{ "name": "OSINT Framework", "type": "folder", "children": [ { "name": "Username", "type": "folder", "children": [ { "name": "Username Search Engines", "type": "folder", "children": [ { "name": "WhatsMyName (T)", "type": "url", "url": "https://github.com/WebBreacher/WhatsMyName", "description": "OSINT project maintaining a curated JSON database of website detection patterns for username enumeration. Web interface available at whatsmyname.app.", "status": "live", "pricing": "free", "bestFor": "Username enumeration using community-maintained site detection data", "input": "Username", "output": "List of sites where the username exists, based on HTTP response pattern matching", "opsec": "active", "opsecNote": "Makes HTTP requests to each target site to check for username existence.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Sylva Identity Discovery (T)", "type": "url", "url": "https://sylva.pfeister.dev/", "description": "Open-source CLI tool for username and identity discovery with branch discovery to expand searches as additional linked identities are uncovered.", "status": "live", "pricing": "free", "bestFor": "Username enumeration with identity branching", "input": "Username", "output": "Linked accounts and identities across platforms", "opsec": "active", "opsecNote": "Makes requests to target platforms to check username existence; external API keys may be used.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Sherlock (T)", "type": "url", "url": "https://github.com/sherlock-project/sherlock", "description": "Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.", "status": "live", "pricing": "free", "bestFor": "Mass username enumeration across 400+ sites", "input": "Username(s)", "output": "List of discovered profile URLs across social networks", "opsec": "active", "opsecNote": "Directly queries each target site to check username existence; supports Tor/proxy for anonymity.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Namechk", "type": "url", "url": "https://namechk.com/", "description": "Web-based username and domain availability checker that searches 100+ social media platforms and 36 domain extensions simultaneously.", "status": "live", "pricing": "free", "bestFor": "Quick username availability check across social media and domains", "input": "Username or domain name", "output": "Availability status across 100+ platforms and domain extensions", "opsec": "passive", "opsecNote": "Searches are routed through Namechk's servers; target accounts are not directly contacted by the user.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Thats Them", "type": "url", "url": "https://thatsthem.com/", "description": "Free people search engine aggregating data from 50+ sources. Supports lookups by name, address, phone number, or email.", "status": "live", "pricing": "freemium", "bestFor": "People search by name, email, phone, or address", "input": "Name, email address, phone number, or physical address", "output": "Contact info, residential details, demographics, and financial estimates", "opsec": "passive", "opsecNote": "Searches are routed through ThatsThem's servers; the target is not alerted.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "NameCheckup", "type": "url", "url": "https://namecheckup.com/", "description": "Free web-based username and domain availability checker that searches across 20+ social media platforms and 40+ domain extensions with WHOIS lookup support.", "status": "live", "pricing": "free", "bestFor": "Username and domain availability checking with WHOIS info", "input": "Username or domain name", "output": "Availability status across social platforms and domain extensions, with WHOIS data", "opsec": "passive", "opsecNote": "Searches are proxied through NameCheckup's servers; no direct contact with target platforms by the user.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "GitFive (T)", "type": "url", "url": "https://github.com/mxrch/GitFive", "description": "OSINT CLI tool for investigating GitHub profiles. Tracks username/name history, maps emails to accounts, extracts SSH public keys, and exports findings as JSON.", "status": "live", "pricing": "free", "bestFor": "Deep investigation of GitHub user profiles and email-to-account mapping", "input": "GitHub username or email address", "output": "Profile history, linked emails, SSH keys, repository analysis, JSON export", "opsec": "active", "opsecNote": "Queries GitHub API directly; developer recommends using a secondary GitHub account.", "localInstall": true, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Sherlock", "type": "url", "url": "https://github.com/sherlock-project/sherlock", "description": "Python CLI tool that hunts down social media accounts by username across 400+ social networks. Supports Tor routing, proxy configuration, and CSV/XLSX export.", "status": "live", "pricing": "free", "bestFor": "Mass username enumeration across 400+ sites", "input": "Username(s)", "output": "List of discovered profile URLs across social networks", "opsec": "active", "opsecNote": "Directly queries each target site to check username existence; supports Tor/proxy for anonymity.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Names Directory", "type": "url", "url": "https://namesdir.com/", "description": "Searchable database of 1B+ name combinations collected from public sources. Allows bidirectional lookup to find first names by surname or surnames by first name.", "status": "live", "pricing": "free", "bestFor": "Finding name combinations and frequency data for a given first or last name", "input": "First name or surname", "output": "Associated name combinations with frequency counts", "opsec": "passive", "opsecNote": "Queries a static public database; no contact with any target individual.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Lullar", "type": "url", "url": "https://com.lullar.com", "description": "Free people search and username lookup tool that searches across 148+ social media platforms including Instagram, TikTok, Facebook, and LinkedIn.", "status": "live", "pricing": "free", "bestFor": "Social media profile discovery by username, email, or name", "input": "Email address, full name, or username", "output": "Social media profiles found across 148+ platforms", "opsec": "passive", "opsecNote": "Searches are routed through Lullar's servers; no direct queries from the user to target platforms.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Specific Sites", "type": "folder", "children": [ { "name": "Amazon Usernames (M)", "type": "url", "url": "https://www.google.com/search?q=site:amazon.com+%3Cusername%3E", "description": "Google dork that searches Amazon.com for pages associated with a specific username, surfacing public profiles, wishlists, and reviews.", "status": "live", "pricing": "free", "bestFor": "Finding Amazon public profiles, wishlists, and review activity by username", "input": "Username (inserted into Google search query)", "output": "Google search results linking to Amazon pages mentioning the username", "opsec": "passive", "opsecNote": "Query goes to Google, not Amazon directly. Google may log the search but the target is not alerted.", "localInstall": false, "googleDork": true, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Github User (M)", "type": "url", "url": "https://api.github.com/users/%3Cusername%3E/events/public", "description": "Queries the GitHub public Events API to retrieve a user's recent public activity, including pushes, pull requests, issues, and other repository events.", "status": "live", "pricing": "free", "bestFor": "Enumerating a GitHub user's recent public activity and repository interactions", "input": "GitHub username (inserted into URL path)", "output": "JSON array of public events (pushes, PRs, issues, comments) with timestamps and repo details", "opsec": "passive", "opsecNote": "Unauthenticated API call; GitHub rate-limits by IP (60 req/hr) but does not notify the target user.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Tinder Usernames (M)", "type": "url", "url": "https://www.gotinder.com/@%3Cusername%3E", "description": "Accesses a Tinder user's public web profile via their username. The gotinder.com domain redirects to tinder.com.", "status": "live", "pricing": "free", "bestFor": "Confirming existence of a Tinder profile and viewing public profile details", "input": "Tinder username (appended to URL after @)", "output": "Public profile page with name, photo, and basic info if the user has web sharing enabled", "opsec": "passive", "opsecNote": "Simple HTTP GET to a public page; target is not notified of profile views via the web URL.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Keybase", "type": "url", "url": "https://keybase.io/", "description": "Platform for cryptographic identity verification, linking social media accounts, PGP keys, and cryptocurrency addresses to a single profile. Acquired by Zoom in 2020 but still operational.", "status": "live", "pricing": "free", "bestFor": "Looking up verified social accounts, PGP keys, and crypto wallets tied to a username", "input": "Username", "output": "User profile showing verified identities across platforms, PGP keys, cryptocurrency addresses, and devices", "opsec": "passive", "opsecNote": "Public profile lookups are passive web requests. No login required to view profiles.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "MIT PGP Key Server", "type": "url", "url": "https://pgp.mit.edu/", "description": "MIT PGP Public Key Server for searching, submitting, and removing PGP public keys. Look up keys by name, email, or key ID to find associated cryptographic identities.", "status": "live", "pricing": "free", "bestFor": "Looking up PGP public keys associated with a username or email address", "input": "Name, email address, or key ID", "output": "PGP public key data, key fingerprints, associated UIDs/email addresses, and key metadata", "opsec": "passive", "opsecNote": "Public key server query; no authentication required and target is not notified of lookups.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "ProtonMail users (M)", "type": "url", "url": "https://api.protonmail.ch/pks/lookup?op=index&search=@protonmail.com", "description": "Queries ProtonMail's HKP-compatible PGP key server to look up the public key for a ProtonMail username. A successful response confirms the account exists.", "status": "live", "pricing": "free", "bestFor": "Confirming whether a ProtonMail username exists and retrieving its PGP public key", "input": "ProtonMail username (appended with @protonmail.com)", "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", "opsec": "passive", "opsecNote": "Unauthenticated API query to ProtonMail's public key server. Target user is not notified. Enables user enumeration.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "ProtonMail Domains (M)", "type": "url", "url": "https://api.protonmail.ch/pks/lookup?op=index&search=", "description": "Queries ProtonMail's HKP key server with a full email address to check for a PGP public key. Useful for identifying ProtonMail users on custom domains.", "status": "live", "pricing": "free", "bestFor": "Checking if an email address on a custom domain is hosted on ProtonMail", "input": "Full email address (any domain that may be hosted on ProtonMail)", "output": "PGP key index with public key fingerprint, algorithm, creation timestamp, and email UID", "opsec": "passive", "opsecNote": "Unauthenticated public HKP endpoint. Target is not notified. Can reveal whether a custom domain uses ProtonMail.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": true, "invitationOnly": false, "deprecated": false } ] } ] }, { "name": "Email Address", "type": "folder", "children": [ { "name": "Email Search", "type": "folder", "children": [ { "name": "Sylva Identity Discovery (T)", "type": "url", "url": "https://sylva.pfeister.dev/", "description": "Identity discovery utility that searches GitHub and PGP key servers to link identities across platforms using email addresses, usernames, or PGP keys.", "status": "live", "pricing": "free", "bestFor": "Identity correlation via GitHub and PGP", "input": "Email, username, or PGP fingerprint", "output": "Linked identities, GitHub profiles, PGP keys", "opsec": "passive", "opsecNote": "Queries public GitHub and PGP servers without direct target contact.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "ThatsThem", "type": "url", "url": "https://thatsthem.com/reverse-email-lookup", "description": "Reverse email lookup tool that searches a database of hundreds of millions of emails to reveal name, address, phone number, and public records associated with an email address.", "status": "live", "pricing": "freemium", "bestFor": "Reverse email lookup, person identification", "input": "Email address", "output": "Name, address, phone number, education", "opsec": "passive", "opsecNote": "Queries ThatsThem's public database without alerting the target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Hunter", "type": "url", "url": "https://hunter.io/", "description": "Email finder and verifier that discovers business email addresses from company domains, names, and social profiles with up to 98% accuracy rate.", "status": "live", "pricing": "freemium", "bestFor": "Business email discovery, email verification", "input": "Domain name, person name, or company info", "output": "Verified business email addresses", "opsec": "passive", "opsecNote": "Queries Hunter's database of public emails; does not contact targets.