Tools for multiple OSINT strategies
36 listed tools Last update on 2025-06-12
Recon: Information gathering stage, where attackers gather as much information as possible about the target.
Weaponization: Crafting of tools or payloads to exploit vulnerabilities.
Delivery: The transmission of the weaponized payload to the target.
Exploitation: Exploiting a vulnerability to gain access to the target system.
Installation: Establishing a foothold on the target system.
Command & Control (C2): Setting up channels for communication with the compromised system.
Actions on Objectives: Achieving the intended goal of the attack, such as data exfiltration or system disruption.
Free
A digital archive providing historical snapshots of websites and other media for OSINT and research purposes
Open-source
Revived and enhanced DNS reconnaissance and enumeration tool, offering subdomain brute-forcing, email harvesting, and metadata analysis
Commercial Free
Web technology profiler used for OSINT, competitive analysis, and cyber reconnaissance
Free
Curated collection of open-source intelligence tools and resources, organized for targeted investigations across various domains
Open-source
Getallurls (gau) fetches known URLs from AlienVault's Open Threat Exchange, the Wayback Machine, and Common Crawl
Free Commercial
OSINT search engine and data archive indexing darknet, leaks, and public records
Commercial
Open-source intelligence and graphical link analysis tool for gathering and connecting information for intelligence and forensics.
Free Commercial
Email and network diagnostic platform offering tools for blacklist monitoring, DNS lookups, and email deliverability analysis
Open-source
Community-driven repository compiling OSINT tools and resources categorized by country, facilitating targeted open-source investigations
Free
Service by Qualys that performs deep analysis of SSL/TLS configurations for public web servers
Open-source
A subdomain discovery tool that discovers valid subdomains for websites by using passive online sources
Open-souce
Fast subdomain enumeration tool that uses OSINT sources and brute-force techniques to aid hunters in mapping domain footprints
Open-source
Analyze URLs and estimate entropies to find URLs that might be vulnerable to attack
Open-source
Accept line-delimited domains on stdin, fetch URLs from the Wayback Machine for *.domain and output them on stdout
Open-Source
Open-source website analysis tool to identify potential vulnerabilities and security misconfigurations
Free
Curated collection of open-source intelligence tools and resources, organized for targeted investigations across various domains