsec": "unknown", + "opsecNote": "Tool status is unclear and behavior is inconsistent; validate with alternative tools before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Instagram", "type": "url", - "url": "https://www.instagram.com/" + "url": "https://www.instagram.com/", + "description": "Main Instagram platform used for public profile, hashtag, and location OSINT collection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Social profiling and image discovery", + "input": "Usernames, hashtags, locations", + "output": "Profiles, posts, location signals, and network context", + "opsec": "passive", + "opsecNote": "Viewing public content is low-friction, but platform telemetry and account controls still apply.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Mini Instagram", "type": "url", - "url": "https://mininsta.net/" + "url": "https://mini-for-instagram.en.softonic.com/", + "description": "Lightweight Instagram client utility used to simplify media viewing and downloading workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Preserving Instagram media for offline review", + "input": "Instagram profile or post URLs", + "output": "Downloaded Instagram images and videos", + "opsec": "passive", + "opsecNote": "Client-side utility; still follow account and platform ToS constraints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Imgrab", "type": "url", - "url": "https://www.imgrab.com/" + "url": "https://www.imgrab.com/", + "description": "Image download utility family used for saving individual or batch media from web pages.", + "status": "live", + "pricing": "free", + "bestFor": "Batch image capture and archive building", + "input": "Web pages or direct image URLs", + "output": "Downloaded image files", + "opsec": "passive", + "opsecNote": "Primarily local processing; risk profile depends on source websites being queried.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Tofo.me", "type": "url", - "url": "https://tofo.me/" + "url": "https://tofo.me/", + "description": "Legacy Instagram-related endpoint with unclear current functionality and limited verifiable OSINT value.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Unknown", + "output": "Unclear or inconsistent output", + "opsec": "unknown", + "opsecNote": "Service behavior is not reliably documented; prefer validated alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -2211,27 +2286,102 @@ { "name": "Flickr", "type": "url", - "url": "https://www.flickr.com/" + "url": "https://www.flickr.com/", + "description": "Photo hosting platform that often preserves useful image metadata and geotags for OSINT workflows.", + "status": "live", + "pricing": "freemium", + "bestFor": "Image metadata and geolocation investigation", + "input": "Usernames, tags, photo links, map regions", + "output": "Public photos with metadata and account context", + "opsec": "passive", + "opsecNote": "Public browsing is generally low-risk; API and account use may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr Map", "type": "url", - "url": "https://www.flickr.com/map/" + "url": "https://www.flickr.com/map/", + "description": "Flickr map interface for browsing geotagged photos by area and time.", + "status": "live", + "pricing": "free", + "bestFor": "Map-based discovery of geotagged Flickr images", + "input": "Geographic area and map navigation", + "output": "Geotagged photos plotted on interactive map tiles", + "opsec": "passive", + "opsecNote": "Uses public Flickr geotag data; activity remains normal web browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "My Pics Map", "type": "url", - "url": "https://www.mypicsmap.com/" + "url": "https://www.mypicsmap.com/", + "description": "Photo mapping utility reference with unclear present-day availability as a distinct OSINT tool.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference for photo geotag visualization", + "input": "Photo collections with location data", + "output": "Mapped photo points (when service is operational)", + "opsec": "unknown", + "opsecNote": "Current reliability is uncertain; validate output against active mapping alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "idGettr", "type": "url", - "url": "https://www.webfx.com/tools/idgettr/" + "url": "https://www.webfx.com/tools/idgettr/", + "description": "Web utility for resolving Instagram usernames to numeric account IDs.", + "status": "live", + "pricing": "free", + "bestFor": "Converting Instagram handles into numeric IDs for follow-on tooling", + "input": "Instagram username", + "output": "Numeric Instagram user ID", + "opsec": "passive", + "opsecNote": "Lookup is performed through the service; avoid using sensitive operational accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Flickr Hive Mind", "type": "url", - "url": "https://flickrhivemind.net/" + "url": "https://flickrhivemind.net/", + "description": "Advanced Flickr search and data-mining interface for tags, users, text, and date filters.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted Flickr dataset discovery and batch result review", + "input": "Tags, usernames, free text, date constraints", + "output": "Filtered photo result sets and source links", + "opsec": "passive", + "opsecNote": "Queries public Flickr data through a third-party interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2242,77 +2392,282 @@ { "name": "ExifEditor", "type": "url", - "url": "https://exifeditor.io" + "url": "https://exifeditor.io", + "description": "Browser-based EXIF metadata viewer and editor for quick image metadata inspection or sanitization.", + "status": "live", + "pricing": "free", + "bestFor": "Fast EXIF inspection and metadata cleanup in-browser", + "input": "Image files (JPEG/PNG)", + "output": "Displayed EXIF fields and optionally edited image file", + "opsec": "passive", + "opsecNote": "Primarily local browser processing; metadata edits are active data changes.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExifTool (T)", "type": "url", - "url": "https://exiftool.org/" + "url": "https://exiftool.org/", + "description": "Widely used command-line toolkit for reading and writing EXIF, IPTC, XMP, and other metadata formats.", + "status": "live", + "pricing": "free", + "bestFor": "Comprehensive multi-format metadata extraction", + "input": "Image, video, audio, and document files", + "output": "Structured metadata fields and optional file metadata updates", + "opsec": "passive", + "opsecNote": "Read operations are passive; write mode modifies source metadata.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ExifViewer", "type": "url", - "url": "https://www.exifviewer.org/" + "url": "https://www.exifviewer.org/", + "description": "Online EXIF inspection utility for camera, location, and embedded image metadata fields.", + "status": "live", + "pricing": "free", + "bestFor": "Quick EXIF inspection without local CLI tools", + "input": "Image file uploads or image URLs", + "output": "Human-readable EXIF and geolocation data", + "opsec": "passive", + "opsecNote": "Uploads may route through third-party infrastructure depending on deployment.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FOCA (T)", "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" + "url": "https://github.com/ElevenPaths/FOCA", + "description": "Desktop reconnaissance tool that gathers public documents from target domains and extracts embedded metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Corporate document metadata reconnaissance", + "input": "Target domains and document repositories", + "output": "Extracted usernames, paths, software fingerprints, and document metadata", + "opsec": "active", + "opsecNote": "Performs active collection and download actions that may be logged by target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "GeoSetter", "type": "url", - "url": "https://geosetter.de/en/main-en/" + "url": "https://geosetter.de/en/main-en/", + "description": "Windows desktop utility for viewing and editing photo geotags and EXIF/XMP metadata fields in bulk.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk geolocation metadata review and correction", + "input": "Image files with embedded or missing location metadata", + "output": "Updated geotags and metadata-enhanced image sets", + "opsec": "passive", + "opsecNote": "Local tool; editing metadata is an active modification step.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Jeffrey's Exif Viewer", "type": "url", - "url": "https://exif.regex.info/" + "url": "https://regex.info/blog/", + "description": "Formerly popular EXIF web viewer that is now discontinued and kept as historical reference.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Image files (service discontinued)", + "output": "No active EXIF processing available", + "opsec": "unknown", + "opsecNote": "Service is discontinued; use active alternatives for operational work.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "JPEGsnoop (T)", "type": "url", - "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" + "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html", + "description": "Windows forensic utility for deep JPEG structure analysis, recompression detection, and authenticity clues.", + "status": "live", + "pricing": "free", + "bestFor": "JPEG forensic analysis and tamper signal detection", + "input": "JPEG and supported media/document files", + "output": "Compression signatures, structure details, and edit indicators", + "opsec": "passive", + "opsecNote": "Local forensic analysis with no inherent outbound activity.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Metapicz", "type": "url", - "url": "https://metapicz.com/#landing" + "url": "https://metapicz.com/#landing", + "description": "Online EXIF parser historically used for quick camera and location metadata reads, now showing signs of limited maintenance.", + "status": "degraded", + "pricing": "free", + "bestFor": "Legacy metadata checks when primary tools are unavailable", + "input": "Image files", + "output": "Formatted EXIF metadata when service is functioning", + "opsec": "passive", + "opsecNote": "Reliability appears inconsistent; verify findings with maintained alternatives.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Search by Exif", "type": "url", - "url": "https://www.exif-search.com/" + "url": "https://exif.osint-tool.com", + "description": "Web EXIF inspection tool focused on extracting metadata and GPS clues from supplied images.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid EXIF and geolocation extraction", + "input": "Image files", + "output": "EXIF metadata with location-relevant fields", + "opsec": "passive", + "opsecNote": "Web-hosted processing can expose uploads to third-party infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xeuledoc - Fetch metadata about any public Google document", "type": "url", - "url": "https://github.com/Malfrats/xeuledoc" - }, - { - "name": "FOCA (T)", - "type": "url", - "url": "https://github.com/ElevenPaths/FOCA" + "url": "https://github.com/Malfrats/xeuledoc", + "description": "Python tool that extracts metadata from public Google Docs, Sheets, and Slides links.", + "status": "live", + "pricing": "free", + "bestFor": "Google document attribution and metadata extraction", + "input": "Public Google document URLs", + "output": "Owner identifiers, account metadata, and document context", + "opsec": "passive", + "opsecNote": "Reads only public docs without authentication bypass, but still queries Google infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Exiv2 (T)", "type": "url", - "url": "https://exiv2.org/" + "url": "https://exiv2.org/", + "description": "Cross-platform library and CLI for reading and modifying EXIF, IPTC, XMP, and ICC metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Programmatic metadata parsing and editing pipelines", + "input": "Image files with embedded metadata", + "output": "Metadata dumps and optional metadata writes", + "opsec": "passive", + "opsecNote": "Read operations are passive; write actions alter evidence files.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "MediaInfo (T)", "type": "url", - "url": "https://mediaarea.net/en/MediaInfo" + "url": "https://mediaarea.net/en/MediaInfo", + "description": "Cross-platform utility for extracting technical metadata from video and audio media files.", + "status": "live", + "pricing": "free", + "bestFor": "Media codec and container metadata profiling", + "input": "Video and audio files", + "output": "Codec, bitrate, duration, stream, and tag metadata", + "opsec": "passive", + "opsecNote": "Local analysis utility with no required outbound collection.