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Email to Address (R)", "type": "url", "url": "https://www.melissa.com/", "description": "Melissa.com's data quality and verification service that validates and enriches email addresses with supplementary contact information.", "status": "live", "pricing": "paid", "bestFor": "Email validation, address enrichment", "input": "Email addresses, contact data", "output": "Validated email, postal address, phone", "opsec": "passive", "opsecNote": "Data verification service; does not perform reconnaissance.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "VoilaNorbert", "type": "url", "url": "https://www.voilanorbert.com/", "description": "Email finder and verifier with 98% success rate that discovers business emails by company/domain, person name, or LinkedIn profile with bulk upload capability.", "status": "live", "pricing": "freemium", "bestFor": "Business email discovery, bulk email finding", "input": "Domain, name, or LinkedIn URL", "output": "Business email addresses, verification status", "opsec": "passive", "opsecNote": "Searches public email database; does not contact targets directly.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "GHunt (T)", "type": "url", "url": "https://github.com/mxrch/GHunt", "description": "Offensive Google framework that investigates Google accounts using email addresses to uncover YouTube channels, Google Photos, Maps reviews, and associated artifacts.", "status": "live", "pricing": "free", "bestFor": "Google account investigation, YouTube/Google Photos OSINT", "input": "Gmail address or GAIA ID", "output": "YouTube channels, Google Photos, Maps reviews, device info", "opsec": "active", "opsecNote": "Requires Google login via browser extension; may be detected by Google.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "OSINT Industries", "type": "url", "url": "https://www.osint.industries/", "description": "Account linking service that extracts all registered accounts tied to an email or phone across 500+ platforms including social media, messaging apps, and lifestyle services.", "status": "live", "pricing": "freemium", "bestFor": "Account enumeration, breach detection, digital footprint mapping", "input": "Email address, phone number, username, or crypto wallet", "output": "Linked accounts, breach information, geospatial data, timeline", "opsec": "passive", "opsecNote": "Scours public websites and databases without contacting the target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", "status": "live", "pricing": "free", "bestFor": "Email harvesting, subdomain enumeration, passive recon", "input": "Domain name", "output": "Email addresses, subdomains, IPs, URLs", "opsec": "passive", "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Infoga (T)", "type": "url", "url": "https://github.com/m4ll0k/infoga", "description": "Python-based email OSINT tool that gathers email account information (IP, hostname, country) from search engines, PGP servers, and Shodan, with breach checking via haveibeenpwned.", "status": "live", "pricing": "free", "bestFor": "Early-stage email reconnaissance, information gathering", "input": "Email address", "output": "IP addresses, hostnames, country, breach status", "opsec": "passive", "opsecNote": "Queries search engines and public APIs without direct target contact.", "localInstall": true, "googleDork": true, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Skymem", "type": "url", "url": "https://www.skymem.info/", "description": "Email finder that discovers company and personal email addresses by domain or name, with bulk search, email list creation, and advanced filtering capabilities.", "status": "live", "pricing": "freemium", "bestFor": "Email discovery by domain, bulk email list creation", "input": "Domain name or person name + domain", "output": "Email addresses, bulk email lists", "opsec": "passive", "opsecNote": "Scrapes and aggregates public email data from websites and profiles.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Epieos Email Tool", "type": "url", "url": "https://tools.epieos.com/email.php", "description": "Freemium OSINT tool performing email reverse lookups to uncover associated social media profiles across 120+ websites and services with breach detection.", "status": "live", "pricing": "freemium", "bestFor": "Email reverse lookup, social media profile discovery", "input": "Email address or phone number", "output": "Associated social media profiles, forum posts, breach info", "opsec": "passive", "opsecNote": "Passive reconnaissance across 120+ websites; does not alert the target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "breach.vip", "type": "url", "url": "https://breach.vip/", "description": "Free database search engine providing access to 1000+ breach databases for research, email searching, and analysis of compromised credentials.", "status": "live", "pricing": "free", "bestFor": "Breach database search, credential lookup", "input": "Email, domain, Discord ID, or phone number", "output": "Breach records, leaked credentials", "opsec": "passive", "opsecNote": "Queries aggregated public breach databases.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Holehe (T)", "type": "url", "url": "https://github.com/megadose/holehe", "description": "Python-based email enumeration tool that checks if an email is registered across 120+ websites and services using password-reset mechanisms.", "status": "live", "pricing": "free", "bestFor": "Email account enumeration, service detection", "input": "Email address", "output": "List of websites where email is registered", "opsec": "passive", "opsecNote": "Uses password-reset functionality without sending emails or alerting targets.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Common Email Formats", "type": "folder", "children": [ { "name": "Email Format", "type": "url", "url": "https://www.email-format.com/", "description": "Tool for analyzing and discovering corporate email address patterns and formats to predict valid employee email addresses within an organization.", "status": "live", "pricing": "free", "bestFor": "Corporate email pattern analysis, email format discovery", "input": "Sample email addresses or company info", "output": "Predicted email format patterns", "opsec": "passive", "opsecNote": "Statistical analysis of publicly known email patterns.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Email Permutator", "type": "url", "url": "https://metricsparrow.com/toolkit/email-permutator/", "description": "OSINT tool that generates all possible email address combinations from a person's name and domain(s) for reconnaissance and email guessing.", "status": "live", "pricing": "free", "bestFor": "Email pattern generation, targeted email guessing", "input": "Person name, nickname, domain(s)", "output": "List of possible email address variations", "opsec": "passive", "opsecNote": "Generates permutations without any network contact.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Email Verification", "type": "folder", "children": [ { "name": "Reacher Github (T)", "type": "url", "url": "https://github.com/reacherhq/check-if-email-exists", "description": "Open-source Rust-based email verification API that checks email deliverability without sending messages, detecting catch-all and disposable addresses.", "status": "live", "pricing": "free", "bestFor": "Email verification, bounce detection, list cleaning", "input": "Email address", "output": "Deliverability status, MX records, bounce type", "opsec": "passive", "opsecNote": "Verifies email existence through MTA queries without sending mail.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Reacher Demo", "type": "url", "url": "https://reacher.email", "description": "Hosted demo of the Reacher email verification API allowing free testing of email validation and deliverability checks online.", "status": "live", "pricing": "free", "bestFor": "Email verification testing, demonstration", "input": "Email address", "output": "Deliverability status, bounce information", "opsec": "passive", "opsecNote": "Passive MTA-based verification without sending emails.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "MailScrap", "type": "url", "url": "https://mailscrap.com/", "description": "Email verification tool that connects to mail servers to verify mailbox existence and removes disposable email addresses from lists.", "status": "live", "pricing": "freemium", "bestFor": "Email validation, list cleaning, disposable email detection", "input": "Email addresses or email lists", "output": "Validation status, mailbox existence", "opsec": "passive", "opsecNote": "Connects to mail servers for verification without sending messages.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Read Notify", "type": "url", "url": "https://www.readnotify.com/", "description": "Email tracking and read receipt service that monitors email opens and engagement, useful for confirming email validity through delivery.", "status": "live", "pricing": "freemium", "bestFor": "Email delivery confirmation, read receipt tracking", "input": "Email address", "output": "Delivery and read status", "opsec": "active", "opsecNote": "Sends tracking pixels; may alert targets to monitoring.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Email Reputation", "type": "url", "url": "https://emailrep.io/", "description": "Tool that checks email reputation, risk scoring, and breach history to identify phishing emails, compromised accounts, and risky addresses.", "status": "live", "pricing": "free", "bestFor": "Email reputation checking, risk assessment", "input": "Email address", "output": "Reputation score, risk level, breach history", "opsec": "passive", "opsecNote": "Passive database lookup without target contact.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "MailboxValidator", "type": "url", "url": "https://www.mailboxvalidator.com/demo", "description": "Email verification API that validates email deliverability, detects catch-all addresses, and provides risk scoring for bulk email list cleaning.", "status": "live", "pricing": "paid", "bestFor": "Email validation, list cleaning, bounce prevention", "input": "Email addresses or bulk lists", "output": "Validation status, risk score, catch-all detection", "opsec": "passive", "opsecNote": "Server-based verification without sending emails.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "VerifyEmail (R$)", "type": "url", "url": "https://emailable.com/", "description": "Email verification service offering both free and premium tiers for validating email addresses and maintaining clean mailing lists.", "status": "live", "pricing": "freemium", "bestFor": "Email validation, list cleaning", "input": "Email addresses", "output": "Validation status, deliverability info", "opsec": "passive", "opsecNote": "Passive email verification without sending messages.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Breach Data", "type": "folder", "children": [ { "name": "Have I been pwned?", "type": "url", "url": "https://haveibeenpwned.com/", "description": "Database of breached credentials and email addresses from known data breaches.", "status": "live", "pricing": "freemium", "bestFor": "Breach detection, credential exposure checks", "input": "Email address, phone number, password hash", "output": "Breach names, breach dates, exposed data types", "opsec": "passive", "opsecNote": "Queries breach database via API. Target is not notified of lookups.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Hudson Rock", "type": "url", "url": "https://www.hudsonrock.com/threat-intelligence-cybercrime-tools", "description": "Infostealer threat intelligence platform that searches a database of compromised devices and stolen credentials to identify if emails have been exposed via malware infections.", "status": "live", "pricing": "freemium", "bestFor": "Infostealer detection, breach assessment, device compromise verification", "input": "Email address, domain, username, or IP", "output": "Infostealer hits, compromised account data, breach details", "opsec": "passive", "opsecNote": "Queries public infostealer database compiled from malware captures.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "DeHashed (R)", "type": "url", "url": "https://dehashed.com/", "description": "Modern breach search engine indexing historical breach data over a decade old, enabling searches by email, username, password, domain, phone, and IP address.", "status": "live", "pricing": "freemium", "bestFor": "Breach searching, credential lookup, historical breach analysis", "input": "Email, username, password, domain, phone, or IP", "output": "Breach records, exposed credentials, breach dates", "opsec": "passive", "opsecNote": "Searches aggregated public breach databases.