rawfilejson/awesome-osint-arsenal

🔍 AWESOME OSINT ARSENAL

The Ultimate Open-Source Intelligence + Security Toolkit

753+ tools · 50 categories · Multi-distro installers · Georgian OSINT · Termux support

The most comprehensive OSINT and security toolkit on the internet — every tool with installation instructions or a verified link.

⚡ Get everything in one command

git clone https://github.com/rawfilejson/awesome-osint-arsenal && cd awesome-osint-arsenal && sudo bash install.sh

🎯 Or pick just what you need

sudo bash osint.sh        # 🔍 OSINT only (Sherlock, Maigret, Amass, …)

sudo bash redteam.sh      # ⚔️  Red team (Sliver, BloodHound, Mimikatz, Nuclei, …)

sudo bash blueteam.sh     # 🛡️  Blue team (Wazuh, Sigma, Suricata, Velociraptor, …)

sudo bash forensics.sh    # 🔬 DFIR + RE (Volatility, Ghidra, radare2, …)

sudo bash hardware.sh     # 🔌 Hardware + SDR (binwalk, hackrf, openocd, …)

sudo bash labs.sh         # 🎓 Vulnerable apps for practice (DVWA, Juice Shop, …)

bash termux.sh            # 📱 Android (Termux subset, no sudo needed)

Works on Kali, Debian, Ubuntu, Parrot, Mint, Pop!_OS (best — apt) Partial on Arch / Manjaro / Fedora / RHEL (auto-detected, falls back to git/pip/go) Termux subset on Android

git clone https://github.com/rawfilejson/awesome-osint-arsenal

cd awesome-osint-arsenal

sudo bash install.sh

The installers auto-detect your package manager:

• Detects your distro and uses the right package manager
• Skips what's already installed (idempotent — safe to re-run)
• Color output: 🟢 installed · 🟡 skipped · 🔴 failed
• Logs failures to ~/osint-install-errors.log
• Prints a summary at the end
• Tools cloned via git go to /opt/osint-arsenal/ (or $HOME/osint-arsenal/ on Termux)

echo 'export PATH="$PATH:/opt/osint-arsenal"' >> ~/.bashrc

source ~/.bashrc

Tools installed via apt/pip/go install are already on your $PATH.

🎯 Find accounts, profiles, and digital footprints across hundreds of platforms.

Pro tip: Start with Sherlock for a quick sweep, then use Maigret for depth — it covers 3000+ sites.

# Kali Linux / Ubuntu
pip install sherlock-project
sherlock "username"

# From GitHub source (always latest)
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
pip install -r requirements.txt
python3 sherlock "username"

# Search multiple usernames at once
sherlock user1 user2 user3

pip install maigret
maigret "username"

# From source
git clone https://github.com/soxoj/maigret.git
cd maigret
pip install -r requirements.txt
python3 -m maigret "username"

# Generate HTML report
maigret "username" --html

📧 Verify emails, find linked accounts, check breach exposure, and analyze headers.

Pro tip: Holehe is free and fast. h8mail is best for breach correlation when API keys are configured.

pip install h8mail

# Basic scan
h8mail -t "target@email.com"

# With API keys (unlocks more breach sources)
# Create config.ini with your API keys from HIBP, BreachDirectory, etc.
h8mail -t "target@email.com" -k config.ini

# Scan a list of emails
h8mail -t emails.txt

📱 Identify carriers, locations, registrations, and linked accounts from phone numbers.

Pro tip: PhoneInfoga is the gold standard CLI tool. GetContact reveals how a number is saved by others.

# Binary install (Kali Linux)
curl -sSL https://raw.githubusercontent.com/sundowndev/phoneinfoga/master/support/scripts/install | bash

# Open web UI at localhost:8080
phoneinfoga serve -p 8080

# Scan from CLI
phoneinfoga scan -n "+1234567890"

# pip install (alternative)
pip install phoneinfoga

🌐 Enumerate subdomains, query DNS records, discover IP ranges, and map attack surfaces.

