Tool Directory

Search, filter, and explore 55 OSINT tools organized by data type and priority.

55 Total16 P1 Essential25 P2 Important14 P3 Specialized
Source Group
Priority
Data Type

Showing 55 of 55 tools

A1

Sherlock

P1

Searches for a username across 400+ social networks simultaneously. Returns direct URLs to discovered profiles.

Username
AggregatorCLI
Open
A2

Holehe

P1

Checks whether an email is registered on various services by exploiting password reset and login flows. Pivots from email to platform accounts.

Email
AggregatorCLI
Open
A3

theHarvester

P2

Reconnaissance tool for gathering emails, subdomains, IPs, and URLs from search engines, PGP servers, and DNS.

EmailDomainIP
AggregatorCLI
Open
A4

Shodan

P1

Search engine for internet-connected devices. Indexes open ports, services, SSL certificates, and device banners across the entire internet.

IPDevice
AggregatorWeb / API
Open
A5

SpiderFoot

P1

Automated OSINT platform that recursively queries 200+ data sources from a seed input to build a comprehensive intelligence graph.

EmailDomainIPUsernamePhoneName
AggregatorWeb / CLI
Open
A6

Maltego

P1

Visual link analysis and data mining platform. Uses modular Transforms to pivot across data types and map relationship networks.

EmailDomainIPPhoneNameUsername
AggregatorDesktop
Open
A7

Namechk

P2

Checks username availability across social networks and domains. Quick browser-based cross-platform existence check.

Username
AggregatorWeb
Open
A8

WhatsMyName

P2

Community-curated username enumeration tool with a frequently updated site list. High accuracy due to active community maintenance.

Username
AggregatorWeb / CLI
Open
A9

Censys

P2

Internet-wide scan data with TLS/SSL certificate transparency focus. Discovers all certificates ever issued to a domain or organization.

IPCertificate
AggregatorWeb / API
Open
A10

GreyNoise

P3

Analyzes internet-wide scan traffic to distinguish targeted attacks from opportunistic background noise. Classifies IPs as benign, malicious, or unknown.

IP
AggregatorWeb / API
Open
A11

Hunter.io

P1

Finds and verifies professional email addresses. Returns known emails and naming patterns for any company domain.

Email
AggregatorWeb / API
Open
A12

Maigret

P1

Advanced username enumeration across 2500+ sites with automatic profile data extraction. Generates structured reports with names, bios, and photos.

Username
AggregatorCLI
Open
A13

IPinfo

P2

IP geolocation, ASN/organization attribution, carrier detection, and VPN/proxy identification. City-level location for any IP.

IP
AggregatorWeb / API
Open
A14

Have I Been Pwned

P2

Breach notification service. Checks if an email appears in known data breaches, revealing associated platforms and potentially leaked identifiers.

Email
AggregatorWeb / API
Open
A15

AbuseIPDB

P3

Community-driven IP reputation database. Aggregates abuse reports into confidence scores for malicious activity assessment.

IP
AggregatorWeb / API
Open
P1

USA.gov Vital Records

P2

Portal to US vital records — birth, death, marriage, and divorce certificates. Links to state-level registrar offices.

NameVital Records
Public RecordsWeb
Open
P2

UK GRO

P3

UK General Register Office. Birth and marriage certificates naming parents and spouses for England and Wales.

NameVital Records
Public RecordsWeb
Open
P3

Australia NAA RecordSearch

P3

Australian National Archives. Historical immigration, passenger records, and naturalization files.

ImmigrationHistorical
Public RecordsWeb
Open
P4

India IGRS

P3

Inspector General of Registration and Stamps. Property registration and residency-linked records across Indian states.

PropertyRegistration
Public RecordsWeb
Open
P5

FamilySearch.org

P1

Largest free genealogical database. Marriage, birth, census, immigration, and naturalization records linking family members globally.

GenealogyVital Records
Public RecordsWeb
Open
P6

US County Assessor / Recorder

P1

County-level property tax records listing owner name, property address, assessed value, and sometimes contact numbers.

PropertyAddressPhone
Public RecordsWeb / Database
Open
P7

UK Land Registry

P2

Title search by owner name returns registered property address for England and Wales.

PropertyAddress
Public RecordsWeb
Open
P8

OpenCorporates

P1

Largest open database of companies globally (200M+). Search director/officer appointments, registered addresses, and company roles.

CorporateNameAddress
Public RecordsWeb / API
Open
P9

SEC EDGAR

P1

US Securities & Exchange Commission filings. Insider trades (Form 4), beneficial ownership (13D), executive bios, and enforcement actions.

CorporateFinancialEmail
Public RecordsWeb / API
Open
P10

EU Business Registers (BRIS)

P3

Cross-EU company director and shareholder searches connecting national business registries.

CorporateName
Public RecordsWeb
Open
P11

PACER

P1

US federal court docket search. Criminal, civil, and bankruptcy filings with party names, contact info, and case documents.

LegalPhoneAddress
Public RecordsWeb
Open
P12

CourtListener / RECAP

P2

Free-text search of millions of federal court documents. Judge financial disclosures via the Free Law Project.

Legal
Public RecordsWeb / API
Open
P13

BAILII

P3

British and Irish Legal Information Institute. UK/Ireland court judgments and tribunal decisions searchable by party name.