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Vigilante.pw", "type": "url", "url": "https://www.vigilante.pw/", "description": "Breach database directory and search platform raising awareness of data breaches by aggregating publicly leaked database information and breach details.", "status": "live", "pricing": "free", "bestFor": "Breach research, public breach database navigation", "input": "Email, username, domain", "output": "Breach records, exposed data information", "opsec": "passive", "opsecNote": "Aggregates and indexes publicly disclosed breach data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Mail Blacklists", "type": "folder", "children": [ { "name": "MxToolbox", "type": "url", "url": "https://mxtoolbox.com/", "description": "Email deliverability diagnostics tool that checks MX records, SPF, DKIM, DMARC configuration, and server health to prevent email delivery issues.", "status": "live", "pricing": "free", "bestFor": "Email server diagnostics, deliverability testing, DNS validation", "input": "Domain name or email address", "output": "MX records, SPF/DKIM/DMARC status, blacklist info", "opsec": "passive", "opsecNote": "Public DNS lookups and SMTP diagnostics without target alerting.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] } ] }, { "name": "Domain Name", "type": "folder", "children": [ { "name": "Whois Records", "type": "folder", "children": [ { "name": "Domain Dossier", "type": "url", "url": "https://centralops.net/co/DomainDossier.aspx", "description": "Free web-based tool that aggregates WHOIS, DNS, and network information for domains and IP addresses into a single consolidated report.", "status": "live", "pricing": "free", "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data", "input": "Domain name or IP address", "output": "WHOIS records, DNS records, IP information, registration details", "opsec": "passive", "opsecNote": "Queries public WHOIS and DNS records; does not contact the target domain directly.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "domainIQ", "type": "url", "url": "https://www.domainiq.com/", "description": "Comprehensive domain intelligence platform offering reverse lookups, ownership history, and related domain discovery. Trusted by government agencies, domain investors, and legal firms.", "status": "live", "pricing": "freemium", "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research", "input": "Domain name", "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups", "opsec": "passive", "opsecNote": "Queries aggregated domain data; does not probe the target directly.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "DomainTools Whois", "type": "url", "url": "https://whois.domaintools.com/", "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response. The industry leader for threat intelligence and domain tracking.", "status": "live", "pricing": "paid", "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence", "input": "Domain name or IP address", "output": "Current and historical WHOIS records, registrant details, hosting history", "opsec": "passive", "opsecNote": "Queries cached WHOIS data; no direct contact with target infrastructure.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "SWITCH Internet Domains Whois (.ch)", "type": "url", "url": "https://www.nic.ch/whois/", "description": "Official Swiss domain registry WHOIS lookup service operated by SWITCH for .ch and .li country-code domains. Public registry with all owner contact details visible.", "status": "live", "pricing": "free", "bestFor": ".ch and .li domain ownership research, Swiss Internet infrastructure lookup", "input": ".ch or .li domain name", "output": "Registrant contact details, creation/expiry dates, nameservers, registration status", "opsec": "passive", "opsecNote": "Queries the official SWITCH registry database; does not probe the target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Whoisology", "type": "url", "url": "https://whoisology.com/#advanced", "description": "Searchable archive of billions of current and historical domain WHOIS records with cross-referencing capabilities. Designed for InfoSec, legal, and research professionals.", "status": "live", "pricing": "freemium", "bestFor": "Historical domain ownership, reverse WHOIS lookups, domain connection tracking", "input": "Domain name, email, registrant name", "output": "Historical WHOIS records, ownership changes, registrant information across domains", "opsec": "passive", "opsecNote": "Accesses archived WHOIS data; no direct probing of target domains.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Whois ARIN", "type": "url", "url": "https://whois.arin.net/ui/advanced.jsp", "description": "Official American Registry for Internet Numbers WHOIS and RDAP lookup service for IPv4, IPv6, ASNs, and organizations in the North American region.", "status": "live", "pricing": "free", "bestFor": "IP address and ASN registration data, North American internet resource tracking", "input": "IP address, ASN, organization name, contact information", "output": "IP ownership, organization details, Points of Contact (POCs), ASN information", "opsec": "passive", "opsecNote": "Queries official ARIN database; does not contact targets or perform active scanning.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "DNSstuff", "type": "url", "url": "https://www.dnsstuff.com/freetools", "description": "Suite of free DNS and network tools providing lookups, DNS checks, and WHOIS information for domain reconnaissance.", "status": "live", "pricing": "free", "bestFor": "Quick DNS and WHOIS lookups, network diagnostics", "input": "Domain name, IP address", "output": "DNS records, WHOIS data, DNS propagation checks, nameserver information", "opsec": "passive", "opsecNote": "Queries public DNS and WHOIS servers; does not probe target infrastructure.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Robtex (R)", "type": "url", "url": "https://robtex.com/", "description": "Comprehensive free DNS lookup and network intelligence tool with decade-spanning database containing billions of documents of internet data. Useful for forensics and threat actor tracking.", "status": "live", "pricing": "free", "bestFor": "DNS reconnaissance, IP and domain relationship mapping, historical internet data lookup", "input": "Domain name, IP address, hostname, autonomous system", "output": "DNS records, IP information, SEO data, reputation scores, historical relationships", "opsec": "passive", "opsecNote": "Searches historical and cached DNS data; does not perform active probing.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Domaincrawler.com", "type": "url", "url": "https://domaincrawler.com/", "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains with 80+ billion historical records since 2008. Used by brand protection and OSINT professionals.", "status": "live", "pricing": "paid", "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence", "input": "Domain name, DNS data, technology stack filters", "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data", "opsec": "passive", "opsecNote": "Queries aggregated domain database updated every 7 days; no active scanning of targets.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "MarkMonitor Whois Search", "type": "url", "url": "https://domains.markmonitor.com/whois/", "description": "ICANN-accredited registrar and brand protection company offering WHOIS lookup and domain management services. Exclusively serves corporate clients including major global brands.", "status": "live", "pricing": "paid", "bestFor": "Corporate domain portfolio management, brand protection, trademark monitoring", "input": "Domain name", "output": "WHOIS records, registration data, brand portfolio information", "opsec": "passive", "opsecNote": "Accesses standard WHOIS records through registered domain lookups; no direct target probing.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "easyWhois", "type": "url", "url": "https://www.easywhois.com/", "description": "Free domain WHOIS lookup and DNS tools service. Now operated under the DomainHelp platform, providing domain registration information and DNS lookups.", "status": "live", "pricing": "free", "bestFor": "Quick domain WHOIS lookups and DNS checks", "input": "Domain name", "output": "WHOIS records, DNS information, registrant details, nameservers", "opsec": "passive", "opsecNote": "Queries public WHOIS and DNS data; does not contact the target domain.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Website Informer", "type": "url", "url": "https://website.informer.com/", "description": "Free domain and website information aggregator providing visitor statistics, safety status, Alexa rankings, ownership data, and technical details about websites.", "status": "live", "pricing": "free", "bestFor": "Website profiling, ownership verification, traffic estimation, technical stack discovery", "input": "Domain name or URL", "output": "Visitor statistics, safety ratings, domain owner information, technology stack, Alexa rank, historical snapshots", "opsec": "passive", "opsecNote": "Aggregates public website data and statistics; does not contact the target infrastructure.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Who.is", "type": "url", "url": "https://who.is/", "description": "Comprehensive WHOIS and RDAP lookup service with large database of domain registration, DNS records, and IP information. Provides both current and historical data.", "status": "live", "pricing": "free", "bestFor": "Domain registration research, WHOIS lookups, RDAP queries, IP tracking", "input": "Domain name or IP address", "output": "WHOIS records, RDAP data, DNS records, nameservers, registrant information", "opsec": "passive", "opsecNote": "Queries public WHOIS and RDAP databases; does not perform active scanning.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Whois AMPed", "type": "url", "url": "https://whoisamped.com/", "description": "Mobile-optimized WHOIS lookup service accessible via web interface for domain registration information and WHOIS queries.", "status": "live", "pricing": "free", "bestFor": "Mobile-friendly WHOIS lookups, quick domain information retrieval", "input": "Domain name", "output": "WHOIS records, domain registration information, registrant details", "opsec": "passive", "opsecNote": "Accesses public WHOIS data; no target probing or direct contact.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "ViewDNS.info", "type": "url", "url": "https://viewdns.info/", "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.", "status": "live", "pricing": "free", "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking", "input": "Domain name, IP address, registrant name/email, nameserver", "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes", "opsec": "passive", "opsecNote": "Queries public DNS and WHOIS data; does not perform active probing of targets.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Daily DNS Changes", "type": "url", "url": "https://dailychanges.domaintools.com/", "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", "status": "live", "pricing": "freemium", "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", "input": "Domain name", "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", "opsec": "passive", "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "IP2WHOIS", "type": "url", "url": "https://www.ip2whois.com", "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.", "status": "live", "pricing": "free", "bestFor": "Domain and IP WHOIS lookups, registrant research", "input": "Domain name or IP address", "output": "WHOIS records, registrant details, location information, registration dates", "opsec": "passive", "opsecNote": "Queries public WHOIS databases; does not contact the target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Netlas.io", "type": "url", "url": "https://app.netlas.io/whois_domains/", "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", "status": "live", "pricing": "freemium", "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", "input": "Domain name, IP address, ASN, DNS records", "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", "opsec": "passive", "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Subdomains", "type": "folder", "children": [ { "name": "SynapsInt", "type": "url", "url": "https://synapsint.com", "description": "Unified web-based OSINT research platform supporting domain, IP, SSL, analytics, email, phone, and social media lookups with subdomain enumeration.", "status": "live", "pricing": "free", "bestFor": "Unified OSINT research, subdomain discovery, multi-vector intelligence gathering", "input": "Domain, IP, email, phone, username, CVE ID", "output": "Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data", "opsec": "passive", "opsecNote": "Aggregates publicly available information from multiple sources; no direct target contact.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Aquatone (T)", "type": "url", "url": "https://github.com/michenriksen/aquatone", "description": "Go-based tool for domain reconnaissance that automates subdomain discovery, HTTP service scanning, screenshot capture, and visual HTML report generation for attack surface analysis.", "status": "live", "pricing": "free", "bestFor": "Visual subdomain reconnaissance, HTTP service discovery, attack surface mapping", "input": "Domain name", "output": "Discovered subdomains, open ports, HTTP screenshots, consolidated reconnaissance report", "opsec": "active", "opsecNote": "Makes HTTP requests to discovered hosts to capture screenshots and fingerprint services; supports integration with passive enumeration tools.