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Apache Tika (T)", "type": "url", - "url": "https://tika.apache.org/" + "url": "https://tika.apache.org/", + "description": "Apache content analysis framework for extracting metadata and text across a very broad set of file formats.", + "status": "live", + "pricing": "free", + "bestFor": "Scalable metadata extraction across heterogeneous document sets", + "input": "Documents, archives, media, and structured file types", + "output": "Normalized metadata fields and extracted text content", + "opsec": "passive", + "opsecNote": "Operational exposure depends on deployment mode (local vs server-based processing).", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "oletools (T)", "type": "url", - "url": "https://github.com/decalage2/oletools" + "url": "https://github.com/decalage2/oletools", + "description": "Python toolkit for analyzing OLE and Office documents, including macro extraction and suspicious object detection.", + "status": "live", + "pricing": "free", + "bestFor": "Office document security triage and embedded code inspection", + "input": "OLE/OOXML/RTF Office documents", + "output": "Macro code, suspicious indicators, embedded object details, and metadata", + "opsec": "active", + "opsecNote": "Malicious samples can trigger security tooling; run analysis in isolated environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Hachoir (T)", From 6466eb0f92018697be1d265666633d6e1ab8daef Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 02:30:43 -0400 Subject: [PATCH 10/22] Enrich What Font Is tool with OSINT metadata (THE-139) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Populated enrichment fields for What Font Is: - description: AI-powered font identification tool - status: live - pricing: freemium (free tier with ads + paid PRO) - bestFor: Identifying fonts from screenshots/images - input/output: Image upload → font matches with links - opsec: passive (uploads to remote servers) - Features: API available, no registration required (optional) Co-Authored-By: Paperclip --- public/arf.json | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/public/arf.json b/public/arf.json index c485eae..1c82ef3 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2996,7 +2996,22 @@ { "name": "What Font Is", "type": "url", - "url": "https://www.whatfontis.com/" + "url": "https://www.whatfontis.com/", + "description": "AI-powered font identification tool that analyzes images against a database of 1.2M+ typefaces to identify fonts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identifying fonts from screenshots and images", + "input": "Image files containing text (uploaded via drag-and-drop or file picker)", + "output": "Font matches with design details, download links, and up to 60+ similar alternatives", + "opsec": "passive", + "opsecNote": "Uploads images to remote servers; consider OPSEC implications for sensitive screenshots or documents.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } From 7a3103207564709d0f61a5f7a03b2466a849412e Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 04:12:48 -0400 Subject: [PATCH 11/22] Enrich Encoding / Decoding tools metadata (THE-163) Co-Authored-By: Paperclip --- public/arf.json | 306 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 288 insertions(+), 18 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..a804a53 100644 --- a/public/arf.json +++ b/public/arf.json @@ -6386,7 +6386,22 @@ { "name": "ClearImage Barcode Reader", "type": "url", - "url": "https://online-barcode-reader.inliteresearch.com/" + "url": "https://online-barcode-reader.inliteresearch.com/", + "description": "Web-based barcode and QR code recognition tool using Inlite Research ClearImage technology for common image and document formats.", + "status": "live", + "pricing": "free", + "bestFor": "Barcode and QR code decoding from uploaded files", + "input": "Image files and PDFs containing barcode or QR symbols", + "output": "Decoded barcode and QR payload values", + "opsec": "active", + "opsecNote": "Uploaded files are processed by a third-party web service and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6397,32 +6412,122 @@ { "name": "JS Beautifier", "type": "url", - "url": "https://beautifier.io/" + "url": "https://beautifier.io/", + "description": "Open-source JavaScript formatter that rewrites minified or obfuscated code into readable, consistently indented source.", + "status": "live", + "pricing": "free", + "bestFor": "Fast readability improvements for packed JavaScript", + "input": "Minified or obfuscated JavaScript source text", + "output": "Formatted JavaScript with normalized structure and spacing", + "opsec": "passive", + "opsecNote": "Typical use is low-risk code formatting through a public web interface.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "JS NICE", "type": "url", - "url": "https://jsnice.org/" + "url": "https://jsnice.org/", + "description": "Legacy JavaScript reverse-engineering service that previously improved variable names and recovered structure from minified code.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference for JavaScript decompilation workflows", + "input": "Obfuscated or minified JavaScript code", + "output": "No current output because the public service is unavailable", + "opsec": "Unknown", + "opsecNote": "Service is currently unreachable and should be treated as defunct until replaced.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Firebug (T)", "type": "url", - "url": "https://getfirebug.com/downloads/" + "url": "https://getfirebug.com/downloads/", + "description": "Former Firefox debugging extension that has been retired, with core functionality absorbed into modern Firefox Developer Tools.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical context for legacy JavaScript debugging references", + "input": "Legacy Firefox extension workflows and old debugging material", + "output": "Archived documentation and obsolete download artifacts", + "opsec": "Unknown", + "opsecNote": "Tool is unmaintained and not suitable for active investigative workflows.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SpiderMonkey (T)", "type": "url", - "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey" + "url": "https://developer.mozilla.org/en-US/docs/Mozilla/Projects/SpiderMonkey", + "description": "Mozilla JavaScript engine used by Firefox and available for standalone execution and analysis in local environments.", + "status": "live", + "pricing": "free", + "bestFor": "Local JavaScript execution and behavior testing without browser UI", + "input": "JavaScript source code", + "output": "Execution results, runtime behavior, and script output", + "opsec": "passive", + "opsecNote": "Runs locally and avoids sending samples to third-party analysis services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kahu Revelo (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows-focused JavaScript deobfuscation utility that executes scripts in a controlled environment to reveal hidden logic.", + "status": "live", + "pricing": "free", + "bestFor": "Unpacking heavily obfuscated JavaScript samples on Windows", + "input": "Obfuscated JavaScript files or script text", + "output": "Deobfuscated code and decoded runtime content", + "opsec": "active", + "opsecNote": "Tool executes suspect code paths, so sandbox or VM isolation is recommended.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "JavaScript Deobfuscator (T)", "type": "url", - "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/" + "url": "https://addons.mozilla.org/en-US/firefox/addon/javascript-deobfuscator/", + "description": "Firefox add-on for inspecting and deobfuscating JavaScript in-browser during page analysis and script review.", + "status": "live", + "pricing": "free", + "bestFor": "Browser-native JavaScript deobfuscation during web investigations", + "input": "JavaScript loaded in Firefox pages or pasted script content", + "output": "Readable deobfuscated script output in browser tooling", + "opsec": "active", + "opsecNote": "Browser execution context can run page scripts and trackers while analyzing content.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6433,7 +6538,22 @@ { "name": "DDecode - PHP Decoder", "type": "url", - "url": "https://ddecode.com/phpdecoder/" + "url": "https://ddecode.com/phpdecoder/", + "description": "Online decoder for layered PHP obfuscation chains such as eval, base64, gzinflate, and related encoding wrappers.", + "status": "live", + "pricing": "free", + "bestFor": "Rapid decoding of obfuscated PHP webshell and malware snippets", + "input": "Encoded or obfuscated PHP code", + "output": "Decoded and expanded PHP source text", + "opsec": "active", + "opsecNote": "Submitted samples are processed by a third-party server, so sensitive code should be sanitized first.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6448,17 +6568,62 @@ { "name": "XORSearch & XORStrings (T)", "type": "url", - "url": "https://blog.didierstevens.com/programs/xorsearch/" + "url": "https://blog.didierstevens.com/programs/xorsearch/", + "description": "Didier Stevens command-line utilities for locating XOR, ROL, ROT, and SHIFT-encoded strings in suspicious binaries.", + "status": "live", + "pricing": "free", + "bestFor": "String extraction and key hunting in encoded malware payloads", + "input": "Binary files and encoded byte streams", + "output": "Decoded candidate strings across transformation and key ranges", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems and does not require online submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "xortool (T)", "type": "url", - "url": "https://github.com/hellman/xortool" + "url": "https://github.com/hellman/xortool", + "description": "Python-based XOR analysis tool that estimates key lengths and recovers likely multi-byte keys via frequency analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering repeating XOR keys from encoded files", + "input": "XOR-encrypted text or binary data", + "output": "Likely XOR keys and candidate decrypted output", + "opsec": "passive", + "opsecNote": "Pure local processing with no required external service calls.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "unxor (T)", "type": "url", - "url": "https://github.com/tomchop/unxor" + "url": "https://github.com/tomchop/unxor", + "description": "Known-plaintext XOR analysis utility for deriving keystreams and recovering original content from encoded samples.", + "status": "live", + "pricing": "free", + "bestFor": "Known-plaintext XOR cracking against malware and encoded artifacts", + "input": "XOR-encoded file plus known plaintext fragments", + "output": "Recovered keystream segments and decoded content", + "opsec": "passive", + "opsecNote": "Local command-line analysis avoids submitting artifacts to remote services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6469,7 +6634,22 @@ { "name": "Kahu Converter Utilities (T)", "type": "url", - "url": "https://www.kahusecurity.com/tools/" + "url": "https://www.kahusecurity.com/tools/", + "description": "Windows utility collection for format conversion, hex/binary transforms, and XOR-related decoding workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Mixed conversion and XOR utility operations on Windows", + "input": "Binary blobs, hex strings, and text samples", + "output": "Converted data and decoded intermediate representations", + "opsec": "passive", + "opsecNote": "Runs locally on analyst systems without mandatory cloud processing.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -6480,22 +6660,82 @@ { "name": "iheartxor.py (T)", "type": "url", - "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html" + "url": "https://hooked-on-mnemonics.blogspot.com/p/iheartxor.html", + "description": "Python script for brute-forcing XOR-obfuscated strings within defined boundaries to reveal hidden text in malware samples.", + "status": "live", + "pricing": "free", + "bestFor": "Targeted extraction of XOR-obfuscated strings from binaries", + "input": "Binary data, dumps, or encoded string segments", + "output": "Recovered candidate strings and associated key bytes", + "opsec": "passive", + "opsecNote": "Offline local script execution keeps sample handling under analyst control.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "XORBruteForcer.py (T)", "type": "url", - "url": "https://eternal-todo.com/var/scripts/xorbruteforcer" + "url": "https://github.com/jesparza/scripts/blob/master/xorBruteForcer.py", + "description": "Single-byte XOR brute-force Python script that iterates candidate key values and surfaces matching decoded output.", + "status": "live", + "pricing": "free", + "bestFor": "Single-byte XOR key brute-forcing and quick validation", + "input": "Encoded file or byte sequence", + "output": "Decoded candidates mapped to tested XOR key values", + "opsec": "passive", + "opsecNote": "Local script analysis avoids artifact upload and minimizes external exposure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "NoMoreXOR.py (T)", "type": "url", - "url": "https://github.com/hiddenillusion/NoMoreXOR" + "url": "https://github.com/hiddenillusion/NoMoreXOR", + "description": "Python utility for recovering long XOR keys using character frequency heuristics and YARA-assisted pattern matching.", + "status": "live", + "pricing": "free", + "bestFor": "Recovering long XOR keys in malware binaries", + "input": "Malware sample or obfuscated binary content", + "output": "Likely keys, decoded streams, and extraction hints", + "opsec": "passive", + "opsecNote": "Operates locally and is suitable for isolated malware analysis environments.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Balbuzard (T)", "type": "url", - "url": "https://bitbucket.org/decalage/balbuzard" + "url": "https://github.com/decalage2/balbuzard", + "description": "Python malware analysis toolkit that extracts indicators and brute-forces common obfuscation patterns including XOR and rotation transforms.", + "status": "live", + "pricing": "free", + "bestFor": "Automated deobfuscation and indicator extraction from suspicious files", + "input": "Suspicious binaries and encoded artifact files", + "output": "Decoded content, extracted IoCs, and pattern-analysis results", + "opsec": "passive", + "opsecNote": "Local toolkit execution supports controlled analysis without remote sample submission.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -6504,12 +6744,42 @@ { "name": "CyberChef", "type": "url", - "url": "https://gchq.github.io/CyberChef/" + "url": "https://gchq.github.io/CyberChef/", + "description": "GCHQ-maintained browser workbench for chained encoding, decoding, hashing, crypto, and data transformation operations.", + "status": "live", + "pricing": "free", + "bestFor": "Building and replaying multi-step decode and transform recipes", + "input": "Text, binary, hex, Base64, and structured payloads", + "output": "Transformed output for each selected operation chain", + "opsec": "passive", + "opsecNote": "Public web app use is convenient, but locally hosted builds are preferred for sensitive data.