OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.
See the code
Contains a list of OSINT tools, OSINT tips, datasets, Maltego transform and others. There are free and paid tools you can use and owner is not responsible (take your own risks), only for knowledge or educational purposes. Apologies if some of the resources are no longer available or contain errors, as the owner does not regularly check the status of these resources, If there is new information, the owner will add it to this repo along with the category. If you want to read about techniques and intelligence some have already been added to the Wiki page Jieyaboo Wiki The owner will add them back. If there are any errors let us know thank you.
Please take a notes. Due to the large number of supply chain attacks, refer to OWASP TOP 10 2025 also the TA campaign like fake captcha, injected script, obfuscate script and other. My advice is to use a sandbox machine that does not contain your personal data and office. With the rise of malware stealers, crypto miners, and other threats, to reduce this risk, you can use fake accounts on social media, email, phone numbers, and your sandbox machine, as well as turn on your AV (Anti Virus) and firewall. For malicious activiy also untracked resouces Jieyab will remove it
Tips:
Contains information about OSINT tips, OSINT branches and knowledge about intelligence
Contains information about OSINT tips, write up usage resouces, use case, my research also other Intelligence base
Info
| Date | Remarks |
|---|---|
| 8 Aug 2026 | Sorry. Update, all the Gitbook and Github Wiki are not public. This site has been made private. If want to read latest update and the change you can chat me in Email "julisandipratam<@_at>gmail.com" you can also using my pub GPG key to send a message Lang used is English and Bahasa Indonesia. Is free no payment and donation. If you want to read access access here : https://forms.gle/AV3MTvzy4ovjYT6Y6 |
| 20 Aug 2026 | Update Jieyab exclusive content Intelligence Base & Knowledge Base, Cell Investigation, Talk About Data Breach, Signal Intel, all about open source data, all about darkweb |
| 21 Aug 2026 | Update Jieyab wiki Github content add article all about android pentest, all about programming, darkweb scrapping, telegram dork also etc |
| Country / Region | Legal Framework | Key Legal Considerations | OSINT / PII Implications |
|---|---|---|---|
| Indonesia ๐ฎ๐ฉ | Personal Data Protection Law (Law No. 27 of 2022) โ UU PDP Electronic Information and Transactions Law (UU ITE) โ Law Overview | Requires a lawful basis for processing personal data (consent, contract, legal obligation, legitimate interest, etc.). Data subjects have rights. UU ITE prohibits unlawful access and misuse of electronic data. | OSINT using publicly available data is generally permissible, but processing identifiable personal data must comply with PDP Law principles such as purpose limitation and data minimization. |
| European Union ๐ช๐บ | General Data Protection Regulation (GDPR) โ Official EU Text | Processing requires a lawful basis (consent, legitimate interest, etc.). Transparency, accountability, and data subject rights apply. High-risk processing may require a DPIA. | Public availability does not remove GDPR obligations. OSINT involving EU residentsโ personal data must meet GDPR compliance standards. |
| Spain ๐ช๐ธ | LOPDGDD (Spainโs Organic Law on Data Protection) + GDPR โ Official Text (BOE) | Supplements GDPR with national rules. Legitimate interest may apply for research under strict necessity and proportionality tests. | OSINT research must document lawful basis and balance privacy impact against legitimate interest. |
| Mexico ๐ฒ๐ฝ | Federal Law on Protection of Personal Data Held by Private Parties โ Official Government Portal | Requires privacy notice, lawful basis, and safeguards when processing personal data. Individuals have rights to access, rectify, cancel, or oppose data use. | Collecting public data is allowed, but processing personal data still falls under legal protections. |
| United States ๐บ๐ธ | Computer Fraud and Abuse Act (CFAA) โ Cornell Law School Reference State Privacy Laws (e.g., CCPA/CPRA) โ California DOJ | Prohibits unauthorized access to computers and bypassing authentication. Privacy laws vary by state. | OSINT is legal when using publicly accessible sources. Accessing restricted systems or circumventing security controls is illegal. |
| China ๐จ๐ณ | Personal Information Protection Law (PIPL) โ Official Text (NPC) Cybersecurity Law (CSL) โ Overview Data Security Law (DSL) โ Overview | PIPL requires lawful basis and strict consent rules for personal data processing. Strong state controls on data handling, cross-border transfer restrictions, and broad definitions of sensitive personal information. | Even publicly available personal data can be regulated under PIPL. Large-scale OSINT data aggregation, profiling, or export outside China may trigger compliance reviews or security assessments. |
| International (Human Rights) | International Covenant on Civil and Political Rights (ICCPR), Article 17 โ UN Text | Recognizes the right to privacy and protection from arbitrary interference. Applies to digital environments. | OSINT activities should respect fundamental privacy rights even when data is publicly accessible. |
| OSINT Ethical Principles (Non-Legal) | Community-driven OSINT codes of conduct and research ethics | Use only lawfully and publicly available sources. Avoid doxxing, stalking, harassment, or data resale. Minimize sensitive data collection. | Ethical practice often goes beyond legal requirements and reduces risk of harm, misuse, or reputational damage. |
You can build it with VM or Live USB, Docker, Deploy on VPS make sure you have sandbox machine!