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "FindSubDomains", "type": "url", "url": "https://findsubdomains.com/", "description": "Free web-based automated subdomain discovery tool with filtering and analysis capabilities, showing organization names, relationships, and top subdomain statistics.", "status": "live", "pricing": "free", "bestFor": "Automated subdomain enumeration, organization name filtering, subdomain statistics", "input": "Domain name or keyword", "output": "Discovered subdomains, organization associations, popularity metrics, filtering options", "opsec": "passive", "opsecNote": "Uses passive DNS and search-based methods for subdomain discovery; no active probing.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Google Subdomains (D)", "type": "url", "url": "https://www.google.com/?gws_rd=ssl#q=site:%3Cdomain.com%3E", "description": "Google Dork technique using the 'site:' operator to enumerate subdomains of a target domain via Google's search index.", "status": "live", "pricing": "free", "bestFor": "Indexed subdomain discovery, publicly visible subdomain enumeration", "input": "Domain name (as Google Dork syntax: site:domain.com)", "output": "Indexed subdomains and pages from Google search results", "opsec": "passive", "opsecNote": "Uses Google's search index; no direct contact with the target domain.", "localInstall": false, "googleDork": true, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Recon-ng (T)", "type": "url", "url": "https://github.com/lanmaster53/recon-ng", "description": "Full-featured web reconnaissance framework with independent modules for data gathering.", "status": "live", "pricing": "free", "bestFor": "Modular web recon, API-driven data collection", "input": "Domain, company name, email, IP", "output": "Contacts, hosts, credentials, ports via module-specific results", "opsec": "passive", "opsecNote": "Queries third-party APIs and data sources. Does not probe the target unless specific modules are configured to do so.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "XRay", "type": "url", "url": "https://github.com/evilsocket/xray", "description": "Go-based network reconnaissance tool that automates subdomain enumeration via DNS brute force, integrates Shodan for port discovery, and gathers banner information with web UI visualization.", "status": "live", "pricing": "free", "bestFor": "Automated subdomain discovery with banner grabbing, open port enumeration, Shodan integration", "input": "Domain name, subdomain wordlist, Shodan API key (optional), ViewDNS API key (optional)", "output": "Enumerated subdomains, open ports, banner information, historical data, web-based results UI", "opsec": "active", "opsecNote": "Performs DNS brute force for subdomain enumeration and makes banner grabbing connections to discovered services.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "DNS Recon (T)", "type": "url", "url": "https://github.com/darkoperator/dnsrecon", "description": "Python-based DNS enumeration script supporting zone transfers, standard record enumeration, TLD expansion, DNS brute force, and PTR lookups.", "status": "live", "pricing": "free", "bestFor": "DNS enumeration, zone transfer testing, subdomain brute forcing, DNS security assessment", "input": "Domain name, IP range/CIDR, subdomain wordlist, DNS server address", "output": "NS/SOA/MX/A records, discovered subdomains, zone transfer results, PTR records, wildcard resolution status", "opsec": "active", "opsecNote": "Performs active DNS queries and brute force attempts; does not probe target services directly but makes repeated DNS requests.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Gobuster (T)", "type": "url", "url": "https://github.com/OJ/gobuster" }, { "name": "Fierce Domain Scanner (T)", "type": "url", "url": "https://github.com/davidpepper/fierce-domain-scanner" }, { "name": "Bluto (T)", "type": "url", "url": "https://github.com/darryllane/Bluto" }, { "name": "OWASP Maryam (T)", "type": "url", "url": "https://github.com/saeeddhqan/Maryam" }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", "status": "live", "pricing": "free", "bestFor": "Email harvesting, subdomain enumeration, passive recon", "input": "Domain name", "output": "Email addresses, subdomains, IPs, URLs", "opsec": "passive", "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Pentest-tools.com Subdomains", "type": "url", "url": "https://pentest-tools.com/information-gathering/find-subdomains-of-domain" }, { "name": "SecLists DNS Subdomains (T)", "type": "url", "url": "https://github.com/danielmiessler/SecLists/tree/master/Discovery/DNS" }, { "name": "dnspop (T)", "type": "url", "url": "https://github.com/bitquark/dnspop" }, { "name": "gdns (T)", "type": "url", "url": "https://github.com/hrbrmstr/gdns" }, { "name": "Sublist3r", "type": "url", "url": "https://github.com/aboul3la/Sublist3r" }, { "name": "AltDNS (T)", "type": "url", "url": "https://github.com/infosec-au/altdns" }, { "name": "Netlas.io", "type": "url", "url": "https://app.netlas.io/domains/", "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", "status": "live", "pricing": "freemium", "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", "input": "Domain name, IP address, ASN, DNS records", "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", "opsec": "passive", "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Discovery", "type": "folder", "children": [ { "name": "Shodan", "type": "url", "url": "https://www.shodan.io/", "description": "Search engine for internet-connected devices. Find open ports, services, and vulnerabilities across the public internet.", "status": "live", "pricing": "freemium", "bestFor": "Port scanning, banner grabbing, IoT discovery", "input": "IP address, domain", "output": "Open ports, services, banners, CVEs", "opsec": "passive", "opsecNote": "Queries cached scan data. Does not directly probe the target.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Netlas.io", "type": "url", "url": "https://app.netlas.io/", "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", "status": "live", "pricing": "freemium", "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", "input": "Domain name, IP address, ASN, DNS records", "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", "opsec": "passive", "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Kraken (T)", "type": "url", "url": "https://github.com/Sw4mpf0x/Kraken" }, { "name": "Online Nikto scanner", "type": "url", "url": "https://nikto.online/" }, { "name": "urlscan.io", "type": "url", "url": "https://urlscan.io/search/#*" }, { "name": "Daily DNS Changes", "type": "url", "url": "https://dailychanges.domaintools.com/", "description": "DomainTools service monitoring DNS record changes across domains, detecting newly registered subdomains and tracking DNS infrastructure modifications.", "status": "live", "pricing": "freemium", "bestFor": "DNS change detection, subdomain discovery, infrastructure monitoring", "input": "Domain name", "output": "New DNS records, nameserver changes, subdomain discoveries, historical DNS changes", "opsec": "passive", "opsecNote": "Monitors public DNS records for changes; no active scanning or direct contact.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Redirect Detective", "type": "url", "url": "https://redirectdetective.com/" }, { "name": "Sitediff (T)", "type": "url", "url": "https://github.com/digininja/sitediff" }, { "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", "status": "live", "pricing": "freemium", "bestFor": "Technology stack identification, competitor analysis", "input": "Domain or URL", "output": "Technology list, analytics IDs, hosting info, historical tech changes", "opsec": "passive", "opsecNote": "Queries cached technology profiles. Does not contact the target.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Wappalyzer", "type": "url", "url": "https://www.wappalyzer.com/" }, { "name": "AnalyzeID", "type": "url", "url": "https://analyzeid.com/" }, { "name": "Criminal IP Search", "type": "url", "url": "https://www.criminalip.io/" }, { "name": "urlDNA", "type": "url", "url": "https://urldna.io" }, { "name": "ZoomEye.ai", "type": "url", "url": "https://www.zoomeye.org/" } ] }, { "name": "Certificate Search", "type": "folder", "children": [ { "name": "Shodan", "type": "url", "url": "https://www.shodan.io/" }, { "name": "Google's Certificate Transparency", "type": "url", "url": "https://www.certificate-transparency.org/known-logs" }, { "name": "Spyse", "type": "url", "url": "https://spyse.com/search/certificate" }, { "name": "Censys", "type": "url", "url": "https://censys.io/", "description": "Internet-wide scanner and search engine for hosts, certificates, and services.", "status": "live", "pricing": "freemium", "bestFor": "Certificate discovery, host enumeration, exposure monitoring", "input": "Domain, IP, certificate fingerprint, search query", "output": "Host details, open ports, TLS certificates, service banners", "opsec": "passive", "opsecNote": "Queries pre-scanned data. Does not probe the target directly.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "crt.sh - Certificate Search", "type": "url", "url": "https://crt.sh/?" }, { "name": "CertKit - Certificate Transparency Log Search", "type": "url", "url": "https://www.certkit.io/tools/ct-logs/" }, { "name": "certgraph (T)", "type": "url", "url": "https://github.com/lanrat/certgraph" }, { "name": "Netlas.io", "type": "url", "url": "https://app.netlas.io/certs/", "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.", "status": "live", "pricing": "freemium", "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research", "input": "Domain name, IP address, ASN, DNS records", "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data", "opsec": "passive", "opsecNote": "Queries cached internet scanning data; free tier available with 50 daily requests.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "PassiveDNS", "type": "folder", "children": [ { "name": "Mnemonic", "type": "url", "url": "https://passivedns.mnemonic.no/" }, { "name": "DNS Dumpster", "type": "url", "url": "https://dnsdumpster.com/" }, { "name": "Deteque (R)", "type": "url", "url": "https://www.deteque.com/" } ] }, { "name": "Reputation", "type": "folder", "children": [ { "name": "UrlQuery.net", "type": "url", "url": "https://urlquery.net/" }, { "name": "URL Void", "type": "url", "url": "https://www.urlvoid.com/" }, { "name": "FortiGuard Reputation Service", "type": "url", "url": "https://fortiguard.com/iprep" }, { "name": "Trend Micro Site Safety Center", "type": "url", "url": "https://global.sitesafety.trendmicro.com/" }, { "name": "WatchGuard ReputationAuthority", "type": "url", "url": "https://www.reputationauthority.org/" }, { "name": "Sucuri SiteCheck", "type": "url", "url": "https://sitecheck.sucuri.net/" }, { "name": "ThreatMiner.org", "type": "url", "url": "https://www.threatminer.org/" }, { "name": "BlueCoat WebPulse", "type": "url", "url": "https://sitereview.bluecoat.com/sitereview.jsp" }, { "name": "Zscaler Zulu URL Risk Analyzer", "type": "url", "url": "https://zulu.zscaler.com/" }, { "name": "Joe Sandbox Url Analyzer", "type": "url", "url": "https://www.url-analyzer.net/" }, { "name": "Deepviz Domain Search", "type": "url", "url": "https://search.deepviz.com/" }, { "name": "AVG Threat Labs", "type": "url", "url": "https://www.avg.com/en/signal/website-safety" }, { "name": "Webroot BrightCloud URL/IP Lookup", "type": "url", "url": "https://www.brightcloud.com/tools/url-ip-lookup.php" }, { "name": "vURL Online", "type": "url", "url": "https://vurldissect.co.uk/" }, { "name": "AlienVault Open Threat Exchange", "type": "url", "url": "https://otx.alienvault.com/browse/pulses/" }, { "name": "Malware Domain List", "type": "url", "url": "https://www.malwaredomainlist.com/mdl.php" }, { "name": "Web Inspector Online Scan", "type": "url", "url": "https://www.webinspector.com/website-malware-scanner/" }, { "name": "Google Safe Browsing API", "type": "url", "url": "https://developers.google.com/safe-browsing/?csw=1" }, { "name": "Cisco Talos", "type": "url", "url": "https://talosintelligence.com/" } ] }, { "name": "Domain Blacklists", "type": "folder", "children": [ { "name": "Threatexpert.com Malicious URLs", "type": "url", "url": "https://www.networksec.org/grabbho/block.txt" }, { "name": "Zeus C2 Tracker", "type": "url", "url": "https://zeustracker.abuse.ch/blocklist.php?download=domainblocklist" }, { "name": "Malware Domains Blacklist", "type": "url", "url": "https://mirror1.malwaredomains.com/files/domains.txt" }, { "name": "Blackweb", "type": "url", "url": "https://github.com/maravento/blackweb" }, { "name": "Critical Stack Intel (R)", "type": "url", "url": "https://intel.criticalstack.com/" }, { "name": "DNS Sinkhole", "type": "url", "url": "https://malc0de.com/bl/" }, { "name": "DNS-BH Malware Domain Blocklist", "type": "url", "url": "https://www.malwaredomains.com/wordpress/?page_id=66" }, { "name": "Malware Domain List", "type": "url", "url": "https://www.malwaredomainlist.com/hostslist/hosts.txt" }, { "name": "MalwareURL (R)", "type": "url", "url": "https://www.malwareurl.com/index.php" }, { "name": "scumware.org", "type": "url", "url": "https://www.scumware.org/" }, { "name": "ZeuS Tracker", "type": "url", "url": "https://zeustracker.abuse.ch/blocklist.php" }, { "name": "Shadowserver Foundation", "type": "url", "url": "https://www.shadowserver.org/" }, { "name": "Email Domain Validation", "type": "url", "url": "https://www.mailboxvalidator.com/domain" } ] }, { "name": "Typosquatting", "type": "folder", "children": [ { "name": "DNS Twist (T)", "type": "url", "url": "https://github.com/elceef/dnstwist" }, { "name": "URLCrazy (T)", "type": "url", "url": "https://www.morningstarsecurity.com/research/urlcrazy" }, { "name": "dnstwister", "type": "url", "url": "https://dnstwister.report/" }, { "name": "Catphish (T)", "type": "url", "url": "https://github.com/ring0lab/catphish" } ] }, { "name": "Analytics", "type": "folder", "children": [ { "name": "BuiltWith", "type": "url", "url": "https://builtwith.com/", "description": "Technology profiler that identifies the tech stack, analytics, and frameworks used by websites.", "status": "live", "pricing": "freemium", "bestFor": "Technology stack identification, competitor analysis", "input": "Domain or URL", "output": "Technology list, analytics IDs, hosting info, historical tech changes", "opsec": "passive", "opsecNote": "Queries cached technology profiles. Does not contact the target.