rawfilejson/awesome-osint-arsenal

🔍 AWESOME OSINT ARSENAL

The Ultimate Open-Source Intelligence + Security Toolkit

753+ tools · 50 categories · Multi-distro installers · Georgian OSINT · Termux support

> The most comprehensive OSINT and security toolkit on the internet — every tool with installation instructions or a verified link.

⚡ Get everything in one command

git clone https://github.com/rawfilejson/awesome-osint-arsenal && cd awesome-osint-arsenal && sudo bash install.sh

🎯 Or pick just what you need

sudo bash osint.sh        # 🔍 OSINT only (Sherlock, Maigret, Amass, …)

sudo bash redteam.sh      # ⚔️  Red team (Sliver, BloodHound, Mimikatz, Nuclei, …)

sudo bash blueteam.sh     # 🛡️  Blue team (Wazuh, Sigma, Suricata, Velociraptor, …)

sudo bash forensics.sh    # 🔬 DFIR + RE (Volatility, Ghidra, radare2, …)

sudo bash hardware.sh     # 🔌 Hardware + SDR (binwalk, hackrf, openocd, …)

sudo bash labs.sh         # 🎓 Vulnerable apps for practice (DVWA, Juice Shop, …)

bash termux.sh            # 📱 Android (Termux subset, no sudo needed)

Works on Kali, Debian, Ubuntu, Parrot, Mint, Pop!_OS (best — apt)

Partial on Arch / Manjaro / Fedora / RHEL (auto-detected, falls back to git/pip/go)

Termux subset on Android

---

[!IMPORTANT]

## 🙏 A note before you fork

> This repo has 753 tools across 50 categories. Keeping that current — links, install commands, new tools every week — is a lot for one person.

> If nobody helps, parts of this list will go stale. That's just real talk.

> How you can help in 30 seconds:

- ⭐ Star the repo (more stars = more contributors find it)

- 🐛 Spotted a dead link? Open an issue, takes 1 minute

- 🧩 Adding a tool? Skim CONTRIBUTING.md first — keeps your PR from getting closed

- ☕ Buy me a coffee so weekends keep going to this

- 📢 Share it — tweet, Discord, wherever the security crowd hangs out

> If something's broken: don't just complain — open an issue or PR. That's how this stays useful.

---

[!WARNING]

DISCLAIMER: This repository is for educational and authorized security research only.

Always obtain written permission before testing systems you do not own.

The authors are not responsible for any misuse of the tools or techniques listed here.

See the full Legal Disclaimer at the bottom.

---

📋 Table of Contents

---

⚙️ Installation Guide

Quick install — Kali / Debian / Ubuntu / Parrot

git clone https://github.com/rawfilejson/awesome-osint-arsenal

cd awesome-osint-arsenal

sudo bash install.sh

Pick a single stack

| Script | What it installs | Use when | |---|---|---| | osint.sh | OSINT tools (Sherlock, Maigret, Amass, theHarvester, …) | You only do recon / investigations | | redteam.sh | Sliver, BloodHound, Impacket, NetExec, Mimikatz, Nuclei, … | Authorized pentesting / red team | | blueteam.sh | Wazuh, Sigma, Suricata, Velociraptor, Atomic Red Team, MITRE CALDERA | SOC / detection engineering | | forensics.sh | Volatility 3, Ghidra, radare2, Plaso, CyberChef, … | DFIR / malware analysis | | hardware.sh | binwalk, hackrf, openocd, GNU Radio, gqrx, … | RF / IoT / firmware research | | labs.sh | DVWA, Juice Shop, WebGoat (Docker) | Local practice labs | | termux.sh | Android-compatible subset | Phone-based recon |

Other Linux distros

The installers auto-detect your package manager:

| Distro | Manager | Status | |---|---|---| | Kali / Debian / Ubuntu / Parrot / Mint / Pop!_OS | apt | ✅ Best — primary target | | Arch / Manjaro / EndeavourOS | pacman | 🟡 Partial (apt-only tools skip cleanly) | | Fedora / RHEL / Rocky / Alma | dnf | 🟡 Partial (apt-only tools skip cleanly) | | Termux (Android) | pkg | ✅ Subset only — use bash termux.sh | | macOS / Windows | — | ❌ Use a Kali VM or WSL2 |

What every installer does

• Detects your distro and uses the right package manager
• Skips what's already installed (idempotent — safe to re-run)
• Color output: 🟢 installed · 🟡 skipped · 🔴 failed
• Logs failures to ~/osint-install-errors.log
• Prints a summary at the end
• Tools cloned via git go to /opt/osint-arsenal/ (or $HOME/osint-arsenal/ on Termux)

After install — add tools to your PATH

echo 'export PATH="$PATH:/opt/osint-arsenal"' >> ~/.bashrc

source ~/.bashrc

Tools installed via apt/pip/go install are already on your $PATH.

---

📊 Stats at a Glance

---

1. Username & Social Media OSINT

🎯 Find accounts, profiles, and digital footprints across hundreds of platforms.

