OSINT Tools: 12 Free Picks That Pros Actually Use (2026)

What Are OSINT Tools?

OSINT tools are software that collects and correlates information from publicly available sources: DNS records, certificate transparency logs, social media profiles, breach databases, code repositories, and search engine indexes. They automate lookups a person could do by hand, then link the results together so patterns become visible.

The word "open" is doing real work there. An OSINT tool queries sources anyone is allowed to query. The moment it brute-forces a login page or scans ports on a host you are not authorized to touch, it stopped being OSINT and became active testing with a different legal footing.

MITRE tracks this activity formally. The Reconnaissance tactic (TA0043) in the ATT&CK framework contains 12 techniques, and most of them describe purely passive collection: searching open technical databases, gathering victim identity information, searching victim-owned websites. Real adversaries spend serious time here, which is a reasonable argument for defenders and testers doing the same.

OSINT is also not a vulnerability scan. A scanner tells you a host runs an outdated OpenSSH. OSINT tells you the host exists at all, who runs it, and what it is called internally.

How to Choose an OSINT Tool

Pick the tool by the question you are answering, not by its GitHub star count. Almost every investigation reduces to one of four questions, each with a small set of tools that answer it well.

Run them in that order. Infrastructure defines the boundary of everything else, employee names feed email formats, email addresses feed breach lookups, and media usually confirms a hypothesis rather than generating one.

In practice you will use maybe five tools on 90% of engagements. The other thirty exist for the one investigation a year where a target only shows up on an obscure regional platform.

Infrastructure OSINT Tools: Mapping the Attack Surface

Every engagement starts here. The goal is a list of hostnames, IP ranges, and services belonging to the target, built without sending traffic to the target itself.

OWASP Amass

Amass is an OWASP Flagship project and the closest thing OSINT has to a standard for asset discovery. It queries dozens of data sources, correlates the results, and builds a graph of the target's external footprint. Passive mode never touches the target:

amass enum -passive -d example.com

On a mid-sized company, expect a few hundred subdomains in a couple of minutes. Amass 5.x added an asset database, so results persist between runs instead of forcing a re-enumeration. Add API keys for SecurityTrails, Shodan, and VirusTotal to the config file and the yield jumps. Without keys it still works, just thinner.

Certificate Transparency Logs (crt.sh)

Every publicly trusted TLS certificate issued since 2018 gets logged to a public, append-only Certificate Transparency log. That means the certificate an admin quietly issued for staging-internal.example.com is a matter of public record. The crt.sh service searches those logs, and it needs no account:

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u

This single command is the highest signal-to-effort ratio in all of OSINT. It routinely surfaces development, staging, and admin hostnames that never appear in DNS brute-force wordlists, because nobody guesses jenkins-prod-eu-west-1. When I only have five minutes on a new target, this is the command I run.

theHarvester

theHarvester pulls emails, subdomains, hostnames, and employee names from more than 50 passive sources including Certificate Transparency, DuckDuckGo, HackerTarget, and Shodan. It ships with Kali, so there is nothing to install:

theHarvester -d example.com -b crtsh,hackertarget,duckduckgo

Its email harvesting is the real draw. Two or three confirmed addresses reveal the naming convention (first.last@, flast@, first@), and that convention plus a LinkedIn employee list becomes an account list on an authorized red team engagement.

Shodan

Shodan indexes service banners from internet-connected hosts rather than web pages, which makes it a search engine for infrastructure. The filters are where the value sits:

ssl.cert.subject.CN:"example.com" 200
org:"Example Inc" port:22

The first finds every host presenting a certificate for the domain, including ones with no DNS record pointing at them. The second lists exposed SSH on hosts attributed to the organization. Filters need a free account, which is a fair trade.

Confirm the results with an active scan once you are authorized, because Shodan data can be weeks stale. Our Nmap cheat sheet covers the flag combinations for that.

People and Account OSINT Tools

Infrastructure tells you what to attack. People tell you how you will get in, because phishing and credential reuse beat exploits on most real engagements.

Sherlock

Sherlock takes a username and checks it against 400+ social networks, reporting which ones have an account under that handle. Version 0.16.0 runs the checks concurrently, so a full sweep takes under a minute:

sherlock target_username

The output needs human filtering. Common handles produce dozens of unrelated hits, and some sites return a 200 for any username. Sherlock gives you leads, not conclusions. Treat a hit as worth opening in a browser, never as proof of identity.

WhatsMyName

WhatsMyName is the dataset most username tools are actually built on. Micah Hoffman started it in 2015, and it now covers 700+ sites in a single community-maintained JSON file that specifies exactly what a positive and negative response looks like per site. That detection detail is why it produces fewer false positives than tools that just check for HTTP 200.

The browser version at whatsmyname.app needs no install and filters by category, which matters when you only care about developer platforms rather than all 700 sites.

holehe

holehe flips the question: give it an email address and it tells you which of 120+ services have an account registered to it. It works by watching how password reset and registration flows respond to a known versus unknown address.

holehe [email protected]

This is the noisiest tool in the list. Some checks trigger a password reset email to the target, which may be acceptable on an authorized social engineering assessment and is a fast way to tip off your subject on a quiet reconnaissance pass. Read what each module does before running it broadly.

Email and Breach Data Tools

An email address is not just a contact method. It is a join key that links a person across breach corpora, code commits, and forum registrations.

Have I Been Pwned is the reference source. As of August 2026 it indexes 1,022 breached websites covering 17,765,749,944 compromised accounts, and it exposes a domain search that lets a verified domain owner see every address in their organization that appears in a breach. For a defender writing a password reset policy, that single report is worth more than most paid threat intelligence feeds.