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Functions Online", "type": "url", - "url": "https://www.functions-online.com/" + "url": "https://www.functions-online.com/", + "description": "PHP-oriented online utility suite for common encoding, decoding, hashing, and string-manipulation function tests.", + "status": "live", + "pricing": "free", + "bestFor": "Quick PHP-specific encoding and decoding checks in browser", + "input": "Function parameters and data strings for selected PHP routines", + "output": "Computed function results and transformed data values", + "opsec": "active", + "opsecNote": "Data is processed server-side, so avoid submitting sensitive payloads directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, From dff616f8c43d0644cd76a8844e270f3fe4b0dd1a Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 04:16:36 -0400 Subject: [PATCH 12/22] Enrich Online Communities metadata (THE-155) Co-Authored-By: Paperclip --- public/arf.json | 289 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 272 insertions(+), 17 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..194328f 100644 --- a/public/arf.json +++ b/public/arf.json @@ -5227,12 +5227,42 @@ { "name": "Live Journal Seek", "type": "url", - "url": "https://ljseek.com/" + "url": "https://ljseek.com/", + "description": "Search tool for LiveJournal journals and communities across public entries that are indexed.", + "status": "live", + "pricing": "free", + "bestFor": "Finding public LiveJournal entries and historical community discussions", + "input": "Keywords and search terms", + "output": "Matching journal entries with author, date, and snippets", + "opsec": "passive", + "opsecNote": "Searches publicly indexed content and does not contact journal owners directly; queries are likely logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Blog Search Engine", "type": "url", - "url": "https://www.blogsearchengine.org/" + "url": "https://www.blogsearchengine.org/", + "description": "Blog-focused search engine for discovering blog posts, directories, and RSS-connected content.", + "status": "live", + "pricing": "free", + "bestFor": "Blog discovery and topic-focused blog post searching", + "input": "Keywords and blog topics", + "output": "Matching blog posts, listings, and feed-linked results", + "opsec": "passive", + "opsecNote": "Aggregates publicly indexed blog data without direct user contact to target blogs; queries are logged.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5243,17 +5273,62 @@ { "name": "Discord Bot List", "type": "url", - "url": "https://discord.bots.gg/" + "url": "https://discord.bots.gg/", + "description": "Searchable directory of Discord bots with listings, categories, and discovery metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot discovery and ecosystem mapping", + "input": "Bot names, keywords, and categories", + "output": "Bot profiles with descriptions, ratings, and invite metadata", + "opsec": "passive", + "opsecNote": "Enumerates publicly listed bots and does not require direct Discord account interaction for browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "ReconXplorer (T)", "type": "url", - "url": "https://github.com/root7am/ReconXplorer" + "url": "https://github.com/root7am/ReconXplorer", + "description": "Open-source reconnaissance toolkit with modules for IP, email, and Discord-focused lookups.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-input OSINT checks from a local scriptable toolkit", + "input": "IP addresses, emails, Discord tokens, and host data", + "output": "Recon results including geolocation, service, and account-related metadata", + "opsec": "active", + "opsecNote": "Runs direct external queries from the operator environment and may trigger service-side detection or logging.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Top.gg", "type": "url", - "url": "https://top.gg/" + "url": "https://top.gg/", + "description": "Large Discord bot and app discovery platform with ranking, filtering, and listing data.", + "status": "live", + "pricing": "free", + "bestFor": "Discord bot ranking analysis and app discovery", + "input": "Bot names, tags, and search filters", + "output": "Bot listings with popularity, server counts, and profile details", + "opsec": "passive", + "opsecNote": "Uses public listing data and does not require direct target interaction for standard browsing.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5264,27 +5339,102 @@ { "name": "BoardReader", "type": "url", - "url": "https://boardreader.com/" + "url": "https://boardreader.com/", + "description": "Forum search engine that indexes discussions across message boards and community platforms.", + "status": "live", + "pricing": "free", + "bestFor": "Finding forum threads and topic-centric discussion history", + "input": "Keywords, forum names, and topical queries", + "output": "Indexed posts and thread references with source links", + "opsec": "passive", + "opsecNote": "Searches indexed forum content and avoids direct interaction with target forum users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Omgili", "type": "url", - "url": "https://webz.io/" + "url": "https://webz.io/", + "description": "Forum and discussion search capability operated through Webz.io infrastructure and data products.", + "status": "live", + "pricing": "freemium", + "bestFor": "Forum discussion discovery with optional API-driven workflows", + "input": "Keywords and Boolean-style forum queries", + "output": "Discussion posts and thread-level matching results", + "opsec": "passive", + "opsecNote": "Uses indexed discussion datasets from a third-party provider; user-side browsing is passive.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Craigslist Forums", "type": "url", - "url": "https://forums.craigslist.org/" + "url": "https://forums.craigslist.org/", + "description": "Craigslist-hosted forum system for public community discussions and region-oriented threads.", + "status": "live", + "pricing": "free", + "bestFor": "Reviewing Craigslist community discussions and regional forum activity", + "input": "Forum categories, keywords, and regional navigation", + "output": "Forum threads, post content, and timing context", + "opsec": "passive", + "opsecNote": "Reads publicly visible forum content and does not require direct messaging or contact with users.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Delphi Forum Search", "type": "url", - "url": "https://www.delphiforums.com/" + "url": "https://www.delphiforums.com/", + "description": "Forum platform with searchable user communities across niche interest categories.", + "status": "live", + "pricing": "freemium", + "bestFor": "Niche forum discovery and historical community thread review", + "input": "Forum names, categories, and keywords", + "output": "Forum listings, thread titles, and message pages", + "opsec": "passive", + "opsecNote": "Public forum browsing is passive; some communities may require registration for deeper access.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Groups Search", "type": "url", - "url": "https://groups.google.com/forum/#!overview" + "url": "https://groups.google.com/forum/#!overview", + "description": "Search interface for Google Groups and archived discussion content, including historical threads.", + "status": "live", + "pricing": "free", + "bestFor": "Researching archived mailing-list and discussion-group content", + "input": "Keywords, group names, authors, and date ranges", + "output": "Thread messages and group-level discussion results", + "opsec": "passive", + "opsecNote": "Searches archived public discussions through Google-hosted infrastructure where activity is logged.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5295,22 +5445,82 @@ { "name": "Mibbit", "type": "url", - "url": "https://search.mibbit.com/" + "url": "https://search.mibbit.com/", + "description": "Former web IRC client and channel search service that is no longer operational.", + "status": "down", + "pricing": "free", + "bestFor": "Legacy reference for historical IRC channel search workflows", + "input": "Channel or keyword queries (historical behavior)", + "output": "No current output; service is discontinued", + "opsec": "Unknown", + "opsecNote": "Service shut down on August 30, 2024 and cannot be relied on for active workflows.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "IRCP (T)", "type": "url", - "url": "https://github.com/internet-relay-chat/IRCP" + "url": "https://github.com/internet-relay-chat/IRCP", + "description": "Python-based IRC probing utility for scanning servers and collecting network/channel metadata.", + "status": "live", + "pricing": "free", + "bestFor": "IRC server enumeration and protocol-level reconnaissance", + "input": "Target ranges, IRC ports, and server parameters", + "output": "Server and channel metadata in machine-readable output", + "opsec": "active", + "opsecNote": "Actively connects to IRC services and may be detectable by network monitoring and server logs.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ircsnapshot (T)", "type": "url", - "url": "https://github.com/bwall/ircsnapshot" + "url": "https://github.com/bwall/ircsnapshot", + "description": "IRC data collection tool that connects bots to servers for user and channel mapping.", + "status": "live", + "pricing": "free", + "bestFor": "IRC topology mapping and user/channel relationship analysis", + "input": "IRC server details, bot config, and channel targets", + "output": "Collected user, hostmask, and channel affiliation data", + "opsec": "active", + "opsecNote": "Requires active network participation via bot accounts and is likely visible to channel operators.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "netsplit.de", "type": "url", - "url": "https://netsplit.de/channels/search.php" + "url": "https://netsplit.de/channels/search.php", + "description": "IRC directory and search portal for channel listings, network stats, and discovery workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Passive IRC channel discovery and network trend checks", + "input": "Channel names, keywords, and network filters", + "output": "Channel listings with network and user-count context", + "opsec": "passive", + "opsecNote": "Uses aggregated indexed IRC data and does not require direct IRC server interaction for searches.", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -5321,17 +5531,62 @@ { "name": "Arctic Shift", "type": "url", - "url": "https://arctic-shift.photon-reddit.com/" + "url": "https://arctic-shift.photon-reddit.com/", + "description": "Search and access layer for Reddit datasets with tools for historical content retrieval and analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Historical Reddit dataset analysis and subreddit research", + "input": "Search terms, dataset queries, or API-style requests", + "output": "Matching Reddit posts, comments, and metadata from indexed datasets", + "opsec": "passive", + "opsecNote": "Works against archived or indexed data sources without requiring direct engagement with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Cama's Reddit Search", "type": "url", - "url": "https://camas.github.io/reddit-search/" + "url": "https://camas.github.io/reddit-search/", + "description": "Web tool for searching Reddit posts and comments by author, subreddit, text, and time filters.", + "status": "live", + "pricing": "free", + "bestFor": "Reddit user and subreddit content discovery", + "input": "Usernames, subreddits, keywords, and date constraints", + "output": "Filtered post/comment search results with metadata", + "opsec": "passive", + "opsecNote": "Uses public data indexing paths; original GitHub hosting was discontinued but alternative hosting remains available.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reveddit", "type": "url", - "url": "https://www.reveddit.com/" + "url": "https://www.reveddit.com/", + "description": "Interface for viewing Reddit content removals using archived and moderation-related visibility signals.", + "status": "live", + "pricing": "free", + "bestFor": "Investigating deleted or removed Reddit discussions", + "input": "Reddit URLs, usernames, or subreddit paths", + "output": "Recovered or flagged removed-content views with moderation indicators", + "opsec": "passive", + "opsecNote": "Queries archive-backed sources and public content pathways without direct contact to target users.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } From 6cd1ee6ef36580b61610d4c962189f405ae13c4d Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 09:22:25 -0400 Subject: [PATCH 13/22] Add disposable email domain detection tools to Email Verification (THE-33) Add 3 community-maintained disposable email blocklists to Email Address > Email Verification: - Disposable Email Domains (GitHub) - 5000+ domain blocklist used by PyPI - Disposable Emails Registry - searchable registry with bulk download - Burner Email Providers - curated list with multi-language integrations Excludes WhoisXML API (premium/paid service) per board guidance. Co-Authored-By: Paperclip --- public/arf.json | 60 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) diff --git a/public/arf.json b/public/arf.json index b8b4568..2184507 100644 --- a/public/arf.json +++ b/public/arf.json @@ -504,6 +504,66 @@ "name": "VerifyEmail (R$)", "type": "url", "url": "https://emailable.com/" + }, + { + "name": "Disposable Email Domains (T)", + "type": "url", + "url": "https://github.com/disposable-email-domains/disposable-email-domains", + "description": "Community-maintained blocklist of 5,000+ disposable email domains with allowlist support and multi-language implementation examples. Used by PyPI and other projects.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting disposable and temporary email addresses during verification", + "input": "Domain name to check against the blocklist", + "output": "Match result against the disposable email domain blocklist", + "opsec": "passive", + "opsecNote": "Local list comparison; no external requests made during lookup.