> Pro tip: Start with Sherlock for a quick sweep, then use Maigret for depth — it covers 3000+ sites.

| Tool | Description | Install / Link | |------|-------------|----------------| | Sherlock | Find usernames across 400+ social networks | pip install sherlock-project | | Maigret | Advanced Sherlock fork — 3000+ sites | pip install maigret | | Namechk | Username & domain availability checker | namechk.com | | WhatsMyName | Web-based username enumeration | whatsmyname.app | | Snoop | Username search (Russian-focused) | pip install snoop | | UserRecon | Bash-based username finder | git clone https://github.com/wishihab/userrecon.git | | Blackbird | Fast username search tool | pip install blackbird-osint | | Social Analyzer | API-based social media profiler | pip install social-analyzer | | NExfil | Find profiles by username | pip install nexfil | | Socid-extractor | Extract info from web pages | pip install socid-extractor | | Gitrecon | GitHub OSINT reconnaissance | pip install gitrecon | | OSRFramework | Username research framework | pip install osrframework | | Holehe | Check if email is registered on 120+ sites | pip install holehe | | socialscan | Check email/username availability | pip install socialscan | | Investigo | Username checker (Go-based) | go install github.com/tdh8316/investigo@latest | | OSINT Framework | Visual map of all OSINT tools | osintframework.com | | CheckUserNames | Check username across multiple platforms | checkusernames.com | | KnowEm | Username search on 500+ sites | knowem.com | | Instant Username Search | Real-time username checker | instantusername.com | | Usersearch.org | Free social network search | usersearch.org | | Lullar | Free people search by email, username, or name across 175+ sites | com.lullar.com | | tookie-osint | Username to social accounts across many sites | git clone https://github.com/Alfredredbird/tookie-osint | | GitFive | GitHub account OSINT — emails, keys, activity | git clone https://github.com/mxrch/GitFive | | Marple | Username search across search-engine results | git clone https://github.com/soxoj/marple | | yesitsme | Find Instagram accounts by email or phone | git clone https://github.com/0x0be/yesitsme |

# Kali Linux / Ubuntu
pip install sherlock-project
sherlock "username"
From GitHub source (always latest)
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
pip install -r requirements.txt
python3 sherlock "username"
Search multiple usernames at once
sherlock user1 user2 user3

pip install maigret
maigret "username"
From source
git clone https://github.com/soxoj/maigret.git
cd maigret
pip install -r requirements.txt
python3 -m maigret "username"
Generate HTML report
maigret "username" --html

---

2. Email OSINT Tools

📧 Verify emails, find linked accounts, check breach exposure, and analyze headers.

> Pro tip: Holehe is free and fast. h8mail is best for breach correlation when API keys are configured.

| Tool | Description | Install / Link | |------|-------------|----------------| | h8mail | Email OSINT & breach hunting | pip install h8mail | | Holehe | Check email on 120+ sites | pip install holehe | | theHarvester | Email & domain harvester | pip install theHarvester | | EmailAnalyzer | Analyze suspicious .eml files | git clone https://github.com/keraattin/EmailAnalyzer | | Prowl | Email & domain reconnaissance | git clone https://github.com/nettitude/Prowl | | EmailHeader-Analyzer | CLI email header parser + OSINT | git clone https://github.com/Giritharram/EmailHeader-Analyzer-CLI-Python | | MailHeaderDetective | Email header forensics | git clone https://github.com/akajhon/MailHeaderDetective | | WhatMail | Email header analysis CLI | git clone https://github.com/z0m31en7/WhatMail | | mailto_analyzer | Email exposure analysis | pip install mailto-analyzer | | Infoga | Email OSINT gathering | git clone https://github.com/m4ll0k/Infoga | | Hunter.io | Find professional emails | hunter.io | | Phonebook.cz | Email, domain & URL search | phonebook.cz | | EmailRep | Email reputation lookup | emailrep.io | | Epieos | Get info linked to email | epieos.com | | GetNotify | Email open tracking + geolocation | getnotify.com | | Snov.io | Email finder & verifier | snov.io | | MXToolbox | Email header analysis & DNS checks | mxtoolbox.com | | SimpleLogin | Email alias service for OSINT | simplelogin.io | | Email-Checker | Email validation tool | email-checker.net | | Voila Norbert | Find anyone's email | voilanorbert.com | | Mosint | Automated email OSINT (breaches, social, DNS) | git clone https://github.com/alpkeskin/mosint | | pwnedOrNot | Check email breaches and dump exposed passwords | git clone https://github.com/thewhiteh4t/pwnedOrNot | | Mailcat | Find registered accounts from an email address | git clone https://github.com/sharsil/mailcat | | check-if-email-exists | Verify email deliverability without sending | git clone https://github.com/reacherhq/check-if-email-exists | | EXPERTE Email Finder | Free email permutation generator + SMTP validation | experte.com/email-finder |

pip install h8mail
Basic scan
h8mail -t "[email protected]"
With API keys (unlocks more breach sources)
Create config.ini with your API keys from HIBP, BreachDirectory, etc.
h8mail -t "[email protected]" -k config.ini
Scan a list of emails
h8mail -t emails.txt

---

3. Phone Number OSINT

📱 Identify carriers, locations, registrations, and linked accounts from phone numbers.

