Open-source Intelligence (OSINT)

Open-source intelligence (OSINT) is data collected from open source and publicly available sources. The following are a few OSINT resources and references:

Passive Recon Tools:

Open Source Threat Intelligence

Awesome Threat Intelligence - A curated list of awesome Threat Intelligence resources. This is a great resource and I try to contribute to it.

OSINT Source Highlights

Website	Description
shodan.io	Server
google.com	Dorks
wigle.net	WiFi Networks
grep.app	Codes Search
app.binaryedge	Threat Intelligence
onyphe.io	Server
viz.greynoise.io	Threat Intelligence
censys.io	Server
hunter.io	Email Addresses
fofa.info	Threat Intelligence
zoomeye.org	Threat Intelligence
leakix.net	Threat Intelligence
intelx.io	OSINT
app.netlas.io	Attack Surface
searchcode.com	Codes Search
urlscan.io	Threat Intelligence
publicwww.com	Codes Search
fullhunt.io	Attack Surface
socradar.io	Threat Intelligence
binaryedge.io	Attack Surface
ivre.rocks	Server
crt.sh	Certificate Search
vulners.com	Vulnerabilities
pulsedive.com	Threat Intelligence

Website Exploration and "Google Hacking"

censys : https://censys.io
Certficate Search: https://crt.sh/
ExifTool: https://www.sno.phy.queensu.ca/~phil/exiftool
Google Hacking Database (GHDB): https://www.exploit-db.com/google-hacking-database
Google Transparency Report: https://transparencyreport.google.com/https/certificates
Huge TLS/SSL certificate DB with advanced search: https://certdb.com
netcraft: https://searchdns.netcraft.com
SiteDigger: http://www.mcafee.com/us/downloads/free-tools/sitedigger.aspx
Spyse: https://spyse.com

Data Breach Query Tools

BaseQuery: https://github.com/g666gle/BaseQuery
Buster: https://github.com/sham00n/buster
h8mail: https://github.com/khast3x/h8mail
LeakLooker: https://github.com/woj-ciech/LeakLooker
PwnDB: https://github.com/davidtavarez/pwndb
Scavenger: https://github.com/rndinfosecguy/Scavenger
WhatBreach: https://github.com/Ekultek/WhatBreach

IP address and DNS Lookup Tools

Acquisitions and

OCCRP Aleph - The global archive of research material for investigative reporting.

Whois

WHOIS information is based upon a tree hierarchy. ICANN (IANA) is the authoritative registry for all of the TLDs and is a great starting point for all manual WHOIS queries.

BGP looking glasses

BGP4: http://www.bgp4.as/looking-glasses
BPG6: http://lg.he.net/

DNS

dnsenum - https://code.google.com/p/dnsenum
dnsmap: https://code.google.com/p/dnsmap
dnsrecon: https://www.darkoperator.com/tools-and-scripts
dnstracer: https://www.mavetju.org/unix/dnstracer.php
dnswalk: https://sourceforge.net/projects/dnswalk

The OSINT Framework

OSINT Framework

Dark Web OSINT Tools

Dark Web Search Engine Tools

Ahmia Search Engine and their GitHub repo
DarkSearch and their GitHub repo
Katana
OnionSearch
Search Engines for Academic Research
DarkDump

Tools to Obtain Information of .onion Links

Tools to scan onion links

Tools to Crawl Dark Web Data

Other Great Intelligence Gathering Sources and Tools

Resources from Pentest-standard.org - http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines#Intelligence_Gathering

Active Recon

Tons of references to scanners and vulnerability management software for active reconnaissance - http://www.pentest-standard.org/index.php/PTES_Technical_Guidelines#Vulnerability_Analysis

6.7 KiB Raw Blame History