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Disposable Emails Registry", + "type": "url", + "url": "https://disposable-emails.github.io/", + "description": "Searchable registry of disposable email domains with bulk download support for threat intelligence integration.", + "status": "live", + "pricing": "free", + "bestFor": "Bulk blocking and threat intelligence integration for disposable email detection", + "input": "Domain name or bulk list download", + "output": "Match result or full disposable domain list (/list.txt)", + "opsec": "passive", + "opsecNote": "Static list download; community-sourced submissions, no external lookups required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, + { + "name": "Burner Email Providers (T)", + "type": "url", + "url": "https://github.com/wesbos/burner-email-providers", + "description": "Curated list of temporary email service domains with API references and detection library implementations across multiple languages.", + "status": "live", + "pricing": "free", + "bestFor": "Identifying burner email providers for integration into custom investigation tools", + "input": "Email domain", + "output": "Match result against known burner/temporary email providers", + "opsec": "passive", + "opsecNote": "Local list comparison; MIT licensed for integration use.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, From a2e25099bf14d021ae3e524eb2a0d0e48eecfefa Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 09:57:27 -0400 Subject: [PATCH 14/22] Populate Domain Name enrichment fields for batch 2 (THE-128) Co-Authored-By: Paperclip --- public/arf.json | 402 +++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 366 insertions(+), 36 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..242d038 100644 --- a/public/arf.json +++ b/public/arf.json @@ -718,35 +718,95 @@ { "name": "Gobuster (T)", "type": "url", - "url": "https://github.com/OJ/gobuster" + "url": "https://github.com/OJ/gobuster", + "description": "Multi-mode brute-force tool for DNS subdomain, virtual host, and directory discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Fast DNS and vhost brute-force enumeration", + "input": "Domain, wordlist, and optional resolver/thread settings", + "output": "Discovered subdomains, vhosts, or directories with response details", + "opsec": "active", + "opsecNote": "Sends direct DNS/HTTP probes and can generate noisy traffic patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Fierce Domain Scanner (T)", "type": "url", - "url": "https://github.com/davidpepper/fierce-domain-scanner" + "url": "https://github.com/davidpepper/fierce-domain-scanner", + "description": "DNS reconnaissance tool focused on subdomain discovery and non-contiguous IP space mapping.", + "status": "live", + "pricing": "free", + "bestFor": "DNS recon and subdomain-to-IP mapping", + "input": "Domain, DNS server options, and optional wordlist/range parameters", + "output": "Subdomains, resolved IPs, and DNS reconnaissance findings", + "opsec": "active", + "opsecNote": "Performs direct DNS lookups and optional scans that can be logged by infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bluto (T)", "type": "url", - "url": "https://github.com/darryllane/Bluto" + "url": "https://github.com/darryllane/Bluto", + "description": "Recon utility for domain intelligence including DNS records, email patterns, and infrastructure clues.", + "status": "live", + "pricing": "free", + "bestFor": "Initial domain footprinting and asset discovery", + "input": "Target domain and optional scan switches", + "output": "Aggregated recon output including DNS and related domain artifacts", + "opsec": "active", + "opsecNote": "Runs active lookups against target-related infrastructure and third-party services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "OWASP Maryam (T)", "type": "url", - "url": "https://github.com/saeeddhqan/Maryam" + "url": "https://github.com/saeeddhqan/Maryam", + "description": "Modular OWASP OSINT framework with footprinting and search modules for multi-source reconnaissance.", + "status": "live", + "pricing": "free", + "bestFor": "Scriptable multi-module OSINT reconnaissance workflows", + "input": "Domain, IP, email, username, or module-specific query terms", + "output": "Module-based findings such as subdomains, metadata, and related intelligence", + "opsec": "active", + "opsecNote": "Can issue direct queries and module-driven probes depending on selected workflow.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", - "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", + "description": "Command-line tool for harvesting emails, subdomains, hosts, and URLs from public data sources.", "status": "live", "pricing": "free", - "bestFor": "Email harvesting, subdomain enumeration, passive recon", - "input": "Domain name", - "output": "Email addresses, subdomains, IPs, URLs", + "bestFor": "Passive email and subdomain collection from indexed sources", + "input": "Domain and selected data source(s)", + "output": "Email addresses, subdomains, hostnames, IPs, and related metadata", "opsec": "passive", - "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", + "opsecNote": "Queries third-party sources instead of directly interacting with the target host.", "localInstall": true, "googleDork": false, "registration": false, @@ -758,37 +818,142 @@ { "name": "Pentest-tools.com Subdomains", "type": "url", - "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" + "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain", + "description": "Web-based subdomain finder that enumerates subdomains for a given domain through hosted scanning.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick browser-based subdomain discovery without local setup", + "input": "Domain name", + "output": "List of discovered subdomains and related DNS intelligence", + "opsec": "passive", + "opsecNote": "Scanning is performed by Pentest-Tools infrastructure, not directly from your host.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SecLists DNS Subdomains (T)", "type": "url", - "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" + "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS", + "description": "Community-maintained DNS wordlist collection used to power subdomain brute-force workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Supplying high-quality DNS wordlists for enumeration tools", + "input": "Domain and chosen wordlist file used in external tooling", + "output": "Wordlist candidates for subdomain brute-force and permutation attacks", + "opsec": "passive", + "opsecNote": "Repository itself is passive; OPSEC impact depends on how the lists are used.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "dnspop (T)", "type": "url", - "url": "https://github.com/bitquark/dnspop" + "url": "https://github.com/bitquark/dnspop", + "description": "DNS reconnaissance utility for enumerating records and identifying domain-related infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Command-line DNS recon and record analysis", + "input": "Domain and optional scan parameters", + "output": "DNS records, discovered hosts, and recon findings", + "opsec": "active", + "opsecNote": "Performs direct DNS queries against resolvers and target-associated records.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "gdns (T)", "type": "url", - "url": "https://github.com/hrbrmstr/gdns" + "url": "https://github.com/hrbrmstr/gdns", + "description": "Google DNS-focused command-line tool for DNS lookup and domain record exploration.", + "status": "live", + "pricing": "free", + "bestFor": "Quick DNS enumeration via Google DNS services", + "input": "Domain and query options", + "output": "Resolved DNS records and related lookup results", + "opsec": "active", + "opsecNote": "Issues active DNS lookup requests that may be observable at resolver level.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sublist3r", "type": "url", - "url": "https://github.com/aboul3la/Sublist3r" + "url": "https://github.com/aboul3la/Sublist3r", + "description": "Python tool for subdomain enumeration using search engines, passive sources, and optional brute-force.", + "status": "live", + "pricing": "free", + "bestFor": "Combining passive and active subdomain discovery in one tool", + "input": "Domain and optional brute-force/thread settings", + "output": "Consolidated list of discovered subdomains", + "opsec": "active", + "opsecNote": "Uses multiple external sources and optional brute-force that can generate detectable traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "AltDNS (T)", "type": "url", - "url": "https://github.com/infosec-au/altdns" + "url": "https://github.com/infosec-au/altdns", + "description": "Permutation-based DNS tool that generates and resolves alternative subdomains from known names.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering likely subdomain variants through permutations", + "input": "Known subdomains, wordlist, and target domain", + "output": "Resolved alternative subdomains and permutation results", + "opsec": "active", + "opsecNote": "Performs direct DNS resolution on generated permutations, creating active query footprints.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/domains/" + "url": "https://app.netlas.io/domains/", + "description": "Search platform for internet-exposed assets, domains, certificates, and web technologies.", + "status": "live", + "pricing": "freemium", + "bestFor": "Passive domain and infrastructure intelligence from indexed data", + "input": "Domain, IP, certificate fingerprint, or search query syntax", + "output": "Indexed assets, service metadata, certificates, and historical records", + "opsec": "passive", + "opsecNote": "Queries Netlas indexed datasets instead of scanning targets directly from your host.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -800,14 +965,14 @@ "name": "Shodan", "type": "url", "url": "https://www.shodan.io/", - "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", + "description": "Search engine for internet-exposed devices, services, and security-relevant banners.", "status": "live", "pricing": "freemium", - "bestFor": "Port scanning, banner grabbing, IoT discovery", - "input": "IP address, domain", - "output": "Open ports, services, banners, CVEs", + "bestFor": "Finding exposed services and infrastructure risk indicators", + "input": "IP, domain, ASN, organization, or filter-based search query", + "output": "Service banners, open ports, geolocation, vulnerabilities, and host metadata", "opsec": "passive", - "opsecNote": "Queries cached scan data. Does not directly probe the target.", + "opsecNote": "Uses Shodan indexed scan data; target systems are not probed from your local host.", "localInstall": false, "googleDork": false, "registration": true, @@ -819,50 +984,155 @@ { "name": "Netlas.io", "type": "url", - "url": "https://app.netlas.io/" + "url": "https://app.netlas.io/", + "description": "Search platform for internet-exposed assets, domains, certificates, and web technologies.", + "status": "live", + "pricing": "freemium", + "bestFor": "Passive domain and infrastructure intelligence from indexed data", + "input": "Domain, IP, certificate fingerprint, or search query syntax", + "output": "Indexed assets, service metadata, certificates, and historical records", + "opsec": "passive", + "opsecNote": "Queries Netlas indexed datasets instead of scanning targets directly from your host.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Kraken (T)", "type": "url", - "url": "https://github.com/Sw4mpf0x/Kraken" + "url": "https://github.com/Sw4mpf0x/Kraken", + "description": "Open-source reconnaissance utility for domain and network intelligence gathering workflows.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-driven reconnaissance against domain and host assets", + "input": "Domain, host, or target parameters supported by selected module", + "output": "Recon findings across DNS, host intelligence, and related artifacts", + "opsec": "active", + "opsecNote": "Runs active collection modules that can generate requests visible to target infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted web interface for Nikto-based web server misconfiguration and vulnerability checks.", + "status": "live", + "pricing": "free", + "bestFor": "Quick remote Nikto scans from a browser", + "input": "Target URL or host", + "output": "Nikto-style findings on server headers, files, and common web weaknesses", + "opsec": "active", + "opsecNote": "Performs active vulnerability probing against the target web server.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "urlscan.io", "type": "url", - "url": "https://urlscan.io/search/#*" + "url": "https://urlscan.io/search/#*", + "description": "URL and domain analysis service that captures page loads, requests, and security-relevant artifacts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Investigating suspicious URLs with scan snapshots and indicators", + "input": "URL or domain", + "output": "Scan reports including redirects, requests, domains, IPs, and screenshots", + "opsec": "passive", + "opsecNote": "Analysis runs on urlscan infrastructure; target contact is performed from their scanners.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", - "url": "https://dailychanges.domaintools.com/" + "url": "https://dailychanges.domaintools.com/", + "description": "DomainTools feed that tracks daily DNS record changes and newly observed domain configurations.", + "status": "live", + "pricing": "free", + "bestFor": "Monitoring DNS change activity and domain churn patterns", + "input": "Domain-centric lookup or feed browsing", + "output": "Recent DNS record changes and domain update observations", + "opsec": "passive", + "opsecNote": "Provides pre-collected change intelligence without direct target interaction by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Redirect Detective", "type": "url", - "url": "https://redirectdetective.com/" + "url": "https://redirectdetective.com/", + "description": "Web tool that traces URL redirect chains and final destinations across multi-hop redirects.", + "status": "live", + "pricing": "free", + "bestFor": "Understanding redirect paths and affiliate or cloaking behavior", + "input": "URL", + "output": "Redirect chain, intermediate hops, and final destination URL", + "opsec": "passive", + "opsecNote": "Redirect checks are initiated through the service, limiting direct local target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Sitediff (T)", "type": "url", - "url": "https://github.com/digininja/sitediff" + "url": "https://github.com/digininja/sitediff", + "description": "Command-line utility for comparing website versions to detect content and structural changes.", + "status": "live", + "pricing": "free", + "bestFor": "Tracking site changes between snapshots for monitoring and QA", + "input": "Two URLs or snapshots to compare", + "output": "Diff output highlighting content and structural deltas", + "opsec": "passive", + "opsecNote": "Primarily compares fetched content; does not perform intrusive probing by design.