> Pro tip: PhoneInfoga is the gold standard CLI tool. GetContact reveals how a number is saved by others.

| Tool | Description | Install / Link | |------|-------------|----------------| | PhoneInfoga | Advanced phone number scanner | pip install phoneinfoga | | Ignorant | Check phone registrations on sites | pip install ignorant | | GetContact | See how number is saved by others | getcontact.com | | NumVerify | Phone number validation API | numverify.com | | Truecaller | Caller ID & spam lookup | truecaller.com | | Sync.me | Phone number lookup | sync.me | | CallerIDTest | Reverse phone lookup | calleridtest.com | | SpyDialer | Free reverse phone lookup | spydialer.com | | National Cellular Directory | Phone owner lookup | nationalcellulardirectory.com | | TelPoisk | Russian phone directory | telpoisk.com | | NumLookup | Free reverse phone lookup | numlookup.com | | Hlr-Lookups | HLR phone number lookup | hlr-lookups.com | | email2phonenumber | Deduce a phone number from an email via reset hints | git clone https://github.com/martinvigo/email2phonenumber | | PhoneSploit | ADB-based phone exploitation | git clone https://github.com/aerosol-can/PhoneSploit |

# Binary install (Kali Linux)
curl -sSL https://raw.githubusercontent.com/sundowndev/phoneinfoga/master/support/scripts/install | bash
Open web UI at localhost:8080
phoneinfoga serve -p 8080
Scan from CLI
phoneinfoga scan -n "+1234567890"
pip install (alternative)
pip install phoneinfoga

---

4. Domain & IP OSINT

🌐 Enumerate subdomains, query DNS records, discover IP ranges, and map attack surfaces.

> Pro tip: Run amass + subfinder together for maximum subdomain coverage, then pipe into httpx to check which hosts are live.

| Tool | Description | Install / Link | |------|-------------|----------------| | Amass | In-depth DNS enumeration | go install github.com/owasp-amass/amass/v4/...@master | | Subfinder | Fast passive subdomain discovery | go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest | | dnsrecon | DNS enumeration | pip install dnsrecon | | Sublist3r | Subdomain enumeration | pip install sublist3r | | crt.sh | Certificate transparency search | crt.sh | | Shodan | Internet-connected device search | shodan.io | | Censys | Internet-wide scan search | censys.io | | Criminal IP | AI-powered cyber threat intelligence | criminalip.io | | VirusTotal | Domain/IP/file analysis | virustotal.com | | SecurityTrails | DNS & domain intelligence | securitytrails.com | | IPGeoLocation | IP address geolocation | git clone https://github.com/maldevel/IPGeoLocation | | Nmap | Network scanner & mapper | apt install nmap | | Masscan | Fastest internet port scanner | apt install masscan | | WHOIS.com | WHOIS domain lookup | whois.com | | ViewDNS | Multiple DNS tools | viewdns.info | | DNSDumpster | DNS reconnaissance & mapping | dnsdumpster.com | | Robtex | DNS lookup visualization | robtex.com | | ARIN WHOIS | IP registration database | whois.arin.net | | BGP Toolkit | BGP/ASN/IP intelligence | bgp.he.net | | urlscan.io | URL/domain analysis & screenshots | urlscan.io | | AbuseIPDB | IP address reputation database | abuseipdb.com | | Web-Check | All-in-one website analysis | web-check.xyz | | IPinfo | IP address data & geolocation | ipinfo.io | | DB-IP | IP geolocation database | db-ip.com | | LeakIX | Search engine for exposed services & leaks | leakix.net | | dnsx | Fast multipurpose DNS toolkit | go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest | | tlsx | TLS certificate collection & analysis | go install github.com/projectdiscovery/tlsx/cmd/tlsx@latest | | shuffledns | massdns wrapper for subdomain brute/resolve | go install github.com/projectdiscovery/shuffledns/cmd/shuffledns@latest | | puredns | Fast accurate DNS bruteforcing & resolving | git clone https://github.com/d3mondev/puredns | | cloud_enum | Enumerate public AWS/Azure/GCP assets | git clone https://github.com/initstring/cloud_enum |

# Step 1: Enumerate subdomains passively (fast)
subfinder -d example.com -o subs.txt
Step 2: Deep active enumeration (slower but more complete)
amass enum -d example.com -o amass_subs.txt
Step 3: Combine and deduplicate
cat subs.txt amass_subs.txt | sort -u > all_subs.txt
Step 4: Check which subdomains are live
cat all_subs.txt | httpx -status-code -title -o live_subs.txt
Step 5: Screenshot all live hosts
cat live_subs.txt | eyewitness --web -d screenshots/

---

5. Geolocation & Maps OSINT

🗺️ Geolocate images, analyze satellite data, and verify photo locations.

> Pro tip: Combine SunCalc (shadow analysis) + ShadowMap + Mapillary for precision image geolocation.

| Tool | Description | Link | |------|-------------|------| | Google Earth Pro | Advanced sa