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "SiteSleuth", "type": "url", "url": "https://www.sitesleuth.io/" }, { "name": "Wappalyzer (T)", "type": "url", "url": "https://www.wappalyzer.com/" }, { "name": "SEMrush", "type": "url", "url": "https://www.semrush.com/" }, { "name": "Moonsearch", "type": "url", "url": "https://moonsearch.com/" }, { "name": "Ewhois", "type": "url", "url": "https://ewhois.com/" }, { "name": "StatsCrop", "type": "url", "url": "https://www.statscrop.com/" }, { "name": "Open Site Explorer", "type": "url", "url": "https://moz.com/link-explorer" }, { "name": "SpyOnWeb", "type": "url", "url": "https://www.spyonweb.com/" }, { "name": "Keyword Density", "type": "url", "url": "https://tools.seobook.com/general/keyword-density/" }, { "name": "Alexa Site Statistics", "type": "url", "url": "https://alexa.amazon.com/about" }, { "name": "Cisco Umbrella Popularity List", "type": "url", "url": "https://s3-us-west-1.amazonaws.com/umbrella-static/index.html" }, { "name": "Alexa Top 500 Global Sites", "type": "url", "url": "https://alexa.amazon.com/about" }, { "name": "Sitedossier", "type": "url", "url": "https://www.sitedossier.com/" }, { "name": "Visual Site Mapper", "type": "url", "url": "https://github.com/alentum/sitemapper-nodejs" }, { "name": "ClearWebStats.com", "type": "url", "url": "https://www.clearwebstats.com/" }, { "name": "PubDB", "type": "url", "url": "https://pub-db.com/" }, { "name": "SimilarWeb", "type": "url", "url": "https://www.similarweb.com/" }, { "name": "Siteliner", "type": "url", "url": "https://www.siteliner.com/" }, { "name": "WhatWeb", "type": "url", "url": "https://github.com/urbanadventurer/WhatWeb" } ] }, { "name": "URL Expanders", "type": "folder", "children": [ { "name": "Link Expander", "type": "url", "url": "https://www.linkexpander.com/" }, { "name": "CheckShortURL", "type": "url", "url": "https://checkshorturl.com/" }, { "name": "URL Expander", "type": "url", "url": "https://urlex.org/" }, { "name": "Where Does This Link Go?", "type": "url", "url": "https://wheregoes.com/" }, { "name": "KnowURL", "type": "url", "url": "https://www.knowurl.com/" } ] }, { "name": "Change Detection", "type": "folder", "children": [ { "name": "VisualPing", "type": "url", "url": "https://visualping.io:443/" }, { "name": "Change Detection", "type": "url", "url": "https://visualping.io/" }, { "name": "Check site availability Online", "type": "url", "url": "https://upcheck.online/" }, { "name": "Follow That Page", "type": "url", "url": "https://www.followthatpage.com/", "description": "Website monitoring service that checks pages for changes and sends alerts when tracked content updates. Supports keyword-based notifications for focused monitoring.", "status": "live", "pricing": "freemium", "bestFor": "Tracking updates on specific web pages by keyword", "input": "Target page URL and optional keyword filters", "output": "Email alerts showing detected page changes", "opsec": "passive", "opsecNote": "Monitoring requests are performed by Follow That Page infrastructure rather than directly from the investigator's workstation.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Urlwatch", "type": "url", "url": "https://github.com/thp/urlwatch", "description": "Open-source Python CLI tool for monitoring webpages and feeds for changes. Supports multiple filters, reporters, and scheduled checks via local automation.", "status": "live", "pricing": "free", "bestFor": "Self-hosted web page change monitoring automation", "input": "URLs, feeds, and local watch configuration", "output": "Diffs and alerts through email, console, or integrations", "opsec": "passive", "opsecNote": "Can run locally or on controlled infrastructure, allowing investigators to manage request origin and monitoring cadence.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "WatchThatPage", "type": "url", "url": "https://watchthatpage.com/", "description": "Web-based page monitoring platform that detects content changes and notifies users by email. Useful for tracking updates on websites without RSS feeds.", "status": "live", "pricing": "freemium", "bestFor": "Monitoring static web pages for updates over time", "input": "Web page URL and watch configuration", "output": "Email notifications and change history snapshots", "opsec": "passive", "opsecNote": "Page checks originate from WatchThatPage systems instead of directly from the investigator.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "ChangeDetect", "type": "url", "url": "https://changedetection.io/", "description": "Open-source website change detection platform with both self-hosted and hosted options. Supports visual diffs, notifications, and automation workflows.", "status": "live", "pricing": "freemium", "bestFor": "Flexible page change monitoring with self-hosted control", "input": "Target URL and optional monitoring rules/selectors", "output": "Change alerts, snapshots, and webhook/integration notifications", "opsec": "passive", "opsecNote": "When self-hosted, investigators control infrastructure and request origin; hosted mode proxies checks through provider systems.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Social Analysis", "type": "folder", "children": [ { "name": "Google Trends", "type": "url", "url": "https://trends.google.com/trends/", "description": "Google analytics interface for comparing search interest trends across terms, regions, and time windows. Includes related queries and topic momentum insights.", "status": "live", "pricing": "free", "bestFor": "Tracking public interest shifts in terms and topics", "input": "Keywords, geography, category, and date range filters", "output": "Relative search-interest graphs and related-query suggestions", "opsec": "passive", "opsecNote": "Queries are conducted within Google's public trends interface and do not directly interact with investigation targets.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "DNSSEC", "type": "folder", "children": [ { "name": "DNSSEC Analyzer", "type": "url", "url": "https://dnssec-analyzer.verisignlabs.com/" }, { "name": "DNSViz", "type": "url", "url": "https://dnsviz.net/", "description": "DNS and DNSSEC analysis platform that visualizes delegation chains and cryptographic validation paths. Helps diagnose trust and signing issues in domain configurations.", "status": "live", "pricing": "free", "bestFor": "Visual DNSSEC validation and DNS misconfiguration analysis", "input": "Domain name", "output": "DNS resolution graphs, DNSSEC status, and validation diagnostics", "opsec": "passive", "opsecNote": "Analysis runs against public DNS infrastructure without direct interaction with domain owners.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Vulnerabilities", "type": "folder", "children": [ { "name": "Scanners", "type": "folder", "children": [ { "name": "Sn1per (T)", "type": "url", "url": "https://github.com/1N3/Sn1per", "description": "Automated reconnaissance and penetration testing framework that orchestrates vulnerability scans and attack-surface discovery workflows.", "status": "live", "pricing": "freemium", "bestFor": "Automated offensive security reconnaissance pipelines", "input": "Target domains, hosts, ranges, or web applications", "output": "Consolidated scan findings, vulnerabilities, and recon artifacts", "opsec": "active", "opsecNote": "Directly probes target infrastructure and can generate detectable scanning traffic.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", "url": "https://nikto.online/", "description": "Web-based interface for running Nikto vulnerability checks against web servers. Provides quick external testing without local deployment.", "status": "live", "pricing": "free", "bestFor": "Quick browser-based web server vulnerability scanning", "input": "Target website URL or host", "output": "Nikto scan report of detected web server issues", "opsec": "active", "opsecNote": "Initiates direct security probing of target web servers and is likely to be logged by defenders.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "WDES - Web Data Exposure Scanner (T)", "type": "url", "url": "https://github.com/eduardoit/web-data-exposure-scanner" } ] }, { "name": "Disclosure Sites", "type": "folder", "children": [ { "name": "Zone-H.org", "type": "url", "url": "https://zone-h.org/archive", "description": "Archive of reported website defacements and related incident metadata maintained by the Zone-H community.", "status": "live", "pricing": "free", "bestFor": "Historical tracking of website defacement incidents", "input": "Search terms, domains, or browsing archive filters", "output": "Defacement records with timestamps and mirrored evidence", "opsec": "passive", "opsecNote": "Uses a third-party archive and does not require direct interaction with target infrastructure.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "RobotsDisallowed", "type": "url", "url": "https://github.com/danielmiessler/RobotsDisallowed", "description": "Curated wordlist derived from robots.txt disallow paths, used for discovery and content enumeration in security testing.", "status": "live", "pricing": "free", "bestFor": "Directory and content discovery wordlist generation", "input": "Wordlist consumption by scanners/fuzzers", "output": "Path candidates likely to expose sensitive or hidden content", "opsec": "passive", "opsecNote": "Repository usage is passive; OPSEC risk comes from downstream active scanning tools that consume the list.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Tools", "type": "folder", "children": [ { "name": "Belati (T)", "type": "url", "url": "https://github.com/aancw/Belati", "description": "Python OSINT framework that aggregates data from multiple online sources and automates collection workflows for investigations.", "status": "live", "pricing": "free", "bestFor": "CLI-based multi-source OSINT collection automation", "input": "Investigation keywords, handles, domains, or entity identifiers", "output": "Collected artifacts from integrated OSINT data sources", "opsec": "passive", "opsecNote": "Collection relies on public-source queries; risk depends on enabled modules and target-facing lookups.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Burp Suite (T)", "type": "url", "url": "https://portswigger.net/burp", "description": "Web security testing suite for intercepting, manipulating, and scanning HTTP(S) traffic in web application assessments.", "status": "live", "pricing": "freemium", "bestFor": "Manual and automated web application security testing", "input": "Target web application traffic and scan targets", "output": "Intercepted requests, vulnerability findings, and test artifacts", "opsec": "active", "opsecNote": "Active testing traffic is sent to targets and can trigger alerts or defensive controls.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "EyeWitness (T)", "type": "url", "url": "https://github.com/ChrisTruncer/EyeWitness", "description": "Reconnaissance tool that captures screenshots of web services and helps identify technologies and exposed login interfaces at scale.", "status": "live", "pricing": "free", "bestFor": "Visual triage of large target lists and exposed services", "input": "List of URLs, hosts, or network service endpoints", "output": "Screenshots, service metadata, and summary HTML reports", "opsec": "passive", "opsecNote": "Primarily collects presentation-layer snapshots; network requests are still sent to targets but with lower interaction depth than exploit scans.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Hunting-New-Registered-Domains (T)", "type": "url", "url": "https://github.com/gfek/Hunting-New-Registered-Domains", "description": "OSINT workflow and scripts focused on identifying newly registered domains likely associated with phishing and brand abuse.", "status": "live", "pricing": "free", "bestFor": "Detecting suspicious newly registered domains for threat hunting", "input": "Keywords, domain feeds, and candidate domain lists", "output": "Prioritized domain candidates for further investigation", "opsec": "passive", "opsecNote": "Analysis is based on external data sources and does not require direct target interaction by default.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "International Domain Name Conversion Tool", "type": "url", "url": "https://mct.verisign-grs.com/", "description": "Web utility for converting internationalized domain names between Unicode and Punycode representations.", "status": "live", "pricing": "free", "bestFor": "IDN normalization and Unicode/Punycode translation", "input": "Domain name in Unicode or Punycode format", "output": "Converted domain representation in alternate encoding", "opsec": "passive", "opsecNote": "Conversion operations are deterministic and do not involve contacting investigation targets.