Hunter maps domains to email formats from public web sources, answering "what does an address at this company look like" faster than piecing it together from press releases. Its free tier caps monthly searches: fine for one engagement, not for bulk work.

Code repositories belong in this stage too, because developers commit secrets constantly. A GitHub search for the target's domain alongside password, api_key, or BEGIN RSA PRIVATE KEY finds live credentials more often than anyone is comfortable with. Git history is the specific trap: a secret removed in a later commit still sits in the repository's history, fully readable.

Image, Document, and Metadata Tools

Files carry more than their contents. A photo can hold GPS coordinates, a camera serial number, and a timestamp. A PDF can name the author, the software version, and the internal path it was saved from.

ExifTool by Phil Harvey reads metadata for basically every format that has any:

exiftool photo.jpg

Look for GPSLatitude, GPSLongitude, CreateDate, and Model. On documents, Author and Creator often leak an internal username matching the corporate account format, a clean bridge from a public PDF to a valid username.

Manage expectations on GPS data, though. Instagram, Facebook, X, and most modern platforms strip EXIF on upload. GPS coordinates survive in files downloaded from a company's own website, sent as email attachments, or hosted on smaller platforms that never implemented stripping. In practice, corporate PDF files leak far more useful metadata than social media photos do.

When metadata is stripped, the image itself becomes the lead. Reverse image search across Google Images, Yandex, and TinEye covers different indexes, and Yandex is noticeably stronger on faces and non-Western content. After that it is manual work: signage, license plates, power outlets, vegetation, the direction of shadows.

Google Dorking: The OSINT Tool You Already Have

No installed tool beats a well-constructed search query. Google dorking means using search operators to find content the site owner never meant to be indexed, and it costs nothing.

• site:example.com -www lists indexed subdomains other than the main site.
• site:example.com filetype:pdf pulls every indexed PDF, each carrying metadata.
• intitle:"index of" site:example.com finds directory listings left open.
• site:pastebin.com "example.com" catches leaked configuration files and credential dumps.
• site:linkedin.com/in "Example Inc" "engineer" builds an employee list without a LinkedIn account.

The Google Hacking Database on Exploit-DB catalogs thousands of these patterns by category, from exposed admin panels to sensitive directories. Skim it once and you will start recognizing the shapes rather than copying queries.

Two practical notes. Run the same query on Bing and DuckDuckGo, since their indexes differ and Bing often retains pages Google has dropped. And expect a CAPTCHA after a burst of operator-heavy searches: that is rate limiting, not a block, and slowing down fixes it.

Automation Frameworks: SpiderFoot, Recon-ng, and Maltego

Once you know what the individual tools do, frameworks chain them together and correlate the output. They are a time saver, not a replacement for understanding the underlying lookups.

SpiderFoot (version 4.0) runs over 200 modules against a target and presents the results through a web interface. Most modules need no API key. Start the server locally and drive it from the browser:

spiderfoot -l 127.0.0.1:5001

A full domain scan returns an enormous result set, much of it noise. The correlation view is what makes it worthwhile, grouping findings into categories like exposed credentials and expiring certificates instead of dumping raw records.

Recon-ng uses a module system familiar to anyone who has used Metasploit, with a workspace database that persists across sessions. Pick it when you want scripted, repeatable collection you can query in SQL afterward.

Maltego is the graph tool. It renders relationships visually, which earns its keep when an investigation involves people connected to companies connected to domains connected to more people. The Community Edition is free and includes 200 monthly credits for querying Maltego Data: enough to learn the interface and run a small investigation, not enough for sustained professional work.

An opinionated call, since somebody always asks. The OSINT Framework mind map at osintframework.com is the most linked OSINT resource on the internet and one of the least useful for doing an actual investigation. It is a directory of links, and plenty of them point at services that shut down years ago. Use it to discover a category of tool you did not know existed, not as a workflow.

Building an OSINT Workflow That Does Not Waste Time

Tools are the easy part. The failure mode in OSINT is collecting a mountain of data and turning none of it into a finding.

1. Write the question first. "Map the external attack surface of example.com" is a question. "Find stuff about example.com" is not, and it produces output nobody can act on.
2. Collect infrastructure passively. crt.sh, then Amass in passive mode, then Shodan. Save the raw output to files with the date in the filename.
3. Build the people layer. Employee names, email format, then usernames. Each stage feeds the next.
4. Correlate before you expand. Look for the overlap between the two layers: the developer whose GitHub handle matches the subdomain naming, the staging host with an employee name in it.
5. Record the source of every finding. An unattributed claim in an OSINT report is worthless, because the client cannot verify it and you cannot reproduce it in six months.

Step five is the one people skip and regret. Keep a notes file with the URL, the timestamp, and a screenshot for anything that could disappear. Deleted posts and pulled repositories are exactly the findings worth having, and exactly the ones that vanish before the report goes out.

Set a time budget per stage too. OSINT expands to fill whatever time you give it, and a tester who spends two days on reconnaissance for a five-day engagement has made a scoping mistake, not a thoroughness win.

Legal and Ethical Considerations

Reading one public LinkedIn profile is unambiguously legal. Aggregating hundreds of them into a dossier on named individuals engages data protection law, and under GDPR that processing needs a lawful basis regardless of whether each source was public.

• Never create fake profiles to access non-public content unless your engagement contract explicitly permits it.
• Stay passive unless authorized. The moment a tool sends a password reset email or scans a port, you have left OSINT behind.
• Store collected personal data as sensitively as the client's own systems would, and delete it when the engagement closes.
• Investigating a private individual out of curiosity is not research. It is stalking, and the tools do not care about your intent.

For a formal framework, NIST SP 800-115 covers information gathering as part of a scoped technical assessment and is a reasonable reference to cite in a rules-of-engagement document.