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", - "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", + "description": "Technology profiling platform that identifies web stacks, frameworks, analytics, and hosting signals.", "status": "live", "pricing": "freemium", - "bestFor": "Technology stack identification, competitor analysis", + "bestFor": "Website technology stack fingerprinting and ecosystem mapping", "input": "Domain or URL", - "output": "Technology list, analytics IDs, hosting info, historical tech changes", + "output": "Detected technologies, hosting/CDN indicators, and related site intelligence", "opsec": "passive", - "opsecNote": "Queries cached technology profiles. Does not contact the target.", + "opsecNote": "Returns platform-collected intelligence and does not require direct target probing by the user.", "localInstall": false, "googleDork": false, "registration": true, @@ -874,22 +1144,82 @@ { "name": "Wappalyzer", "type": "url", - "url": "https://www.wappalyzer.com/" + "url": "https://www.wappalyzer.com/", + "description": "Technology detection platform and browser tooling for identifying frameworks, CMS, and SaaS usage.", + "status": "live", + "pricing": "freemium", + "bestFor": "Detecting web technologies and software dependencies at scale", + "input": "Domain, URL, or browsed webpage", + "output": "Detected technologies by category with confidence indicators", + "opsec": "passive", + "opsecNote": "Uses extension/service analysis of page resources; minimal direct probing behavior.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "AnalyzeID", "type": "url", - "url": "https://analyzeid.com/" + "url": "https://analyzeid.com/", + "description": "Reverse lookup service for tracking IDs such as Google Analytics, AdSense, and affiliate identifiers.", + "status": "live", + "pricing": "free", + "bestFor": "Pivoting from shared tracking IDs to related domains", + "input": "Tracking ID (analytics, ads, affiliate, or publisher ID)", + "output": "Associated domains and identifier reuse relationships", + "opsec": "passive", + "opsecNote": "Operates on indexed identifier-to-domain mappings without active target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Criminal IP Search", "type": "url", - "url": "https://www.criminalip.io/" + "url": "https://www.criminalip.io/", + "description": "Cyber threat intelligence search engine for exposed assets, domains, vulnerabilities, and risk indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Threat-focused lookup of internet-facing assets and exposures", + "input": "IP, domain, ASN, CVE, or filter-based threat query", + "output": "Asset details, risk scores, service fingerprints, and vulnerability context", + "opsec": "passive", + "opsecNote": "Searches provider datasets rather than scanning targets directly from analyst infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "urlDNA", "type": "url", - "url": "https://urldna.io" + "url": "https://urldna.io", + "description": "URL intelligence service for investigating domains, redirects, and related reputation indicators.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick URL/domain triage and intelligence pivoting", + "input": "URL or domain", + "output": "URL analysis details, related domains, and risk-relevant metadata", + "opsec": "passive", + "opsecNote": "Uses service-side analysis and historical datasets instead of direct local probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ZoomEye.ai", From 8ebd8b16d7cd78f29fca7f0bf9a0017ab9ce665f Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 13:47:34 -0400 Subject: [PATCH 15/22] Enrich Images/Videos/Docs batch 1 metadata (THE-135) Co-Authored-By: Paperclip --- public/arf.json | 401 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 368 insertions(+), 33 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..1d1807c 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2049,127 +2049,462 @@ { "name": "Google Images", "type": "url", - "url": "https://images.google.com/?gws_rd=ssl" + "url": "https://images.google.com/", + "description": "Google's reverse image and visual search via Lens for finding matches, source pages, and related images across the web.", + "status": "live", + "pricing": "free", + "bestFor": "Broad reverse image search and source discovery", + "input": "Image upload or image URL", + "output": "Visually similar images, matching pages, and indexed source sites", + "opsec": "passive", + "opsecNote": "Standard search query against Google; no direct interaction with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Bing Images", "type": "url", - "url": "https://www.bing.com/images" + "url": "https://www.bing.com/images", + "description": "Microsoft visual search engine with reverse image lookup and crop-based matching for partial-object analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Cropped reverse-image matching and visual component analysis", + "input": "Image upload, image URL, or cropped image region", + "output": "Matching images, related pages, and object-level visual matches", + "opsec": "passive", + "opsecNote": "Performs web search queries without direct interaction with target identities.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceCheck Facial Recognition Search", "type": "url", - "url": "https://facecheck.id/" + "url": "https://facecheck.id/", + "description": "Facial recognition search engine that finds publicly indexed face matches across web and social sources.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding public social profiles by face image", + "input": "Face photo upload", + "output": "Potential face matches with source links and similarity scoring", + "opsec": "active", + "opsecNote": "Uploads target imagery to a third-party face-search service; treat as active collection.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Surfface Face & People Search Engine", "type": "url", - "url": "https://surfface.com/" + "url": "https://surfface.com/", + "description": "AI-based face and people search platform focused on open-source identity discovery and correlation.", + "status": "live", + "pricing": "freemium", + "bestFor": "Identity correlation from face imagery", + "input": "Face photo and optional identifying context", + "output": "Candidate profile matches from publicly available web sources", + "opsec": "active", + "opsecNote": "Submits facial data to vendor infrastructure for matching against indexed sources.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PimEyes Face Search Engine", "type": "url", - "url": "https://pimeyes.com/en" + "url": "https://pimeyes.com/en", + "description": "Commercial reverse face search engine for locating appearances of a face on publicly indexed websites.", + "status": "live", + "pricing": "freemium", + "bestFor": "High-coverage reverse face search investigations", + "input": "Face photo upload", + "output": "Matched face thumbnails and source-page links", + "opsec": "active", + "opsecNote": "Face image is uploaded and processed by a third-party biometric search provider.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": true, + "deprecated": false }, { "name": "Yandex Images", "type": "url", - "url": "https://www.yandex.com/images/" + "url": "https://yandex.com/images/", + "description": "Reverse image search engine with strong matching for Eastern European and Asian web sources.", + "status": "live", + "pricing": "free", + "bestFor": "Finding non-Western image sources and modified variants", + "input": "Image upload or image URL", + "output": "Similar images, likely originals, and source webpages", + "opsec": "passive", + "opsecNote": "Standard search requests to Yandex index; no direct account interaction required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Baidu Images", "type": "url", - "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" + "url": "https://image.baidu.com/", + "description": "Chinese reverse image search platform useful for discovering image reuse on China-centric websites.", + "status": "live", + "pricing": "free", + "bestFor": "China-specific image source discovery", + "input": "Image upload or image URL", + "output": "Visually similar images from Chinese websites and platforms", + "opsec": "passive", + "opsecNote": "Queries Baidu index only; no direct contact with target entities.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Twitter Image Search (M)", "type": "url", - "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" + "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images", + "description": "Manual X/Twitter query template for finding tweets containing images for a target keyword or account.", + "status": "live", + "pricing": "free", + "bestFor": "Finding image-containing tweets by keyword or operator", + "input": "Edited URL query (keyword, account, and search operators)", + "output": "Tweets and accounts with matching image/media posts", + "opsec": "passive", + "opsecNote": "Searches public timeline content; no direct engagement with targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Imgur Search", "type": "url", - "url": "https://imgur.com/search" + "url": "https://imgur.com/search", + "description": "Search interface for Imgur-hosted public images, albums, and community media posts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Locating reposted images and public gallery content on Imgur", + "input": "Keyword, tag, or user/gallery query", + "output": "Public image posts, albums, and account-linked media results", + "opsec": "passive", + "opsecNote": "Uses public site search and does not directly contact targets.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Photobucket", "type": "url", - "url": "https://photobucket.com/" + "url": "https://photobucket.com/", + "description": "Long-running image hosting platform with public galleries and legacy web-hosted photo content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding legacy hosted images and user gallery artifacts", + "input": "Keyword, user, or gallery search", + "output": "Public image galleries and hosted photo assets", + "opsec": "passive", + "opsecNote": "Investigations remain on public gallery pages and search views.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "7Photos.net", "type": "url", - "url": "https://7photos.net/" - }, - { - "name": "Panoramio", - "type": "url", - "url": "https://www.panoramio.com/" + "url": "https://7photos.net/", + "description": "Unclear image-related web service with an active domain but limited publicly verifiable functionality.", + "status": "degraded", + "pricing": "unknown", + "bestFor": "Unknown; requires additional validation before operational use", + "input": "Presumed image upload", + "output": "Unclear due to gated/redirected workflow", + "opsec": "unknown", + "opsecNote": "Observed authentication-style redirect behavior; service behavior is not fully observable.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Current Location", "type": "url", - "url": "https://current-location.com/" - }, - { - "name": "Lakako Photo Search", - "type": "url", - "url": "https://www.lakako.com/" + "url": "https://current-location.com/", + "description": "Location-based photo discovery tool that aggregates geotagged images from public platforms on an interactive map.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering geotagged photos near a location of interest", + "input": "Map location, coordinates, or browser geolocation", + "output": "Geotagged image results with source context from supported platforms", + "opsec": "passive", + "opsecNote": "Queries publicly indexed geotagged photos; no direct interaction with uploaders.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Lenso.ai", "type": "url", - "url": "https://lenso.ai/" + "url": "https://lenso.ai/", + "description": "AI reverse image and face matching platform designed to find similar or edited visual content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Matching altered or low-quality images and face lookups", + "input": "Image or face photo upload", + "output": "Visual matches, related occurrences, and similarity-ranked results", + "opsec": "active", + "opsecNote": "Uploads target imagery to external AI service for analysis and indexing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "CC Search", "type": "url", - "url": "https://ccsearch.creativecommons.org/" + "url": "https://search.creativecommons.org/", + "description": "Creative Commons search portal for discovering openly licensed and public-domain images.", + "status": "live", + "pricing": "free", + "bestFor": "Finding license-safe imagery and attribution-ready sources", + "input": "Keyword search with license/source filters", + "output": "CC/public-domain image results across partner collections", + "opsec": "passive", + "opsecNote": "Aggregated search over open repositories with no target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CamFind App", "type": "url", - "url": "https://camfindapp.com/" + "url": "https://camfindapp.com/", + "description": "Mobile visual search app that identifies objects, landmarks, and products from photos.", + "status": "live", + "pricing": "freemium", + "bestFor": "On-device object identification and quick visual lookups", + "input": "Mobile camera image", + "output": "Object labels, related images, and linked web results", + "opsec": "active", + "opsecNote": "Uploads captured images to remote processing service for recognition.