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Online Nikto scanner", "type": "url", "url": "https://nikto.online/", "description": "Browser-based Nikto scanning endpoint for identifying common web server misconfigurations and known weaknesses.", "status": "live", "pricing": "free", "bestFor": "Fast external vulnerability checks against web targets", "input": "Website URL or host target", "output": "Web vulnerability scan results and issue summary", "opsec": "active", "opsecNote": "Performs active probing against target systems that may be detected and logged.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Report Malicious Sites", "type": "folder", "children": [ { "name": "Microsoft", "type": "url", "url": "https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest" }, { "name": "Google", "type": "url", "url": "https://safebrowsing.google.com/safebrowsing/report_phish/?hl=en" } ] } ] }, { "name": "Cloud Infrastructure", "type": "folder", "children": [ { "name": "AWS Enumeration", "type": "folder", "children": [ { "name": "cloud_enum (T)", "type": "url", "url": "https://github.com/initstring/cloud_enum" }, { "name": "AWSBucketDump (T)", "type": "url", "url": "https://github.com/jordanpotti/AWSBucketDump" }, { "name": "Subfinder (T)", "type": "url", "url": "https://github.com/projectdiscovery/subfinder" } ] }, { "name": "Azure/GCP Discovery", "type": "folder", "children": [ { "name": "GCPBucketBrute (T)", "type": "url", "url": "https://github.com/RhinoSecurityLabs/GCPBucketBrute" }, { "name": "AADInternals (T)", "type": "url", "url": "https://github.com/Gerenios/AADInternals" }, { "name": "ROADtools (T)", "type": "url", "url": "https://github.com/dirkjanm/roadtools" }, { "name": "MicroBurst (T)", "type": "url", "url": "https://github.com/NetSPI/MicroBurst" }, { "name": "Stormspotter (T)", "type": "url", "url": "https://github.com/Azure/Stormspotter" } ] }, { "name": "S3/Blob Storage", "type": "folder", "children": [ { "name": "Public Buckets", "type": "url", "url": "https://buckets.grayhatwarfare.com/" }, { "name": "goblob (T)", "type": "url", "url": "https://github.com/Macmod/goblob" }, { "name": "S3Scanner (T)", "type": "url", "url": "https://github.com/sa7mon/s3scanner" }, { "name": "BucketLoot (T)", "type": "url", "url": "https://github.com/redhuntlabs/BucketLoot" }, { "name": "lazys3 (T)", "type": "url", "url": "https://github.com/nahamsec/lazys3" } ] }, { "name": "Cloud Configuration Analysis", "type": "folder", "children": [ { "name": "Prowler (T)", "type": "url", "url": "https://github.com/prowler-cloud/prowler" }, { "name": "ScoutSuite (T)", "type": "url", "url": "https://github.com/nccgroup/ScoutSuite" }, { "name": "Cloud Custodian (T)", "type": "url", "url": "https://github.com/cloud-custodian/cloud-custodian" }, { "name": "Checkov (T)", "type": "url", "url": "https://github.com/bridgecrewio/checkov" }, { "name": "Steampipe (T)", "type": "url", "url": "https://github.com/turbot/steampipe" } ] }, { "name": "SaaS Footprinting", "type": "folder", "children": [ { "name": "Amass (T)", "type": "url", "url": "https://github.com/owasp-amass/amass" }, { "name": "Sublist3r (T)", "type": "url", "url": "https://github.com/aboul3la/Sublist3r" }, { "name": "theHarvester (T)", "type": "url", "url": "https://github.com/laramies/theHarvester", "description": "Command-line tool for gathering emails, subdomains, IPs, and URLs from public sources.", "status": "live", "pricing": "free", "bestFor": "Email harvesting, subdomain enumeration, passive recon", "input": "Domain name", "output": "Email addresses, subdomains, IPs, URLs", "opsec": "passive", "opsecNote": "Queries third-party search engines and APIs. Does not contact the target directly.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "SpiderFoot (T)", "type": "url", "url": "https://github.com/smicallef/spiderfoot", "description": "Automated OSINT collection tool with 200+ modules for reconnaissance and threat intelligence.", "status": "live", "pricing": "free", "bestFor": "Automated recon, attack surface mapping, threat intelligence", "input": "Domain, IP, email, name, phone, subnet", "output": "Correlated intelligence graph, structured findings across modules", "opsec": "active", "opsecNote": "Some modules actively probe targets. Review module settings before running.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "dnsrecon (T)", "type": "url", "url": "https://github.com/darkoperator/dnsrecon" } ] } ] }, { "name": "IP & MAC Address", "type": "folder", "children": [ { "name": "Geolocation", "type": "folder", "children": [ { "name": "MaxMind Demo", "type": "url", "url": "https://www.maxmind.com/en/home", "description": "Web-based IP geolocation demo with location, ASN, and network data from MaxMind's GeoIP database.", "status": "live", "pricing": "free", "bestFor": "Quick IP geolocation", "input": "IP address", "output": "Country, region, city, coordinates, ASN", "opsec": "passive", "opsecNote": "Queries MaxMind; submissions logged.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "IPv4/IPv6 lists by country code", "type": "url", "url": "https://github.com/ipverse/", "description": "Database of IPv4 and IPv6 address ranges organized by country for geographic IP filtering.", "status": "live", "pricing": "free", "bestFor": "Country-level IP enumeration", "input": "Country code", "output": "IP ranges in CIDR notation", "opsec": "passive", "opsecNote": "Passive lookup of public IP allocations.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "IP2Location.com", "type": "url", "url": "https://www.ip2location.com/demo", "description": "Commercial IP geolocation service with free demo and database. Provides location, proxy detection, and network data.", "status": "live", "pricing": "freemium", "bestFor": "Accurate geolocation with proxy detection", "input": "IP address", "output": "Location, ASN, proxy type, VPN status, timezone", "opsec": "passive", "opsecNote": "Passive database lookup; free tier limited.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "IP Fingerprints", "type": "url", "url": "https://ipfingerprints.com/", "description": "Reverse IP lookup service identifying all domains hosted on a given IP address.", "status": "live", "pricing": "free", "bestFor": "Find domains on shared hosting", "input": "IP address", "output": "List of domains on IP", "opsec": "passive", "opsecNote": "Uses public DNS reverse lookup data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "DB-IP", "type": "url", "url": "https://db-ip.com/", "description": "Lightweight IP geolocation API covering 46M+ IPv4/IPv6 blocks with city-level accuracy.", "status": "live", "pricing": "freemium", "bestFor": "Accurate IP geolocation with developer API", "input": "IP address", "output": "Location, timezone, ISP, coordinates", "opsec": "passive", "opsecNote": "Passive database lookup; free API rate limited.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "IP Location Finder", "type": "url", "url": "https://www.iplocation.net/", "description": "Web-based tool for IP geolocation with maps and detailed location information.", "status": "live", "pricing": "free", "bestFor": "Quick IP location with maps", "input": "IP address", "output": "City, coordinates, ISP, hostname", "opsec": "passive", "opsecNote": "Passive lookup; no notification to target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Info Sniper", "type": "url", "url": "https://www.infosniper.net/", "description": "Multi-field reverse OSINT tool for IP, email, phone lookups with social media enumeration.", "status": "live", "pricing": "freemium", "bestFor": "Multi-field reverse lookup (IP/email/phone)", "input": "IP, email, or phone", "output": "Associated accounts and social profiles", "opsec": "passive", "opsecNote": "Correlates public data; paid features available.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "utrace", "type": "url", "url": "https://en.utrace.de/", "description": "IP geolocation and reverse DNS lookup tool with network traceroute visualization.", "status": "live", "pricing": "free", "bestFor": "IP location and traceroute", "input": "IP or hostname", "output": "Location, ASN, reverse DNS, route path", "opsec": "active", "opsecNote": "Traceroute is active; geolocation is passive.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Host / Port Discovery", "type": "folder", "children": [ { "name": "urlscan.io", "type": "url", "url": "https://urlscan.io/search/#*", "description": "Website scanner analyzing URLs and domains for malicious content with infrastructure intelligence.", "status": "live", "pricing": "freemium", "bestFor": "URL/domain scanning for malware and phishing", "input": "URL or domain", "output": "Screenshot, DNS, IP, certificates, cookies", "opsec": "passive", "opsecNote": "Passive scanning; no direct contact with target.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Spyse", "type": "url", "url": "https://spyse.com/search/ip", "description": "Internet assets search engine collecting and analyzing public data for attack surface management.", "status": "live", "pricing": "freemium", "bestFor": "Internet asset discovery and reconnaissance", "input": "IP, domain, email, organization", "output": "Subdomains, services, vulnerabilities, data breaches", "opsec": "passive", "opsecNote": "Passive data collection; requires account for full access.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Shodan", "type": "url", "url": "https://www.shodan.io/", "description": "Search engine for internet-connected devices, providing visibility into exposed services and vulnerabilities.", "status": "live", "pricing": "freemium", "bestFor": "Find exposed IoT and network services", "input": "IP, port, service type", "output": "Service banners, open ports, vulnerabilities, location", "opsec": "passive", "opsecNote": "Passive data collection; InternetDB API free for non-commercial use.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Netlas.io", "type": "url", "url": "https://netlas.io/", "description": "Comprehensive internet scanning platform with OSINT, DNS, and WHOIS data. Free tier: 50 requests/day.", "status": "live", "pricing": "freemium", "bestFor": "Internet asset reconnaissance with web, DNS, WHOIS", "input": "IP, domain, ASN", "output": "Open ports, services, certificates, DNS records, WHOIS", "opsec": "passive", "opsecNote": "Passive scanning with account-based rate limits.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Portmap", "type": "url", "url": "https://portmap.com/", "description": "Port mapping tool that scans for open ports and services on target IP addresses.", "status": "live", "pricing": "free", "bestFor": "Port scanning and service discovery", "input": "IP address or hostname", "output": "Open ports, service types, versions", "opsec": "active", "opsecNote": "Active port scanning probes target network.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Scans.io", "type": "url", "url": "https://scans.io/", "description": "Archive of internet-wide scan data including censys scans and other reconnaissance data.", "status": "live", "pricing": "free", "bestFor": "Historical internet scan data access", "input": "IP or domain", "output": "Historical scan results, service history", "opsec": "passive", "opsecNote": "Passive access to historical scanning archives.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Nmap (T)", "type": "url", "url": "https://nmap.org/download.html", "description": "Open-source network mapping and port scanning tool with OS detection and service version identification.", "status": "live", "pricing": "free", "bestFor": "Network reconnaissance and port scanning", "input": "IP range or hostname", "output": "Open ports, OS type, service versions, MAC addresses", "opsec": "active", "opsecNote": "Active scanning tool; generates network traffic.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Online Port scanner", "type": "url", "url": "https://portscanner.online/", "description": "Web-based port scanner checking open ports on target IP addresses without installation.", "status": "live", "pricing": "free", "bestFor": "Quick port scanning without tools", "input": "IP address and port range", "output": "Open ports, response times", "opsec": "active", "opsecNote": "Active port scanning; limited to common ports on free tier.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Internet Census Search", "type": "url", "url": "https://www.exfiltrated.com/querystart.php", "description": "Search interface for the Shodan-like internet census data and open services.", "status": "live", "pricing": "free", "bestFor": "Search open services and devices", "input": "Service type, IP range, port", "output": "List of exposed services and IPs", "opsec": "passive", "opsecNote": "Passive data search of known internet census.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Criminal IP Search", "type": "url", "url": "https://www.criminalip.io/", "description": "IP reputation and threat intelligence platform analyzing malicious IP addresses and attacks.", "status": "live", "pricing": "freemium", "bestFor": "IP reputation and malicious activity analysis", "input": "IP address", "output": "Threat reports, activity logs, attack types", "opsec": "passive", "opsecNote": "Passive threat intelligence lookup.