Pro tip: Run amass + subfinder together for maximum subdomain coverage, then pipe into httpx to check which hosts are live.

# Step 1: Enumerate subdomains passively (fast)
subfinder -d example.com -o subs.txt

# Step 2: Deep active enumeration (slower but more complete)
amass enum -d example.com -o amass_subs.txt

# Step 3: Combine and deduplicate
cat subs.txt amass_subs.txt | sort -u > all_subs.txt

# Step 4: Check which subdomains are live
cat all_subs.txt | httpx -status-code -title -o live_subs.txt

# Step 5: Screenshot all live hosts
cat live_subs.txt | eyewitness --web -d screenshots/

🗺️ Geolocate images, analyze satellite data, and verify photo locations.

Pro tip: Combine SunCalc (shadow analysis) + ShadowMap + Mapillary for precision image geolocation.

🖼️ Extract metadata, reverse search images, verify authenticity, and detect AI-generated content.

Pro tip: Yandex reverse image search consistently outperforms Google for finding faces and locations.

# Install
apt-get install libimage-exiftool-perl

# Basic metadata read
exiftool image.jpg

# Extract GPS coordinates specifically
exiftool -GPSLatitude -GPSLongitude image.jpg

# Strip ALL metadata (for privacy)
exiftool -all= image.jpg

# Show all metadata groups
exiftool -a -u -g1 image.jpg

# Batch process a whole folder
exiftool /path/to/images/

👤 Find people across the web using photos, names, or usernames.

⚠️ Warning: Facial recognition has serious privacy and legal implications. Use only with explicit authorization.

📡 Monitor, scrape, and investigate social media accounts and communities.

Pro tip: Combine Osintgram (Instagram) + Telepathy (Telegram) + snscrape (Twitter/X) for full platform coverage.

💥 Check if credentials, emails, or phones have been exposed in data breaches.

Pro tip: HIBP is free and safe. DeHashed and LeakCheck offer the most data for paid tiers.

# Start Tor service first
sudo systemctl start tor

# Clone pwndb
git clone https://github.com/coj337/pwndb.git
cd pwndb

# Install requirements
pip install -r requirements.txt

# Search by email
python3 pwndb.py --target email@example.com

# The .onion address (open in Tor Browser)
# pwndb2am33lno4bq.onion

📁 Archives of leaked government, corporate, and classified documents.

🔑 Tools for authorized password auditing and credential recovery on systems you own.

# Install
apt install hashcat

# Crack MD5 hash with wordlist
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

# Crack SHA-256 with rules
hashcat -m 1400 hash.txt wordlist.txt -r rules/best64.rule

# Common hash types:
# -m 0    = MD5
# -m 100  = SHA-1
# -m 1400 = SHA-256
# -m 1800 = SHA-512crypt (Linux)
# -m 1000 = NTLM (Windows)
# -m 2500 = WPA/WPA2 (Wi-Fi)

🕶️ Search .onion sites, darknet markets, and hidden services.

Requires: Tor Browser or Tor service running on port 9050.

# Install Tor
sudo apt install tor proxychains4

# Start Tor service
sudo systemctl start tor
sudo systemctl enable tor

# Test Tor is working
curl --socks5 127.0.0.1:9050 https://check.torproject.org/api/ip

# Use proxychains with any tool
proxychains4 nmap -sT target.onion
proxychains4 curl http://example.onion

# Edit /etc/proxychains4.conf if needed
# Make sure this line is present: socks5 127.0.0.1 9050

🔒 Maintain anonymity during OSINT investigations and protect your identity.

Pro tip: Use Tails OS for investigations requiring full anonymity — it leaves zero trace on disk.

🕸️ Fingerprint web technologies, discover hidden directories, and crawl for endpoints.

Pro tip: Run Whatweb first to fingerprint, then Nikto for quick vulns, then Nuclei for deep scanning.

🎭 Phishing simulation frameworks for authorized red team engagements.