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "RevEye Reverse Image Search (T)", "type": "url", - "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" + "url": "https://github.com/steven2358/reveye", + "description": "Open-source browser extension that launches reverse image searches across multiple engines from one menu.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-engine reverse image pivoting from a single browser action", + "input": "Right-click target image in browser", + "output": "Parallel reverse-search results in configured engines", + "opsec": "passive", + "opsecNote": "Client-side extension submits search queries to selected engines only.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SmugMug Search", "type": "url", - "url": "https://www.smugmug.com/" + "url": "https://www.smugmug.com/", + "description": "Photo hosting and portfolio platform with searchable public galleries and photographer profiles.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding public photographer portfolios and gallery artifacts", + "input": "Keyword, gallery, or photographer search", + "output": "Public albums, image sets, and profile-linked photo collections", + "opsec": "passive", + "opsecNote": "Research is limited to publicly exposed gallery content.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ImageNet", "type": "url", - "url": "https://image-net.org/" + "url": "https://image-net.org/", + "description": "Large-scale labeled image dataset used for computer vision and image classification research.", + "status": "live", + "pricing": "free", + "bestFor": "Reference classification sets and ML-oriented visual taxonomy work", + "input": "Category/synset browsing and dataset queries", + "output": "Labeled image classes, metadata, and downloadable dataset resources", + "opsec": "passive", + "opsecNote": "Academic dataset access with no direct subject engagement.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Places2", "type": "url", - "url": "https://places2.csail.mit.edu/explore.html" + "url": "http://places2.csail.mit.edu/", + "description": "MIT CSAIL scene-recognition dataset containing millions of place-labeled images for visual analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Scene classification reference and location-context model training", + "input": "Scene categories and dataset download requests", + "output": "Scene-labeled image datasets and related research resources", + "opsec": "passive", + "opsecNote": "Public academic dataset access; no direct target interaction.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Image Identification Project", "type": "url", - "url": "https://www.imageidentify.com/" + "url": "https://www.imageidentify.com/", + "description": "Online image recognition service that labels uploaded images with machine-generated tags and confidence scores.", + "status": "live", + "pricing": "freemium", + "bestFor": "Quick machine-labeling of unknown image content", + "input": "Image upload", + "output": "Predicted tags, object labels, and confidence values", + "opsec": "active", + "opsecNote": "Uploaded images are processed on third-party infrastructure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "SauceNAO", "type": "url", - "url": "https://saucenao.com/" + "url": "https://saucenao.com/", + "description": "Reverse image source finder widely used to trace artwork, anime frames, and reposted media to origin sites.", + "status": "live", + "pricing": "freemium", + "bestFor": "Tracing image origins and duplicate postings", + "input": "Image upload or image URL", + "output": "Likely source links, matching images, and similarity metrics", + "opsec": "passive", + "opsecNote": "Search workflow only; does not interact with target accounts directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Picarta", "type": "url", - "url": "https://picarta.ai/" + "url": "https://picarta.ai/", + "description": "AI geolocation tool that estimates likely photo capture locations from visual scene analysis.", + "status": "live", + "pricing": "freemium", + "bestFor": "Estimating geographic origin of photos without metadata", + "input": "Image upload", + "output": "Predicted coordinates and location confidence cues", + "opsec": "active", + "opsecNote": "Image content is uploaded to a third-party AI geolocation service.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "FaceSeek Face Search Engine", "type": "url", - "url": "https://faceseek.online" + "url": "https://www.faceseek.online/", + "description": "Face-matching web tool for locating visually similar faces across indexed online content.", + "status": "live", + "pricing": "freemium", + "bestFor": "Supplemental reverse face lookup and comparison", + "input": "Face photo upload", + "output": "Potential facial matches with source references", + "opsec": "active", + "opsecNote": "Uploads biometric imagery to a hosted face-search platform.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, From c69e18e519c0eb11427342205e0706c01faa1eba Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 13:53:48 -0400 Subject: [PATCH 16/22] Fix PimEyes invitationOnly flag (THE-135) PimEyes is a publicly accessible commercial service (subscription required for full features), not invitation-only. Corrects the badge value from true to false. Co-Authored-By: Paperclip --- public/arf.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/public/arf.json b/public/arf.json index 1d1807c..d0f703b 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2143,7 +2143,7 @@ "registration": true, "editUrl": false, "api": false, - "invitationOnly": true, + "invitationOnly": false, "deprecated": false }, { From 879374fb284744b5ad781a0e0a5fb60f45f74a9b Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 17:09:31 -0400 Subject: [PATCH 17/22] Enrich Domain Name tools batch 5 metadata (THE-131) Co-Authored-By: Paperclip --- public/arf.json | 425 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 400 insertions(+), 25 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..809691b 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1210,92 +1210,362 @@ { "name": "Wappalyzer (T)", "type": "url", - "url": "https://www.wappalyzer.com/" + "url": "https://www.wappalyzer.com/", + "description": "Technology stack profiler that identifies CMS, frameworks, analytics, and infrastructure used by a website.", + "status": "live", + "pricing": "freemium", + "bestFor": "Technology stack fingerprinting and recon", + "input": "Domain or URL", + "output": "Detected technologies, categories, versions, and metadata", + "opsec": "active", + "opsecNote": "Performs direct analysis of target pages when scanning live URLs.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "SEMrush", "type": "url", - "url": "https://www.semrush.com/" + "url": "https://www.semrush.com/", + "description": "SEO intelligence platform for domain analytics, keyword intelligence, backlinks, and competitor profiling.", + "status": "live", + "pricing": "paid", + "bestFor": "Traffic and backlink competitive analysis", + "input": "Domain", + "output": "Keywords, backlinks, ranking trends, and traffic estimates", + "opsec": "passive", + "opsecNote": "Uses provider-side indexed datasets and does not require direct probing by the user.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Moonsearch", "type": "url", - "url": "https://moonsearch.com/" + "url": "https://moonsearch.com/", + "description": "Legacy reverse-WHOIS style domain correlation service with unclear current availability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical domain ownership correlation", + "input": "Domain or registrant details", + "output": "Potentially related domains and ownership links", + "opsec": "unknown", + "opsecNote": "Service availability is inconsistent; treat results as unverified and re-check before use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Ewhois", "type": "url", - "url": "https://ewhois.com/" + "url": "https://www.ewhois.com/", + "description": "Web WHOIS lookup utility for registration, registrar, and nameserver details.", + "status": "live", + "pricing": "free", + "bestFor": "Quick WHOIS lookups", + "input": "Domain", + "output": "Registrant, registrar, dates, and nameserver records", + "opsec": "passive", + "opsecNote": "Performs standard registration lookups with low operational risk.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "StatsCrop", "type": "url", - "url": "https://www.statscrop.com/" + "url": "https://www.statscrop.com/", + "description": "Website statistics portal with traffic rank snapshots and related metadata.", + "status": "live", + "pricing": "free", + "bestFor": "Quick website popularity snapshots", + "input": "Domain", + "output": "Traffic rank estimates and summary site stats", + "opsec": "passive", + "opsecNote": "Reads provider-side metrics without direct target interaction by the user.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Open Site Explorer", "type": "url", - "url": "https://moz.com/link-explorer" + "url": "https://moz.com/link-explorer", + "description": "Legacy Moz Open Site Explorer entry now represented by Moz Link Explorer for backlink analysis.", + "status": "degraded", + "pricing": "freemium", + "bestFor": "Backlink and linking-domain analysis", + "input": "Domain or URL", + "output": "Backlinks, authority-style metrics, and linking domains", + "opsec": "passive", + "opsecNote": "Modern functionality persists under Moz Link Explorer; legacy naming retained for framework continuity.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": true, + "api": true, + "invitationOnly": false, + "deprecated": true }, { "name": "SpyOnWeb", "type": "url", - "url": "https://www.spyonweb.com/" + "url": "https://www.spyonweb.com/", + "description": "Correlation tool that links domains by shared tracking and advertising identifiers.", + "status": "live", + "pricing": "freemium", + "bestFor": "Finding related infrastructure via shared IDs", + "input": "Domain or analytics/ad IDs", + "output": "Related domains and shared identifier pivots", + "opsec": "passive", + "opsecNote": "Uses indexed identifier data and does not require active probing.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Keyword Density", "type": "url", - "url": "https://tools.seobook.com/general/keyword-density/" + "url": "https://tools.seobook.com/general/keyword-density/", + "description": "Text and page analyzer that measures keyword frequency and relative density.", + "status": "live", + "pricing": "free", + "bestFor": "On-page keyword frequency analysis", + "input": "URL or text", + "output": "Keyword counts and density metrics", + "opsec": "active", + "opsecNote": "May fetch target content directly for analysis when URL input is used.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Site Statistics", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Internet traffic-statistics entry; service was discontinued in 2022.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Domain", + "output": "Legacy traffic ranking context (archival)", + "opsec": "unknown", + "opsecNote": "Alexa Internet shut down on May 1, 2022; keep as deprecated reference only.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Cisco Umbrella Popularity List", "type": "url", - "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" + "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html", + "description": "Domain popularity ranking based on Cisco Umbrella DNS telemetry.", + "status": "live", + "pricing": "free", + "bestFor": "Top-domain popularity and DNS trend context", + "input": "Domain or list lookup", + "output": "Popularity ranking and related DNS-derived context", + "opsec": "passive", + "opsecNote": "Consumes published ranking data with low direct exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Alexa Top 500 Global Sites", "type": "url", - "url": "https://alexa.amazon.com/about" + "url": "https://alexa.amazon.com/about", + "description": "Historical Alexa Top Sites list reference; no longer maintained after Alexa shutdown.", + "status": "down", + "pricing": "free", + "bestFor": "Historical popularity-list reference", + "input": "N/A", + "output": "Legacy ranking context only", + "opsec": "unknown", + "opsecNote": "Alexa Internet ended on May 1, 2022; this entry is retained only as deprecated legacy context.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Sitedossier", "type": "url", - "url": "https://www.sitedossier.com/" + "url": "https://www.sitedossier.com/", + "description": "Domain dossier aggregator with WHOIS, DNS, and linked infrastructure context.", + "status": "live", + "pricing": "free", + "bestFor": "Quick domain intelligence aggregation", + "input": "Domain or IP", + "output": "WHOIS, DNS, and related-site context", + "opsec": "passive", + "opsecNote": "Aggregates public records and indexed data with limited operator exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Visual Site Mapper", "type": "url", - "url": "https://github.com/alentum/sitemapper-nodejs" + "url": "https://github.com/alentum/sitemapper-nodejs", + "description": "Site-crawling mapper used to visualize website structure and page relationships.", + "status": "live", + "pricing": "free", + "bestFor": "Generating website structure maps", + "input": "Domain or URL seed", + "output": "Crawl graph and site map structure", + "opsec": "active", + "opsecNote": "Actively crawls target pages and generates repeated requests.