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Scanless (T)", "type": "url", "url": "https://github.com/vesche/scanless", "description": "Command-line tool for port scanning without leaving traces on target using third-party services.", "status": "live", "pricing": "free", "bestFor": "Stealthy port scanning via proxies", "input": "IP and port", "output": "Open port results", "opsec": "passive", "opsecNote": "Routes scans through third-party services for stealth.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "BinaryEdge (R)", "type": "url", "url": "https://www.binaryedge.io/", "description": "Commercial security research platform with internet-wide scanning and module-based detection.", "status": "live", "pricing": "paid", "bestFor": "Commercial internet threat intelligence", "input": "IP, domain, query", "output": "Services, vulnerabilities, threat modules", "opsec": "passive", "opsecNote": "Commercial threat intelligence requiring subscription.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Masscan (T)", "type": "url", "url": "https://github.com/robertdavidgraham/masscan", "description": "Ultra-fast TCP port scanner designed for scanning large IP ranges and entire networks.", "status": "live", "pricing": "free", "bestFor": "Large-scale network port scanning", "input": "IP range", "output": "Open ports, response times", "opsec": "active", "opsecNote": "Active scanner; generates significant network traffic.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "IPv4", "type": "folder", "children": [ { "name": "ASlookup.com", "type": "url", "url": "https://aslookup.com/", "description": "BGP and autonomous system lookup tool for finding IP ranges and ownership information.", "status": "live", "pricing": "free", "bestFor": "BGP and ASN lookup", "input": "ASN or IP address", "output": "IP ranges, organization, peering info", "opsec": "passive", "opsecNote": "Passive lookup of public BGP data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Port scanner Online", "type": "url", "url": "https://portscanner.online/", "description": "Simple web-based port scanner for checking common ports on target IPs.", "status": "live", "pricing": "free", "bestFor": "Quick port availability checks", "input": "IP and port", "output": "Port status (open/closed)", "opsec": "active", "opsecNote": "Active probing; may be logged by firewalls.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Onyphe", "type": "url", "url": "https://www.onyphe.io/", "description": "Cyber defense search engine with internet scanning, threat intelligence, and attack surface management.", "status": "live", "pricing": "freemium", "bestFor": "Internet asset discovery and threat intel", "input": "IP, domain, CVE", "output": "Services, vulnerabilities, certificates, datasources", "opsec": "passive", "opsecNote": "Passive intelligence from public sources.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "IPv4 CIDR Report", "type": "url", "url": "https://www.cidr-report.org/as2.0/", "description": "Tool for analyzing IPv4 CIDR blocks and finding contained IP addresses and subnets.", "status": "live", "pricing": "free", "bestFor": "CIDR block analysis and subnet enumeration", "input": "CIDR block", "output": "IP ranges, subnet breakdown", "opsec": "passive", "opsecNote": "Passive analysis of IP allocation data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Reverse.report", "type": "url", "url": "https://reverse.report/", "description": "Comprehensive reverse lookup tool for IP to domain, email, and phone number associations.", "status": "live", "pricing": "freemium", "bestFor": "Reverse IP and domain lookups", "input": "IP address or domain", "output": "Associated domains, subdomains, history", "opsec": "passive", "opsecNote": "Passive lookup of DNS and WHOIS data.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Team Cymru IP to ASN", "type": "url", "url": "https://asn.cymru.com/", "description": "IP to ASN mapping tool providing autonomous system ownership and prefix information.", "status": "live", "pricing": "free", "bestFor": "IP to ASN mapping", "input": "IP address", "output": "ASN, organization, prefix", "opsec": "passive", "opsecNote": "Passive lookup of BGP and WHOIS data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "IP to ASN DB", "type": "url", "url": "https://iptoasn.com/", "description": "Database and API service for looking up which ASN owns a given IP address.", "status": "live", "pricing": "free", "bestFor": "IP to ASN lookup with historical data", "input": "IP address", "output": "ASN, organization, prefix, company info", "opsec": "passive", "opsecNote": "Passive database lookup.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Hacker Target - Reverse DNS", "type": "url", "url": "https://hackertarget.com/reverse-dns-lookup/", "description": "Reverse DNS lookup tool and API finding domain names associated with IP addresses.", "status": "live", "pricing": "freemium", "bestFor": "Reverse DNS lookup of IP addresses", "input": "IP address or range", "output": "Associated domains and PTR records", "opsec": "passive", "opsecNote": "Passive DNS lookup; includes free API tier.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "IPv6", "type": "folder", "children": [ { "name": "IPv6 CIDR Report", "type": "url", "url": "https://www.cidr-report.org/v6/as2.0/", "description": "CIDR block analysis tool for IPv6 address ranges and subnet enumeration.", "status": "live", "pricing": "free", "bestFor": "IPv6 CIDR block analysis", "input": "IPv6 CIDR block", "output": "IPv6 ranges, subnet breakdown", "opsec": "passive", "opsecNote": "Passive analysis of IPv6 allocation data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "BGP", "type": "folder", "children": [ { "name": "Hurricane Electric BGP Toolkit", "type": "url", "url": "https://bgp.he.net/", "description": "BGP and network routing analysis tools including AS to prefix lookup and BGP prefix information.", "status": "live", "pricing": "free", "bestFor": "BGP analysis and routing intelligence", "input": "ASN, IP range, or prefix", "output": "BGP routes, peering, organization info", "opsec": "passive", "opsecNote": "Passive lookup of public BGP data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "BGP Malicious Content Ranking", "type": "url", "url": "https://bgpranking.circl.lu/", "description": "Platform ranking ASNs and BGP prefixes by malicious content and security threats.", "status": "live", "pricing": "free", "bestFor": "Identify malicious ASNs and networks", "input": "ASN or prefix", "output": "Threat ranking, malicious activity metrics", "opsec": "passive", "opsecNote": "Passive threat intelligence from public sources.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "PeeringDB", "type": "url", "url": "https://www.peeringdb.com/advanced_search", "description": "Database of internet exchange points, member networks, and AS relationships for network mapping.", "status": "live", "pricing": "free", "bestFor": "Internet peering and AS relationship mapping", "input": "ASN, organization, or IX", "output": "Peering relationships, exchange points, contacts", "opsec": "passive", "opsecNote": "Passive lookup of public peering data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "BGP Tools", "type": "url", "url": "https://www.bgp4.as/tools", "description": "Collection of BGP analysis and AS number lookup tools for network intelligence.", "status": "live", "pricing": "free", "bestFor": "BGP routing and AS analysis", "input": "ASN, IP, or prefix", "output": "Routes, prefixes, organizations", "opsec": "passive", "opsecNote": "Passive analysis of public BGP data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": true, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Reputation", "type": "folder", "children": [ { "name": "IP Void", "type": "url", "url": "https://www.ipvoid.com/", "description": "IP reputation and threat intelligence service analyzing blacklist status and security risks.", "status": "live", "pricing": "freemium", "bestFor": "Check IP reputation and blacklist status", "input": "IP address", "output": "Threat score, blacklist status, reports", "opsec": "passive", "opsecNote": "Passive reputation lookup; account needed for full data.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "ExoneraTor", "type": "url", "url": "https://exonerator.torproject.org/", "description": "Tool for checking if an IP address belonged to Tor at a specific date.", "status": "live", "pricing": "free", "bestFor": "Verify Tor relay membership by date", "input": "IP address and date", "output": "Tor exit/entry node status confirmation", "opsec": "passive", "opsecNote": "Passive historical Tor relay lookup from public archives.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Grey Noise", "type": "url", "url": "https://viz.greynoise.io/", "description": "Platform for analyzing internet background noise and identifying benign scanning activity.", "status": "live", "pricing": "freemium", "bestFor": "Distinguish malicious from benign internet activity", "input": "IP address", "output": "Classification, scanner type, threat assessment", "opsec": "passive", "opsecNote": "Passive threat intelligence; free tier available.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Blacklists", "type": "folder", "children": [ { "name": "Blocklist.de", "type": "url", "url": "https://www.blocklist.de/en/index.html", "description": "Community-contributed blocklist of IP addresses involved in attacks and malicious activity.", "status": "live", "pricing": "free", "bestFor": "Check IP blacklist status", "input": "IP address", "output": "Blacklist status, attack types logged", "opsec": "passive", "opsecNote": "Passive lookup of community blocklist.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "DShield API", "type": "url", "url": "https://isc.sans.edu/api/", "description": "API and database of security events and IPs involved in attacks monitored by SANS.", "status": "live", "pricing": "free", "bestFor": "Query IPs involved in attacks", "input": "IP address", "output": "Attack reports, threat activity", "opsec": "passive", "opsecNote": "Passive threat intelligence from SANS monitored networks.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "FireHOL IP Lists ", "type": "url", "url": "https://iplists.firehol.org/", "description": "Collection of firewall-friendly IP lists for blocking malicious and spam sources.", "status": "live", "pricing": "free", "bestFor": "Block malicious/spam IP sources", "input": "IP address or list download", "output": "Blacklist membership status", "opsec": "passive", "opsecNote": "Passive lookup of public IP reputation lists.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "Project Honey Pot", "type": "url", "url": "https://www.projecthoneypot.org/list_of_ips.php", "description": "Global honeypot network collecting spam and attack data with IP reputation service.", "status": "live", "pricing": "freemium", "bestFor": "Check IP for spam and attack history", "input": "IP address", "output": "Threat score, spam reports, attack activity", "opsec": "passive", "opsecNote": "Passive lookup of honeypot-collected threat data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Neighbor Domains", "type": "folder", "children": [ { "name": "IP Fingerprints - Reverse IP Lookup", "type": "url", "url": "https://ipfingerprints.com/reverseip.php", "description": "Find all domains hosted on a shared IP address through reverse IP lookup.", "status": "live", "pricing": "free", "bestFor": "Find domains on shared hosting", "input": "IP address", "output": "List of domains on IP", "opsec": "passive", "opsecNote": "Passive DNS reverse lookup.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Bing IP Search (D)", "type": "url", "url": "https://www.bing.com/search?q=ip%3A8.8.8.8", "description": "Bing search operator for finding domains and subdomains hosted on a specific IP address.", "status": "live", "pricing": "free", "bestFor": "Find domains on IP using Bing index", "input": "IP address", "output": "Domains indexed by Bing on that IP", "opsec": "passive", "opsecNote": "Passive search using Bing's public index.", "localInstall": false, "googleDork": true, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "TCP/IP Utils - Domain Neighbors", "type": "url", "url": "https://dnslytics.com/", "description": "Find all domains on the same IP and subdomain information via reverse IP lookups.", "status": "live", "pricing": "free", "bestFor": "Identify related domains on same IP", "input": "Domain or IP", "output": "Neighbor domains, IP info", "opsec": "passive", "opsecNote": "Passive DNS and IP lookup data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "MyIPNeighbors", "type": "url", "url": "https://www.my-ip-neighbors.com/", "description": "Reverse IP lookup tool for discovering all domains and subdomains on an IP address.", "status": "live", "pricing": "free", "bestFor": "Find all domains on same shared IP", "input": "IP address", "output": "List of domains on IP, subdomains", "opsec": "passive", "opsecNote": "Passive DNS reverse lookup.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Protected by Cloud Services", "type": "folder", "children": [ { "name": "CloudFlare Watch", "type": "url", "url": "https://www.crimeflare.com/", "description": "Tool for identifying and analyzing websites protected by Cloudflare's CDN and security services.", "status": "live", "pricing": "free", "bestFor": "Identify Cloudflare-protected sites", "input": "Domain or IP", "output": "Cloudflare status, origin IP (if discoverable)", "opsec": "passive", "opsecNote": "Passive lookup of Cloudflare configurations.