Popular OSINT Tools in Cybersecurity With the increasing cyber threats in the digital landscape, cybersecurity has become a top priority for organizations and individuals alike. Open-source intelligence (OSINT) tools help security professionals gather publicly available information to assess exposure and identify risks. The tools below are grouped by purpose. Note that while many are free and open source, some are commercial or freemium services included here for their usefulness in OSINT work. Breach & Identity Exposure Have I Been Pwned - haveibeenpwned.com An essential service that checks whether an email address or password has appeared in a known data breach. CheckUserNames - checkusernames.com Checks the availability (and existence) of a username across many social and web platforms. BeenVerified - beenverified.com A commercial background-check service that aggregates public records. (Paid.) Internet-Wide Asset Search Engines Shodan - shodan.io Often called the "search engine for the Internet of Things," Shodan scans the internet and indexes the service banners it collects, exposing internet-facing devices. (Freemium.) Censys - censys.io A search engine that lets researchers query hosts and networks to uncover exposed services and misconfigurations. (Freemium.) ZoomEye - zoomeye.org A cyberspace search engine for finding specific network components (webcams, routers, servers) through various filters. (Freemium.) Reconnaissance Frameworks & Aggregators OSINT Framework - osintframework.com A curated collection of OSINT resources organized by purpose - a good starting point for any investigation. Maltego - maltego.com A data-mining tool that renders interactive link-analysis graphs to map relationships between OSINT data points. (Free and commercial editions.) Recon-ng - github.com/lanmaster53/recon-ng A full-featured reconnaissance framework with modules for automated information gathering. (Open source.) theHarvester - github.com/laramies/theHarvester Gathers emails, subdomains, hosts, and more from a range of public sources. (Open source.) IVRE - ivre.rocks A network reconnaissance framework that builds its own self-hosted view of a network from passive and active data sources. (Open source.) Website & Metadata Analysis BuiltWith - builtwith.com Identifies the technologies (frameworks, analytics, hosting) that a given website is built on. (Freemium.) FOCA - github.com/ElevenPaths/FOCA Fingerprinting Organizations with Collected Archives - extracts metadata and hidden information from public documents. (Open source.) Metagoofil - github.com/laramies/metagoofil Extracts metadata from public documents (PDF, DOC, XLS, PPT) found on target websites. (Open source.) ExifTool - exiftool.org A command-line application and Perl library for reading, writing, and editing metadata in files - especially useful for photos and videos. (Open source.) Google Dorks - google.com Advanced Google search operators used to surface exposed files, directories, and sensitive data. Not a product but a technique. Network & Vulnerability Scanning Nmap - nmap.org The Network Mapper, a widely used tool for host discovery, port scanning, and service detection. See our article on Nmap in Cybersecurity Practices. (Open source.) OpenVAS / Greenbone - openvas.org A comprehensive vulnerability scanning and management framework. (Open source.) Unicornscan - github.com/dneufeld/unicornscan An asynchronous port scanner built for large-scale, high-speed scanning. (Open source.) Fierce - github.com/mschwager/fierce A DNS reconnaissance tool for locating non-contiguous IP space and hostnames. (Open source.) Geolocation Creepy - github.com/ilektrojohn/creepy Aggregates geolocation data from social media and image-hosting services and plots it on a map. (Open source; note this project is no longer actively maintained.) Use responsibly. These tools surface publicly available information, but that does not make every use of them lawful or ethical. Always ensure you have appropriate authorization before conducting cybersecurity research or investigations, and stay within the scope of any engagement. See our overview of Common Penetration Testing Methodologies and Other Standards for how these tools fit into a structured, authorized assessment. Want a professional security assessment of your organization's exposure? Our Managed IT Services team can help.