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ClearWebStats.com", "type": "url", - "url": "https://www.clearwebstats.com/" + "url": "https://www.clearwebstats.com/", + "description": "Public site-statistics index showing traffic and rank snapshots for domains.", + "status": "live", + "pricing": "free", + "bestFor": "Lightweight web popularity lookups", + "input": "Domain", + "output": "Estimated rank and summary traffic metrics", + "opsec": "passive", + "opsecNote": "Uses provider-collected analytics rather than direct target scanning.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "PubDB", "type": "url", - "url": "https://pub-db.com/" + "url": "https://pub-db.com/", + "description": "Legacy public-database lookup entry with expired or unavailable service state.", + "status": "down", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "Query terms", + "output": "Unavailable/legacy output", + "opsec": "unknown", + "opsecNote": "Service appears expired or defunct; verify alternatives before operational use.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "SimilarWeb", "type": "url", - "url": "https://www.similarweb.com/" + "url": "https://www.similarweb.com/", + "description": "Digital intelligence platform for traffic estimates, referrals, and audience insights.", + "status": "live", + "pricing": "freemium", + "bestFor": "Competitor traffic and referral analysis", + "input": "Domain", + "output": "Traffic channels, engagement, and competitor benchmarking", + "opsec": "passive", + "opsecNote": "Relies on provider-side datasets and panels; no active probing required by user.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Siteliner", "type": "url", - "url": "https://www.siteliner.com/" + "url": "https://www.siteliner.com/", + "description": "Website crawler that highlights duplicate content, broken links, and SEO quality issues.", + "status": "live", + "pricing": "freemium", + "bestFor": "Duplicate-content and link-health audits", + "input": "Domain", + "output": "Duplicate-content metrics, broken links, and crawl summaries", + "opsec": "active", + "opsecNote": "Performs active crawl requests against the target site.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WhatWeb", "type": "url", - "url": "https://github.com/urbanadventurer/WhatWeb" + "url": "https://github.com/urbanadventurer/WhatWeb", + "description": "Open-source fingerprinting scanner for identifying technologies, frameworks, and server-side indicators.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based web technology fingerprinting", + "input": "Domain or URL", + "output": "Detected technologies, headers, and fingerprint matches", + "opsec": "active", + "opsecNote": "Directly scans target endpoints and can be noisy depending on scan options.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1306,27 +1576,102 @@ { "name": "Link Expander", "type": "url", - "url": "https://www.linkexpander.com/" + "url": "https://www.linkexpander.com/", + "description": "Short-link expansion tool that resolves redirects to destination URLs.", + "status": "live", + "pricing": "free", + "bestFor": "Expanding shortened links safely", + "input": "Shortened URL", + "output": "Resolved destination URL and redirect behavior", + "opsec": "passive", + "opsecNote": "Uses preview/expansion workflows and avoids direct navigation in the browser.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "CheckShortURL", "type": "url", - "url": "https://checkshorturl.com/" + "url": "https://checkshorturl.com/", + "description": "Preview service for shortened URLs with destination and threat-check context.", + "status": "live", + "pricing": "free", + "bestFor": "Safe short-link destination checks", + "input": "Shortened URL", + "output": "Expanded destination and warning context", + "opsec": "passive", + "opsecNote": "Passively expands links before user navigation.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "URL Expander", "type": "url", - "url": "https://urlex.org/" + "url": "https://urlex.org/", + "description": "Link resolver for unshortening and inspecting redirect destination chains.", + "status": "live", + "pricing": "free", + "bestFor": "Resolving opaque short links", + "input": "Shortened URL", + "output": "Expanded URL and redirect details", + "opsec": "passive", + "opsecNote": "Primarily destination resolution with low direct operational exposure.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Where Does This Link Go?", "type": "url", - "url": "https://wheregoes.com/" + "url": "https://wheregoes.com/", + "description": "Redirect-chain inspector that traces and visualizes final destination paths.", + "status": "live", + "pricing": "free", + "bestFor": "Tracing redirect chains for suspicious links", + "input": "URL", + "output": "Redirect hops, response codes, and final destination", + "opsec": "passive", + "opsecNote": "Provides passive redirect tracing before manual browser interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "KnowURL", "type": "url", - "url": "https://www.knowurl.com/" + "url": "https://www.knowurl.com/", + "description": "Legacy URL intelligence entry with uncertain availability and reliability.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical reference only", + "input": "URL", + "output": "Unreliable or unavailable metadata", + "opsec": "unknown", + "opsecNote": "Current service status is unclear; verify manually before relying on output.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -1337,12 +1682,42 @@ { "name": "VisualPing", "type": "url", - "url": "https://visualping.io:443/" + "url": "https://visualping.io/", + "description": "Website monitoring platform that alerts on page content or visual changes.", + "status": "live", + "pricing": "freemium", + "bestFor": "Automated webpage change monitoring", + "input": "URL and watch settings", + "output": "Change alerts with visual or text diffs", + "opsec": "active", + "opsecNote": "Performs recurring fetches of target pages based on monitoring cadence.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Change Detection", "type": "url", - "url": "https://visualping.io/" + "url": "https://changedetection.io/", + "description": "Open-source change-monitoring system for tracking updates on websites over time.", + "status": "live", + "pricing": "free", + "bestFor": "Self-hosted page change monitoring", + "input": "URL and monitoring rules", + "output": "Diffs and notifications when monitored content changes", + "opsec": "active", + "opsecNote": "Generates recurring requests to monitored targets; tune intervals for OPSEC.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Check site availability Online", From 6988fb5421778a7cc6b80145bd2c6510ebbdd28f Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 19:42:52 -0400 Subject: [PATCH 18/22] Curate Images/Videos/Docs batch 3 deterministic updates (THE-137) Co-Authored-By: Paperclip --- public/arf.json | 36 +++++++++++++----------------------- 1 file changed, 13 insertions(+), 23 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..0a8d599 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2317,12 +2317,12 @@ { "name": "Hachoir (T)", "type": "url", - "url": "https://github.com/vstinner/hachoir" + "url": "https://hachoir.readthedocs.io/" }, { "name": "C2PA Verify", "type": "url", - "url": "https://contentcredentials.org/verify" + "url": "https://c2paviewer.com/" }, { "name": "Metadata2Go", @@ -2343,7 +2343,7 @@ { "name": "Ghiro (T)", "type": "url", - "url": "https://github.com/ghirensics/ghiro" + "url": "https://getghiro.org/" }, { "name": "Camera Trace", @@ -2361,11 +2361,6 @@ "name": "OCR", "type": "folder", "children": [ - { - "name": "Online OCR", - "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" - }, { "name": "i2OCR", "type": "url", @@ -2390,7 +2385,7 @@ { "name": "Creepy (T)", "type": "url", - "url": "https://www.geocreepy.com/" + "url": "https://github.com/ilektrojohn/creepy" } ] } @@ -2407,7 +2402,7 @@ { "name": "Google Videos", "type": "url", - "url": "https://www.google.com/videohp?gws_rd=ssl" + "url": "https://www.google.com/videohp" }, { "name": "Bing Videos", @@ -2417,7 +2412,7 @@ { "name": "Internet Archive Videos", "type": "url", - "url": "https://archive.org/details/opensource_movies" + "url": "https://archive.org/details/movies" }, { "name": "Vines (D)", @@ -2425,14 +2420,14 @@ "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" }, { - "name": "Dogpile Web Search", + "name": "Dogpile", "type": "url", "url": "https://www.dogpile.com/" }, { "name": "Geo Search Tool", "type": "url", - "url": "https://www.geosearchtool.com/" + "url": "https://youtube.github.io/geo-search-tool/" }, { "name": "blinkx Video Search", @@ -2442,17 +2437,17 @@ { "name": "Facebook Live Map", "type": "url", - "url": "https://www.facebook.com/watch/live/?ref=live_delegate" + "url": "https://facebook.com/live" }, { - "name": "LiveLeak", + "name": "LiveLeak (D)", "type": "url", "url": "https://www.liveleak.com/" }, { "name": "Metatube", "type": "url", - "url": "https://www.metatube.com/" + "url": "https://github.com/JVT038/MetaTube" }, { "name": "Yahoo Video Search", @@ -2462,7 +2457,7 @@ { "name": "Search YouTube by Location", "type": "url", - "url": "https://mattw.io/youtube-geofind/location" + "url": "https://mattw.io/youtube-geofind/" } ] }, @@ -5574,7 +5569,7 @@ { "name": "Online OCR", "type": "url", - "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" + "url": "https://www.onlineocr.net/" }, { "name": "i2OCR", @@ -5585,11 +5580,6 @@ "name": "New OCR", "type": "url", "url": "https://www.newocr.com/" - }, - { - "name": "Online OCR", - "type": "url", - "url": "https://www.onlineocr.net/" } ] }, From 20a1fe2a1a8125b692b8746f841956e82fa00c31 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 20:36:20 -0400 Subject: [PATCH 19/22] Remove ambiguous tools: Get-Metadata, Camera Trace, DetURL (THE-137) These three entries do not map to identifiable standalone public OSINT tools. Research across multiple sources could not confirm their existence as distinct, maintained tools. They can be re-added if concrete replacements are identified. Co-Authored-By: Paperclip --- public/arf.json | 15 --------------- 1 file changed, 15 deletions(-) diff --git a/public/arf.json b/public/arf.json index 0a8d599..8e0af3e 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2328,11 +2328,6 @@ "name": "Metadata2Go", "type": "url", "url": "https://www.metadata2go.com/" - }, - { - "name": "Get-Metadata", - "type": "url", - "url": "https://www.get-metadata.com/" } ] }, @@ -2345,11 +2340,6 @@ "type": "url", "url": "https://getghiro.org/" }, - { - "name": "Camera Trace", - "type": "url", - "url": "https://www.cameratrace.com/trace" - }, { "name": "Forensically", "type": "url", @@ -2465,11 +2455,6 @@ "name": "Analyze / Record", "type": "folder", "children": [ - { - "name": "DetURL", - "type": "url", - "url": "https://deturl.com/" - }, { "name": "Print YouTube StoryBoard Instructions", "type": "url", From 557a2380aafb6a217e0e7d6fcd2b62f0ff18f234 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 20:47:39 -0400 Subject: [PATCH 20/22] Apply approved Domain batch 6 naming and URL clarifications (THE-132) Co-Authored-By: Paperclip --- public/arf.json | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..b53a424 100644 --- a/public/arf.json +++ b/public/arf.json @@ -1345,7 +1345,7 @@ "url": "https://visualping.io/" }, { - "name": "Check site availability Online", + "name": "UPcheck", "type": "url", "url": "https://upcheck.online/" }, @@ -1367,7 +1367,7 @@ { "name": "ChangeDetect", "type": "url", - "url": "https://www.eatgrainmaker.com/home/" + "url": "https://changedetection.io/" } ] }, @@ -1417,7 +1417,7 @@ "url": "https://nikto.online/" }, { - "name": "WDES - Web Data Exposure Scanner (T)", + "name": "Web Data Exposure Scanner (T)", "type": "url", "url": "https://github.com/eduardoit/web-data-exposure-scanner" } @@ -1482,14 +1482,14 @@ "type": "folder", "children": [ { - "name": "Microsoft", + "name": "Windows Defender Security Intelligence (WDSI)", "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" + "url": "https://www.microsoft.com/en-us/wdsi" }, { - "name": "Google", + "name": "Google Safe Browsing", "type": "url", - "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" + "url": "https://safebrowsing.google.com/" } ] } From 7abc9a025f8b49d1c7b45340ad15fcc4b57a6643 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 21:58:15 -0400 Subject: [PATCH 21/22] Apply enrichment fields for all 21 Domain Name batch 6 tools (THE-132) Populate description, status, pricing, bestFor, input, output, opsec, opsecNote, and badge fields for Change Detection, Social Analysis, DNSSEC, Vulnerabilities, Tools, and Report Malicious Sites subcategories. Key decisions: - UPcheck (formerly Check site availability Online): marked deprecated=true as the service is currently down - Sn1per, Burp Suite, Online Nikto, WDES, EyeWitness: opsec=active due to active scanning behavior - Urlwatch, RobotsDisallowed: localInstall=true (CLI/open-source tools) - DNSSEC Analyzer uses Verisign URL; DNSViz uses dnsviz.net (distinct tools) - Both Online Nikto scanner entries enriched (Discovery and Tools sections) Co-Authored-By: Paperclip --- public/arf.json | 382 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 356 insertions(+), 26 deletions(-) diff --git a/public/arf.json b/public/arf.json index b53a424..ab2fdf6 100644 --- a/public/arf.json +++ b/public/arf.json @@ -829,7 +829,22 @@ { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "urlscan.io", @@ -1347,27 +1362,102 @@ { "name": "UPcheck", "type": "url", - "url": "https://upcheck.online/" + "url": "https://upcheck.online/", + "description": "Website uptime checker that tests if a site is currently accessible.", + "status": "down", + "pricing": "free", + "bestFor": "Quick site availability checks", + "input": "URL/domain", + "output": "Up/down status", + "opsec": "passive", + "opsecNote": "No identification risk; passive status check only", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Follow That Page", "type": "url", - "url": "https://www.followthatpage.com/" + "url": "https://www.followthatpage.com/", + "description": "Website change detection service that monitors