OSINT
Sock Puppets
Creating an Effective Sock Puppet for OSINT Investigations Introduction
The Art Of The Sock
Reddit My process for setting up anonymous sockpuppet accounts
Fake Name Generator
This Person Does not Exist
Privacy.com
Email OSINT
Hunter.io
Phonebook.cz
VoilaNorbert
Email-Hippo
Email-Checker
Clearbit-Connect
Password OSINT
PWDQuery
h8mail
Breachdirectory
Dehashed
WeLeakInfo
LeakCheck
SnusBase
Scylla.sh
Have I Been Pwned
Breached Credentials
# https://github.com/hmaverickadams/breach-parse
bash breach-parse.sh @company.com company.com "BreachCompilation/"Image OSINT
Google Image Search
Yandex
TinEye
Jeffreys Image Metadata Viewer
GeoGuessr
GeoGuessr The Top Tips Tricks and Techniques
Username OSINT
NameChk
WhatsMyName
NameCheckup
People OSINT
WhitePages
TruePeopleSearch
FastPeopleSearch
FastBackgroundCheck
WebMii
PeekYou
411
Spokeo
ThatsThem
Voter-Records
TrueCaller
Caller-ID-Test
Infobel
Social Media OSINT
# Twitter
from:username since:2019/03/01 until:2019/04/01
to:username
@username
geocode:$geo_code,10kmTwitter-Advanced-Search
Social Bearing
Twitonomy
Sleeping Time
Mention Mapp
Tweetbeaver
SpoonBill
Tinfoleak
TweetDeck
Sowdust
Intelx-Facebook-Search
Wopita
Code-of-a-Ninja
InstaDP
ImgInn
Snap-Map
Website OSINT
BuiltWith
Domain-Dossier
DNSlytics-Reverse-IP
SpyOnWeb
VirusTotal
Visual-Ping
Back Link Watch
viewdns.info
Pentest Tools Subdomain Finder
Spyse
crt.sh
Shodan
Wayback Machine
Business OSINT
AI-HIT
Open Corporates
Wireless OSINT
WiGLE
Working with OSINT Tools
Linux Tools
theHarvester -d tesla.com -b all
recon-ngh8mail
breach-parse
Twint
Subfinder
Assetfinder
httprobe
Amass
GoWitness
Hunchly
OSINT Automation Foundations
#!/bin/bash
domain=$1
RED="\033[1;31m"
RESET="\033[0m"
info_path=$domain/info
subdomain_path=$domain/subdomains
screenshot_path=$domain/screenshots
if [ ! -d "$domain" ];then
mkdir $domain
fi
if [ ! -d "$info_path" ];then
mkdir $info_path
fi
if [ ! -d "$subdomain_path" ];then
mkdir $subdomain_path
fi
if [ ! -d "$screenshot_path" ];then
mkdir $screenshot_path
fi
echo -e "${RED} [+] Checkin' who it is...${RESET}"
whois $1 > $info_path/whois.txt
echo -e "${RED} [+] Launching subfinder...${RESET}"
subfinder -d $domain > $subdomain_path/found.txt
echo -e "${RED} [+] Running assetfinder...${RESET}"
assetfinder $domain | grep $domain >> $subdomain_path/found.txt
#echo -e "${RED} [+] Running Amass. This could take a while...${RESET}"
#amass enum -d $domain >> $subdomain_path/found.txt
echo -e "${RED} [+] Checking what's alive...${RESET}"
cat $subdomain_path/found.txt | grep $domain | sort -u | httprobe -prefer-https | grep https | sed 's/https\?:\/\///' | tee -a $subdomain_path/alive.txt
echo -e "${RED} [+] Taking dem screenshotz...${RESET}"
gowitness file -f $subdomain_path/alive.txt -P $screenshot_path/ --no-httpOSINT Flowcharts
Search Engine OSINT
site:github.com
Term1 AND Term2
Term1 OR Term2
Term1 * Term3
site:tesla.com password filetype:pdf
site:tesla.com -www -shop
filetype:pdf inurl:file intext:passwordGoogle Advanced Search
Google Search Guide
Yandex
DuckDuckGo
Last updated