⚠️ For authorized penetration testing and security awareness training ONLY.

git clone https://github.com/htr-tech/zphisher.git
cd zphisher
chmod +x zphisher.sh
bash zphisher.sh

# Select template from menu (Facebook, Google, Instagram, etc.)
# Tool generates a phishing URL with Cloudflare/Serveo tunnel
# Captured credentials are saved locally

💣 Frameworks for finding and verifying vulnerabilities on authorized targets.

⚠️ Always have written permission before running any of these tools.

📶 Analyze traffic, audit Wi-Fi networks, and perform MITM on authorized targets.

📲 Android/iOS security testing for authorized assessments.

🤖 AI tools for automating research, analyzing images, and accelerating investigations.

Pro tip: Perplexity AI is excellent for OSINT research — it cites sources so you can verify everything.

💰 Research companies, track crypto, and uncover financial relationships.

🚗 Access public records, vehicle history, property data, and court documents.

🔬 Extract hidden data, recover deleted files, and analyze digital evidence.

Pro tip: CyberChef is a must-bookmark — it handles encoding, encryption, and data manipulation all in-browser.

⚠️ WARNING: Accessing cameras without authorization is illegal everywhere. This section is for educational awareness only — to understand how exposed devices are found so you can protect them.

🔍 Advanced search operators for finding information that isn't easily discoverable.

Pro tip: Combine multiple operators for maximum precision. Always test in a private/incognito window.

🗄️ Advanced dorks for finding inadvertently exposed sensitive data on the web.

📍 Tools for tracking IP addresses through crafted links.

⚠️ For authorized use only — e.g., tracking your own email campaigns or authorized phishing simulations.

💡 Trick: Mask a logger URL using the VK redirect: https://vk.com/away.php?to=YOUR_LOGGER_URL

💬 Telegram-based OSINT tools, bots, and intelligence communities.

🇷🇺 Services widely used in Russian-speaking OSINT communities.

📱 Full OSINT & security toolkit setup for Android via Termux.

# First-time Termux setup
pkg update -y && pkg upgrade -y
pkg install python python2 git wget curl nmap
pip install requests colorama
termux-setup-storage

pkg update -y && pkg upgrade -y && \
pkg install -y python git wget curl nmap hydra perl openssh php clang make openssl && \
pip install requests colorama sherlock-project maigret holehe h8mail && \
cd ~ && \
git clone https://github.com/htr-tech/zphisher && \
git clone https://github.com/Manisso/fsociety && \
git clone https://github.com/ultrasecurity/Storm-Breaker && \
git clone https://github.com/wishihab/userrecon && \
echo "Done! All tools installed."

🐉 Tools pre-installed on Kali, plus recommended additions.

# From this repo's installer (recommended — installs everything)
sudo bash install.sh

# Or add specific tools manually:
sudo apt update && sudo apt install -y \
  amass subfinder httpx nuclei gobuster feroxbuster \
  spiderfoot eyewitness phoneinfoga metagoofil

pip install maigret holehe h8mail socialscan social-analyzer \
  deepface face_recognition volatility3 telepathy

🧰 Comprehensive frameworks that bundle dozens of tools under one roof.

📖 Build custom wordlists or use proven collections.

Pro tip: CeWL is great for targeted attacks — it generates wordlists from the target's own website.

# Use RockYou (already in Kali)
/usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz

# Generate a pattern-based wordlist with Crunch
# Format: crunch <min> <max> <charset>
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 -o wordlist.txt

# Generate custom wordlist from a target website
cewl https://example.com -m 6 -w cewl_wordlist.txt

# Profile-based wordlist (interview the target)
python3 cupp.py -i

🔧 Physical devices for authorized penetration testing and hardware security research.

🖥️ Specialized operating systems built for security research, OSINT, and privacy.

🔌 Programmatic access to OSINT data sources for building your own tools.

🧩 Must-have browser extensions for every OSINT investigator.

📚 The best resources for learning OSINT — from beginner to professional.