pages for updates and sends email notifications.", + "status": "live", + "pricing": "free", + "bestFor": "Website monitoring for content changes", + "input": "URLs", + "output": "Change alerts via email", + "opsec": "passive", + "opsecNote": "No direct identification risk; third-party service tracks monitored URLs", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Urlwatch", "type": "url", - "url": "https://github.com/thp/urlwatch" + "url": "https://github.com/thp/urlwatch", + "description": "Open-source Python CLI tool for monitoring websites and local documents for changes with flexible notification options.", + "status": "live", + "pricing": "free", + "bestFor": "Automated change monitoring with custom notifications", + "input": "URLs or local files", + "output": "Change reports and diffs", + "opsec": "passive", + "opsecNote": "Local execution only; no external tracking of monitored targets", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "WatchThatPage", "type": "url", - "url": "https://watchthatpage.com/" + "url": "https://watchthatpage.com/", + "description": "Web-based page monitoring service with keyword filtering and change notification alerts.", + "status": "live", + "pricing": "freemium", + "bestFor": "Change detection with keyword filtering", + "input": "URLs and keywords", + "output": "Change alerts", + "opsec": "passive", + "opsecNote": "No direct identification; third-party service stores monitored URLs", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "ChangeDetect", "type": "url", - "url": "https://changedetection.io/" + "url": "https://changedetection.io/", + "description": "SaaS and self-hosted website monitoring platform with 85+ notification integrations.", + "status": "live", + "pricing": "freemium", + "bestFor": "Scalable change detection with broad notification support", + "input": "URLs", + "output": "Change notifications", + "opsec": "passive", + "opsecNote": "No identification risk; can be self-hosted for full control", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1378,7 +1468,22 @@ { "name": "Google Trends", "type": "url", - "url": "https://trends.google.com/trends/" + "url": "https://trends.google.com/trends/", + "description": "Google's search trend analysis tool for tracking keyword popularity and comparing search interest over time.", + "status": "live", + "pricing": "free", + "bestFor": "Search trend analysis and keyword research", + "input": "Keywords or domains", + "output": "Trend data and comparative interest graphs", + "opsec": "passive", + "opsecNote": "Google-tracked; your queries may be associated with your account or IP", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1389,12 +1494,42 @@ { "name": "DNSSEC Analyzer", "type": "url", - "url": "https://dnssec-analyzer.verisignlabs.com/" + "url": "https://dnssec-analyzer.verisignlabs.com/", + "description": "Verisign's DNSSEC validation tool that checks the DNSSEC chain of trust for a domain.", + "status": "live", + "pricing": "free", + "bestFor": "DNSSEC chain-of-trust validation", + "input": "Domain names", + "output": "DNSSEC validation status and chain details", + "opsec": "passive", + "opsecNote": "No identification risk; passive DNS lookup", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DNSViz", "type": "url", - "url": "https://dnsviz.net/" + "url": "https://dnsviz.net/", + "description": "Open-source web-based DNSSEC visualization tool that maps the DNS delegation chain and trust anchors.", + "status": "live", + "pricing": "free", + "bestFor": "Visual DNSSEC debugging and delegation chain analysis", + "input": "Domain names", + "output": "Interactive DNS chain diagrams", + "opsec": "passive", + "opsecNote": "No identification risk; passive DNS query", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1409,17 +1544,62 @@ { "name": "Sn1per (T)", "type": "url", - "url": "https://github.com/1N3/Sn1per" + "url": "https://github.com/1N3/Sn1per", + "description": "Automated reconnaissance and penetration testing framework combining multiple scanning tools for full-scope target enumeration.", + "status": "live", + "pricing": "free", + "bestFor": "Full-scope pentest automation and recon", + "input": "Target domains or IPs", + "output": "Recon data, open ports, vulnerabilities, and footprinting results", + "opsec": "active", + "opsecNote": "Generates significant network traffic and alerts; high IDS/WAF detection risk", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Web Data Exposure Scanner (T)", "type": "url", - "url": "https://github.com/eduardoit/web-data-exposure-scanner" + "url": "https://github.com/eduardoit/web-data-exposure-scanner", + "description": "Open-source scanner for detecting exposed web application data and sensitive file disclosures on web servers.", + "status": "live", + "pricing": "free", + "bestFor": "Detecting exposed sensitive data on web servers", + "input": "URLs/domains", + "output": "Exposed data findings", + "opsec": "active", + "opsecNote": "Active scanning may generate server logs and trigger alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1430,14 +1610,44 @@ { "name": "Zone-H.org", "type": "url", - "url": "https://zone-h.org/archive" + "url": "https://zone-h.org/archive", + "description": "Website defacement archive and defacer tracking database with historical records of compromised sites.", + "status": "live", + "pricing": "free", + "bestFor": "Defacement history and attacker identification", + "input": "Domains", + "output": "Defacement records and defacer profiles", + "opsec": "passive", + "opsecNote": "Historical archive lookup; no active probing of targets", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, { "name": "RobotsDisallowed", "type": "url", - "url": "https://github.com/danielmiessler/RobotsDisallowed" + "url": "https://github.com/danielmiessler/RobotsDisallowed", + "description": "Curated wordlist of top disallowed paths harvested from robots.txt files across high-traffic websites.", + "status": "live", + "pricing": "free", + "bestFor": "robots.txt enumeration and directory discovery", + "input": "Used as wordlist input for directory brute-forcing", + "output": "Directory path wordlist", + "opsec": "passive", + "opsecNote": "Passive wordlist only; no requests made to target during list use", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1448,32 +1658,122 @@ { "name": "Belati (T)", "type": "url", - "url": "https://github.com/aancw/Belati" + "url": "https://github.com/aancw/Belati", + "description": "Open-source OSINT data collection and automation framework for gathering information from multiple sources.", + "status": "live", + "pricing": "free", + "bestFor": "Multi-source OSINT collection automation", + "input": "Domains and targets", + "output": "Aggregated OSINT data", + "opsec": "passive", + "opsecNote": "Primarily passive; behavior depends on configured modules", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Burp Suite (T)", "type": "url", - "url": "https://portswigger.net/burp" + "url": "https://portswigger.net/burp", + "description": "Industry-standard web application security testing platform for manual and automated vulnerability assessment.", + "status": "live", + "pricing": "freemium", + "bestFor": "Web application penetration testing", + "input": "Web applications and URLs", + "output": "Security findings, intercepted traffic, and vulnerability reports", + "opsec": "active", + "opsecNote": "Full active scanning; generates extensive server logs and may trigger WAF/IDS alerts", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "EyeWitness (T)", "type": "url", - "url": "https://github.com/ChrisTruncer/EyeWitness" + "url": "https://github.com/ChrisTruncer/EyeWitness", + "description": "Open-source tool for automated website screenshotting, service header collection, and default credential identification.", + "status": "live", + "pricing": "free", + "bestFor": "Visual site enumeration and credential identification", + "input": "URL lists", + "output": "Screenshots, headers, and default credential matches", + "opsec": "passive", + "opsecNote": "HTTP requests visible in target server logs; screenshots leave network footprint", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Hunting-New-Registered-Domains (T)", "type": "url", - "url": "https://github.com/gfek/Hunting-New-Registered-Domains" + "url": "https://github.com/gfek/Hunting-New-Registered-Domains", + "description": "Open-source tool for identifying newly registered domains matching patterns, useful for phishing and brand threat detection.", + "status": "live", + "pricing": "free", + "bestFor": "Phishing domain detection and brand threat monitoring", + "input": "Domain patterns or keywords", + "output": "List of newly registered matching domains", + "opsec": "passive", + "opsecNote": "WHOIS queries may create observable patterns; otherwise passive", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "International Domain Name Conversion Tool", "type": "url", - "url": "https://mct.verisign-grs.com/" + "url": "https://mct.verisign-grs.com/", + "description": "Verisign's IDN/Punycode bidirectional converter for translating international domain names to and from ASCII-compatible encoding.", + "status": "live", + "pricing": "free", + "bestFor": "IDN and Punycode domain analysis", + "input": "International or Punycode domain names", + "output": "Converted domain equivalents", + "opsec": "passive", + "opsecNote": "No identification risk; local conversion tool", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", - "url": "https://nikto.online/" + "url": "https://nikto.online/", + "description": "Hosted version of the Nikto web server scanner for identifying vulnerabilities, misconfigurations, and exposed files.", + "status": "live", + "pricing": "free", + "bestFor": "Web server vulnerability scanning", + "input": "URLs", + "output": "Vulnerability and misconfiguration reports", + "opsec": "active", + "opsecNote": "Generates noisy scan traffic visible in target server logs; likely to trigger WAF/IDS alerts", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -1484,12 +1784,42 @@ { "name": "Windows Defender Security Intelligence (WDSI)", "type": "url", - "url": "https://www.microsoft.com/en-us/wdsi" + "url": "https://www.microsoft.com/en-us/wdsi", + "description": "Microsoft's security intelligence portal for reporting malicious URLs and checking Windows Defender threat assessments.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Microsoft and checking URL threat status", + "input": "URLs", + "output": "Threat status and submission confirmation", + "opsec": "passive", + "opsecNote": "Microsoft-tracked; submissions aggregated for threat intelligence", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Google Safe Browsing", "type": "url", - "url": "https://safebrowsing.google.com/" + "url": "https://safebrowsing.google.com/", + "description": "Google's phishing and malware reporting portal for submitting suspicious URLs for review.", + "status": "live", + "pricing": "free", + "bestFor": "Reporting malicious sites to Google and checking URL safety status", + "input": "URLs", + "output": "Safety status and submission confirmation", + "opsec": "passive", + "opsecNote": "Google-tracked; searches and submissions aggregated at scale", + "localInstall": false, + "googleDork": true, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] } @@ -4103,12 +4433,12 @@ "url": "https://www.brbpub.com/" }, { - "name": "GOVDATA - Das Datenportal für Deutschland (German)", + "name": "GOVDATA - Das Datenportal f\u00fcr Deutschland (German)", "type": "url", "url": "https://www.govdata.de/" }, { - "name": "Open-Data-Portal München (German)", + "name": "Open-Data-Portal M\u00fcnchen (German)", "type": "url", "url": "https://www.opengov-muenchen.de/" }, @@ -7733,7 +8063,7 @@ "url": "https://themanyhats.club/centralised-place-for-privacy-resources/" }, { - "name": "The Hitchhiker’s Guide to Online Anonymity", + "name": "The Hitchhiker\u2019s Guide to Online Anonymity", "type": "url", "url": "https://anonymousplanet.org/guide/" }, @@ -7909,4 +8239,4 @@ ] } ] -} +} \ No newline at end of file From 39ebb0ac7e8200d9e5fdcfdc369f231906d3fdf9 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 21:59:18 -0400 Subject: [PATCH 22/22] Update arf.json --- public/arf.json | 40 ++++++++++++++++++++-------------------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/public/arf.json b/public/arf.json index 194328f..17beb49 100644 --- a/public/arf.json +++ b/public/arf.json @@ -10,6 +10,26 @@ "name": "Username Search Engines", "type": "folder", "children": [ + { + "name": "WhatsMyName (T)", + "type": "url", + "url": "https://github.com/WebBreacher/WhatsMyName", + "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", + "status": "live", + "pricing": "free", + "bestFor": "Username enumeration using community-maintained site detection data", + "input": "Username", + "output": "List of sites where the username exists, based on HTTP response pattern matching", + "opsec": "active", + "opsecNote": "Makes HTTP requests to each target site to check for username existence.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false + }, { "name": "Sylva Identity Discovery (T)", "type": "url", @@ -70,26 +90,6 @@ "invitationOnly": false, "deprecated": false }, - { - "name": "WhatsMyName (T)", - "type": "url", - "url": "https://github.com/WebBreacher/WhatsMyName", - "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", - "status": "live", - "pricing": "free", - "bestFor": "Username enumeration using community-maintained site detection data", - "input": "Username", - "output": "List of sites where the username exists, based on HTTP response pattern matching", - "opsec": "active", - "opsecNote": "Makes HTTP requests to each target site to check for username existence.", - "localInstall": false, - "googleDork": false, - "registration": false, - "editUrl": false, - "api": false, - "invitationOnly": false, - "deprecated": false - }, { "name": "Thats Them", "type": "url",