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "CloudFail (T)", "type": "url", "url": "https://github.com/m0rtem/CloudFail", "description": "Tool for finding origin IPs of Cloudflare-protected websites through enumeration techniques.", "status": "live", "pricing": "free", "bestFor": "Bypass Cloudflare to find origin IP", "input": "Domain protected by Cloudflare", "output": "Origin IP address (if discoverable)", "opsec": "active", "opsecNote": "Uses active enumeration and DNS history techniques.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "Wireless Network Info", "type": "folder", "children": [ { "name": "WiGLE: Wireless Network Mapping", "type": "url", "url": "https://wigle.net/", "description": "Global database of wireless networks (WiFi, Bluetooth, cellular) with mapping and signal strength data.", "status": "live", "pricing": "freemium", "bestFor": "Map wireless networks and find signal coverage", "input": "Location, SSID, or BSSID", "output": "Network locations, signal maps, network details", "opsec": "passive", "opsecNote": "Crowdsourced wireless network data; passive lookup.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false }, { "name": "OpenCellid: Database of Cell Towers", "type": "url", "url": "https://opencellid.org/", "description": "Open database of cellular tower locations and coverage for mobile network geolocation.", "status": "live", "pricing": "free", "bestFor": "Find cellular tower locations and coverage", "input": "Cell tower ID or location", "output": "Tower coordinates, operator, coverage area", "opsec": "passive", "opsecNote": "Passive lookup of public cellular network data.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": true, "invitationOnly": false, "deprecated": false } ] }, { "name": "Network Analysis Tools", "type": "folder", "children": [ { "name": "Wireshark", "type": "url", "url": "https://www.wireshark.org/download.html", "description": "Open-source network packet analyzer for deep packet inspection and network troubleshooting.", "status": "live", "pricing": "free", "bestFor": "Network packet analysis and protocol debugging", "input": "Network traffic capture file", "output": "Detailed packet analysis, protocol breakdown", "opsec": "Unknown", "opsecNote": "Tool-dependent; passive capture or active sniffing possible.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "NetworkMiner", "type": "url", "url": "https://www.netresec.com/?page=Networkminer", "description": "Passive network forensics tool for extracting files and data from network traffic captures.", "status": "live", "pricing": "free", "bestFor": "Network forensics and file extraction from traffic", "input": "PCAP network traffic files", "output": "Extracted files, metadata, network sessions", "opsec": "passive", "opsecNote": "Passive analysis of already-captured traffic.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Packet Total", "type": "url", "url": "https://www.packettotal.com/", "description": "Online platform for uploading and analyzing network packet captures (PCAP files).", "status": "live", "pricing": "free", "bestFor": "Cloud-based network forensics analysis", "input": "PCAP files", "output": "Traffic analysis, threat indicators, IoCs", "opsec": "Unknown", "opsecNote": "Passive analysis of PCAP; consider privacy of uploaded data.", "localInstall": false, "googleDork": false, "registration": true, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "checkip (T)", "type": "url", "url": "https://github.com/jreisinger/checkip", "description": "Command-line utility for checking local machine IP address and network connectivity.", "status": "live", "pricing": "free", "bestFor": "Display local IP and network info", "input": "Local system (no input needed)", "output": "Local IP, gateway, DNS servers", "opsec": "passive", "opsecNote": "Passive system utility; local only.", "localInstall": true, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] }, { "name": "IP Loggers", "type": "folder", "children": [ { "name": "Ki.tc", "type": "url", "url": "https://ki.tc", "description": "IP logging service that generates trackable links for IP/browser info collection.", "status": "live", "pricing": "free", "bestFor": "Generate trackable links to log visitor IPs", "input": "Target URL or destination", "output": "Tracker link, IP logs, browser info", "opsec": "Unknown", "opsecNote": "Creates tracking mechanism; detection depends on how link is used.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "Grabify", "type": "url", "url": "https://grabify.link", "description": "URL shortener service that logs IP addresses and device information of link clickers.", "status": "live", "pricing": "free", "bestFor": "Shorten URLs and log visitor IPs", "input": "URL to shorten", "output": "Short URL with IP logging", "opsec": "Unknown", "opsecNote": "Creates tracking link; malicious uses common.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false }, { "name": "IP Logger", "type": "url", "url": "https://iplogger.com/", "description": "IP logging and URL shortening service tracking visitor IP, location, and browser data.", "status": "live", "pricing": "free", "bestFor": "Track visitor IPs through shortened links", "input": "URL to wrap", "output": "Logging URL, visitor IP/location data", "opsec": "Unknown", "opsecNote": "Tracking service; ethical and legal concerns apply.", "localInstall": false, "googleDork": false, "registration": false, "editUrl": false, "api": false, "invitationOnly": false, "deprecated": false } ] } ] }, { "name": "Images / Videos / Docs", "type": "folder", "children": [ { "name": "Images", "type": "folder", "children": [ { "name": "Search", "type": "folder", "children": [ { "name": "Google Images", "type": "url", "url": "https://images.google.com/?gws_rd=ssl" }, { "name": "Bing Images", "type": "url", "url": "https://www.bing.com/images" }, { "name": "FaceCheck Facial Recognition Search", "type": "url", "url": "https://facecheck.id/" }, { "name": "Surfface Face & People Search Engine", "type": "url", "url": "https://surfface.com/" }, { "name": "PimEyes Face Search Engine", "type": "url", "url": "https://pimeyes.com/en" }, { "name": "Yandex Images", "type": "url", "url": "https://www.yandex.com/images/" }, { "name": "Baidu Images", "type": "url", "url": "https://graph.baidu.com/pcpage/index?tpl_from=pc" }, { "name": "Twitter Image Search (M)", "type": "url", "url": "https://twitter.com/search?q=%3Csearchterm%3E&src=typd&vertical=default&f=images" }, { "name": "Imgur Search", "type": "url", "url": "https://imgur.com/search" }, { "name": "Photobucket", "type": "url", "url": "https://photobucket.com/" }, { "name": "7Photos.net", "type": "url", "url": "https://7photos.net/" }, { "name": "Panoramio", "type": "url", "url": "https://www.panoramio.com/" }, { "name": "Current Location", "type": "url", "url": "https://current-location.com/" }, { "name": "Lakako Photo Search", "type": "url", "url": "https://www.lakako.com/" }, { "name": "Lenso.ai", "type": "url", "url": "https://lenso.ai/" }, { "name": "CC Search", "type": "url", "url": "https://ccsearch.creativecommons.org/" }, { "name": "CamFind App", "type": "url", "url": "https://camfindapp.com/" }, { "name": "RevEye Reverse Image Search (T)", "type": "url", "url": "https://chrome.google.com/webstore/detail/reveye-reverse-image-sear/keaaclcjhehbbapnphnmpiklalfhelgf?hl=en" }, { "name": "SmugMug Search", "type": "url", "url": "https://www.smugmug.com/" }, { "name": "ImageNet", "type": "url", "url": "https://image-net.org/" }, { "name": "Places2", "type": "url", "url": "https://places2.csail.mit.edu/explore.html" }, { "name": "Image Identification Project", "type": "url", "url": "https://www.imageidentify.com/" }, { "name": "SauceNAO", "type": "url", "url": "https://saucenao.com/" }, { "name": "Picarta", "type": "url", "url": "https://picarta.ai/" }, { "name": "FaceSeek Face Search Engine", "type": "url", "url": "https://faceseek.online" } ] }, { "name": "Instagram", "type": "folder", "children": [ { "name": "Webstigram", "type": "url", "url": "https://websta.me/search-engine-optimization/" }, { "name": "Instagram", "type": "url", "url": "https://www.instagram.com/" }, { "name": "Mini Instagram", "type": "url", "url": "https://mininsta.net/" }, { "name": "Imgrab", "type": "url", "url": "https://www.imgrab.com/" }, { "name": "Tofo.me", "type": "url", "url": "https://tofo.me/" } ] }, { "name": "Flickr", "type": "folder", "children": [ { "name": "Flickr", "type": "url", "url": "https://www.flickr.com/" }, { "name": "Flickr Map", "type": "url", "url": "https://www.flickr.com/map/" }, { "name": "My Pics Map", "type": "url", "url": "https://www.mypicsmap.com/" }, { "name": "idGettr", "type": "url", "url": "https://www.webfx.com/tools/idgettr/" }, { "name": "Flickr Hive Mind", "type": "url", "url": "https://flickrhivemind.net/" } ] }, { "name": "Metadata", "type": "folder", "children": [ { "name": "ExifEditor", "type": "url", "url": "https://exifeditor.io" }, { "name": "ExifTool (T)", "type": "url", "url": "https://exiftool.org/" }, { "name": "ExifViewer", "type": "url", "url": "https://www.exifviewer.org/" }, { "name": "FOCA (T)", "type": "url", "url": "https://github.com/ElevenPaths/FOCA" }, { "name": "GeoSetter", "type": "url", "url": "https://geosetter.de/en/main-en/" }, { "name": "Jeffrey's Exif Viewer", "type": "url", "url": "https://exif.regex.info/" }, { "name": "JPEGsnoop (T)", "type": "url", "url": "https://www.impulseadventure.com/photo/jpeg-snoop.html" }, { "name": "Metapicz", "type": "url", "url": "https://metapicz.com/#landing" }, { "name": "Search by Exif", "type": "url", "url": "https://www.exif-search.com/" }, { "name": "xeuledoc - Fetch metadata about any public Google document", "type": "url", "url": "https://github.com/Malfrats/xeuledoc" }, { "name": "FOCA (T)", "type": "url", "url": "https://github.com/ElevenPaths/FOCA" }, { "name": "Exiv2 (T)", "type": "url", "url": "https://exiv2.org/" }, { "name": "MediaInfo (T)", "type": "url", "url": "https://mediaarea.net/en/MediaInfo" }, { "name": "Apache Tika (T)", "type": "url", "url": "https://tika.apache.org/" }, { "name": "oletools (T)", "type": "url", "url": "https://github.com/decalage2/oletools" }, { "name": "Hachoir (T)", "type": "url", "url": "https://github.com/vstinner/hachoir" }, { "name": "C2PA Verify", "type": "url", "url": "https://contentcredentials.org/verify" }, { "name": "Metadata2Go", "type": "url", "url": "https://www.metadata2go.com/" }, { "name": "Get-Metadata", "type": "url", "url": "https://www.get-metadata.com/" } ] }, { "name": "Forensics", "type": "folder", "children": [ { "name": "Ghiro (T)", "type": "url", "url": "https://github.com/ghirensics/ghiro" }, { "name": "Camera Trace", "type": "url", "url": "https://www.cameratrace.com/trace" }, { "name": "Forensically", "type": "url", "url": "https://29a.ch/photo-forensics/" } ] }, { "name": "OCR", "type": "folder", "children": [ { "name": "Online OCR", "type": "url", "url": "https://www.sodapdf.com/pdf-tools/ocr-pdf/" }, { "name": "i2OCR", "type": "url", "url": "https://www.i2ocr.com/" }, { "name": "New OCR", "type": "url", "url": "https://www.newocr.com/" }, { "name": "Online OCR", "type": "url", "url": "https://www.onlineocr.net/" } ] }, { "name": "Tools", "type": "folder", "children": [ { "name": "Creepy (T)", "type": "url", "url": "https://www.geocreepy.com/" } ] } ] }, { "name": "Videos", "type": "folder", "children": [ { "name": "Search", "type": "folder", "children": [ { "name": "Google Videos", "type": "url", "url": "https://www.google.com/videohp?gws_rd=ssl" }, { "name": "Bing Videos", "type": "url", "url": "https://www.bing.com/videos" }, { "name": "Internet Archive Videos", "type": "url", "url": "https://archive.org/details/opensource_movies" }, { "name": "Vines (D)", "type": "url", "url": "https://www.google.com/search?q=site:vine.co+%3Csearchterm%3E" }, { "name": "Dogpile Web Search", "type": "url", "url": "https://www.dogpile.com/" }, { "name": "Geo Search Tool", "type": "url", "url": "https://www.geosearchtool.com/" }, { "name": "blinkx Video Search", "type": "url", "url": "https://blinkx.com/" }, { "name": "Facebook Live Map", "type": "url", "url": "https://www.facebook.com/watch/live/?ref=live_delegate" }, { "name": "LiveLeak", "type": "url", "url": "https://www.liveleak.com/" }, { "name": "Metatube", "type": "url", "url": "https://www.metatube.com/" }, { "name": "Yahoo Video Search", "type": "url", "url": "https://video.search.yahoo.com/" }, { "name": "Search YouTube by Location", "type": "url", "url": "https://mattw.io/youtube-geofind/location" } ] }, { "name": "Analyze / Record", "type": "folder", "children": [ { "name": "DetURL", "type": "url", "url": "https://deturl.com/" }, { "name": "Print YouTube StoryBoard Instructions", "type": "url", "url": "https://www.labnol.org/internet/print-youtube-video/28217" }, { "name": "Print Storyboard from Youtube", "type": "url", "url": "javascript:(function(){a=ytplayer.config.args.storyboard_spec;if(!a){alert(\"Sorry we cannot process this YouTube video. Could you please try another one\");exit();}b=a.split(\"|\");base=b[0].split(\"$\")[0]+\"2/M\";c=b[3].split(\"%23\");sigh=c[c.length-1];var imgs=\"\";t=ytplayer.config.args.length_seconds;n=Math.ceil(c[2]/(c[3]*c[4]));for(i=0;i
\";}var title=ytplayer.config.args.title;msg=\"