⭐ The best curated OSINT resource lists on GitHub.

# Option 1: Direct from this repo (one command)
curl -sL https://raw.githubusercontent.com/rawfilejson/awesome-osint-arsenal/main/install.sh | sudo bash

# Option 2: Clone first (recommended — inspect before running)
git clone https://github.com/rawfilejson/awesome-osint-arsenal.git
cd awesome-osint-arsenal
sudo bash install.sh

pkg update -y && pkg upgrade -y
pkg install -y python git wget curl nmap hydra perl openssh php clang make openssl
pip install requests colorama sherlock-project maigret holehe h8mail
cd ~ && git clone https://github.com/htr-tech/zphisher && git clone https://github.com/Manisso/fsociety

sudo apt update && sudo apt upgrade -y
sudo apt install -y git python3 python3-pip golang-go nmap wireshark \
  sqlmap hydra john hashcat aircrack-ng nikto dirb wpscan \
  theharvester maltego spiderfoot set exiftool masscan whatweb \
  gobuster feroxbuster wfuzz libimage-exiftool-perl binwalk \
  foremost bulk-extractor macchanger tor proxychains4

pip3 install sherlock-project maigret holehe h8mail socialscan \
  social-analyzer phoneinfoga snscrape instaloader deepface \
  face_recognition volatility3 blackbird-osint nexfil \
  socid-extractor osrframework telepathy twayback toutatis \
  dnstwist waybackpy trufflehog

cd /opt
sudo git clone https://github.com/Manisso/fsociety
sudo git clone https://github.com/Z4nzu/hackingtool
sudo git clone https://github.com/ultrasecurity/Storm-Breaker
sudo git clone https://github.com/htr-tech/zphisher
sudo git clone https://github.com/s0md3v/Orbit
sudo git clone https://github.com/s0md3v/Photon
sudo git clone https://github.com/danielmiessler/SecLists
sudo git clone https://github.com/lgandx/Responder
sudo git clone https://github.com/commixproject/commix
sudo git clone https://github.com/opsdisk/pagodo
sudo git clone https://github.com/RedSiege/EyeWitness

C2 frameworks, AD attacks, exploitation kits, post-exploitation. Authorized testing only.

Pro tip: Sliver and Havoc are the modern open-source Cobalt Strike alternatives — start there before paying.

SIEM, EDR, network monitoring, detection engineering, IR.

Pro tip: Wazuh is your free Splunk replacement. Pair it with Sigma rules + Suricata for a full SOC stack on commodity hardware.

CTI platforms — open-source and enterprise.

Pro tip: MISP is free and powerful. OpenCTI gives you a STIX2-native graph DB. Both run as Docker stacks.

Disk/memory forensics, malware reverse engineering, timeline tools, binary analysis.

Pro tip: Volatility 3 + Plaso (log2timeline) + KAPE = the modern DFIR triage stack. Ghidra > IDA Free for static analysis.

Hands-on practice — paid platforms and free local labs.

Pro tip: Free path: TryHackMe → PortSwigger Academy → HackTheBox retired boxes. Paid path: HTB Academy + OffSec PG.

Where to actually earn money from your skills.

Pro tip: Start on Bugcrowd or YesWeHack public programs — easier triage and lower competition than HackerOne H1.

Books, courses, blogs, YouTube channels, awesome lists.

Pro tip: IppSec.rocks indexes EVERY HackTheBox walkthrough — search any retired box and watch how a pro solves it.

Tools added in v2.x — modern recon, archive lookups, niche services, research-grade pivots.

Pro tip: This section gets refreshed every release — check before you reach for an older tool.

🇬🇪 The most comprehensive OSINT resource collection for the country of Georgia (Sakartvelo).

28 sub-sections · 500+ verified resources — government databases, public registries, investigative tools, open-data portals, Telegram bots & more.

Pro tip: Pair this with my Georgian-Wordlist (760K Georgian words for security research) and Wordlist-Generator.