Legal
Public RecordsWeb
Open
P14

WIPO Global Brand Database

P3

World Intellectual Property Organization trademark database. Applicant address and ownership data for international trademarks.

TrademarkAddress
Public RecordsWeb
Open
P15

INTERPOL Notices

P2

International wanted persons database. Red Notices include photographs, nationality, and charges for cross-border fugitives.

CriminalNamePhotos
Public RecordsWeb
Open
S1

LinkedIn (X-Ray Search)

P1

Professional network with X-Ray search via Google (site:linkedin.com/in). Employment history, education, skills, and professional headshots.

NameEmploymentEducation
SOCMINTWeb
Open
S2

X / Twitter (Advanced Search)

P2

Microblog platform with advanced search operators for date ranges, locations, user mentions, and keyword filtering.

UsernameContent
SOCMINTWeb
Open
S3

Facebook (Graph / Transparency)

P1

Social network with friends lists, tagged photos, family relationship fields, and Transparency pages for public figures.

NamePhotosRelationships
SOCMINTWeb
Open
S4

Instagram (Location + Hashtag)

P2

Photo/video platform with location-based and hashtag search. Geotagged posts reveal travel patterns and visited locations.

PhotosLocation
SOCMINTWeb
Open
S5

TikTok

P3

Short-form video platform. Username and sound-based search for discovering accounts and viral content.

UsernameContent
SOCMINTWeb
Open
S6

Reddit (Pushshift Archives)

P2

Forum with user post history and Pushshift archives. Search for name mentions in posts and comments to discover accounts.

UsernameContent
SOCMINTWeb
Open
S7

Telegram (Channel / Group)

P2

Messaging platform with channel and group search. Phone number association can surface names; public channels reveal activity.

PhoneUsername
SOCMINTWeb / Desktop
Open
G1

Google Earth Pro / Street View

P1

Satellite and street-level imagery for visual landmark verification and ground-truthing candidate locations.

Satellite ImageryStreet Imagery
GEOINTDesktop / Web
Open
G2

SunCalc (Shadow Analysis)

P2

Solar position calculator. Validates location and time by comparing shadow direction in images against computed sun position.

Solar Position
GEOINTWeb
Open
G3

Snapchat Snap Map

P2

Location-tagged social media. User-submitted snaps geolocated on a map for real-time and recent location intelligence.

LocationContent
GEOINTWeb
Open
G4

Instagram Location Search

P2

Geotagged photo discovery. Browse posts tagged at specific locations to find users who visited an area.

LocationPhotos
GEOINTWeb
Open
G5

Sentinel Hub (Copernicus)

P3

EU satellite imagery platform. Compare imagery over time for change detection and environmental monitoring.

Satellite Imagery
GEOINTWeb / API
Open
G6

ExifTool

P1

Image metadata extraction tool. Reads EXIF GPS coordinates, camera model, timestamps, and software from photos and videos.

Image MetadataGPS
GEOINTCLI
Open
G7

Overpass Turbo / OSM

P2

Query OpenStreetMap for specific geographic features visible in images. Find mosques, railways, bridges within radius of a point.

Map Features
GEOINTWeb
Open
T1

State Professional License Registries

P2

State-level license databases for doctors, engineers, contractors, etc. List licensee name, address, and qualifying education.

LicenseAddressName
Trait DiscoveryWeb / Database
Open
T2

NCSBN Nursys

P3

National nursing license verification. Confirms license status, education program, and disciplinary actions.

LicenseName
Trait DiscoveryWeb
Open
T3

USPTO Patent Search

P2

US patent filings listing inventor name, city/state/country, assignee (employer), and correspondence address.

PatentNameAddress
Trait DiscoveryWeb
Open
T4

Google Scholar / ORCID

P2

Academic publications with author affiliation, contact email, and institutional profile photos.

PublicationNameEmail
Trait DiscoveryWeb
Open
T5

GitHub / GitLab

P2

Developer platforms. Git commits embed author email in metadata. Profile reveals username, employer/org affiliation, and activity.

UsernameEmailCode
Trait DiscoveryWeb / API
Open
T6

Strava / Garmin Heatmaps

P3

Fitness tracking platforms. Activity heatmaps reveal running/cycling routes, home locations, and travel patterns.

LocationActivity
Trait DiscoveryWeb
Open
T7

Ham Radio (FCC ULS / QRZ.com)

P3

FCC amateur radio license database. Lists licensee name, mailing address, and phone number.

LicensePhoneAddress
Trait DiscoveryWeb / Database
Open
T8

FAA Airmen Certification

P3

Pilot certificate database. Lists certificate holder name, city, state, and certificate type.

LicenseNameAddress
Trait DiscoveryWeb
Open
T9

FINRA BrokerCheck

P2

Complete employment history, qualifying exams, and disclosure events (regulatory actions, complaints, criminal matters) for registered financial professionals.

EmploymentDisciplinaryPhone
Trait DiscoveryWeb
Open
T10

State Bar Associations

P2

Attorney lookup directories. Bar status, firm affiliation, admission date, law school, and office phone number.

LicensePhoneName
Trait DiscoveryWeb
Open
T11

Wayback Machine

P2

Historical web snapshots. Recover deleted profiles, changed bios, removed social media content, and old website versions.

HistoricalWeb Archive
Trait DiscoveryWeb / API
Open