Artist string
Author string
Caption string
Categories string
Collections string
DateTime date
DPP lang-alt
EditStatus string
FixtureIdentifier string
Keywords string
Notes string
ObjectCycle string
OriginatingProgram string
Rating real
Rawrppused boolean
ReleaseDate string
ReleaseTime string
RPP lang-alt
Snapshots string
Tagged boolean
More : man exiftool (Run on your terminal)
Site :
example : exiftool -Author="Bayu" test.txt
you can add multiple tag and multiple file
example : exiftool -Author="" test.txt
example : exiftool -all="" file
Usage : man exiftool or read documentation exiftool.org
Not there are tag no writetable, make sure tagname can write
Automated tool by David Bombal
Use fresh file, if your file has been compressed or edit metadata you got a default metadata You can use xmp format for edit, write and delete metadata Check the documentation
Site and forums OSINT community arround world
All demonstrations in this repository are performed in isolated, self-hosted lab environments. Do not use any information here against real, third-party infrastructure, devices, or networks without explicit written authorization. The author are not responsible for misuse.
Legal Considerations
SIGINT work spans multiple signal domains (cellular, WiFi, RFID/NFC, Sub-GHz radio, etc.), each governed by different areas of law depending on jurisdiction. Broadly:
Rule of thumb: if a tool or technique in this repo can transmit, intercept, or interact with real third-party infrastructure, it needs either (a) your own isolated lab environment with no real target involved, or (b) explicit written authorization from the owner/operator, or (c) a license from the relevant regulator.
| Jurisdiction | Regulator | Reference |
|---|---|---|
| ๐ฎ๐ฉ Indonesia | Kominfo / Ditjen SDPPI | UU No. 36 Tahun 1999 tentang Telekomunikasi |
| ๐ฎ๐ฉ Indonesia | โ | UU ITE (unauthorized access / computer misuse) |
| ๐บ๐ธ United States | FCC | Communications Act of 1934, ยง301 (47 U.S.C. ยง301) |
| ๐บ๐ธ United States | โ | Computer Fraud and Abuse Act (CFAA) โ unauthorized access |
| ๐ช๐บ European Union | ETSI / national NRAs | ETSI EN 301 893 (spectrum access rules; check individual member-state telecom & cybercrime law) |
| International | ITU-R | ITU Radio Regulations |
Add your own country's regulator/law here as needed โ this table is not exhaustive.
List for learn SIGINT. There is a hardware also the software
Hardware
Software
Visualization
U can integrate with commercial satellite platform like Sentinel, Planet labs and etc
Simulation and Labs
Resources
Pro Tips
Try search on forum like programmer forums, web framework forums, social media and other things. Use a google dork to easy way find information with site target
List endpoint Github for search code
Endpoint list Github (Better login with your account for best results)
Guide Github search code by Jieyab89 : https://github.com/Jieyab89/OSINT-Cheat-sheet/tree/main/Script/Github-Search
Hastag and keyword analysis in search engine, social media or other platform (Text Intel)
Notes this is for surface web or clearnet site
Use this if google cache was gone (no index sites)
https[:]//www[.]google[.]com/search?q=cache:<url of interest>
There is a resouces to investigae malicious link and bypass url shortlink
Tips
You can find the file hash or other threat indicator
Github Dork
Dorking is a wonderful thing, you can use this technique to search for anything such as index of a website, looking for live online camera server and other specifics, as for dorking commands that you can do for example
Example
Example
Web Defacement Archive
Tips
You can use dork and cache for Google index search hacker nickname also try search into archiver data broker like wayback, archive today and etc
Politic and Geopolitic Archive
Malware Database Archive
Crack medium article
Pro Tips
You can also use Google dork to search blogger profile
Pro Tips
If you has found the person phone number you can check at data breach, e wallet, social media, email address (via reset password), getcontact, truecaller, ipqs, fraud checker and last trying to dork or search any info into social media too
Group Search: site:facebook.com inurl:group
Group Wall Posts Search: site:facebook.com inurl:wall
Pages Search: site:facebook.com inurl:pages
Public Profiles: allinurl: people 'name' site:facebook.com
Photos By - https://www.facebook.com/search/taget_id/photos-by
Photos Liked - https://www.facebook.com/search/taget_id/photos-liked
Photos Of - https://www.facebook.com/search/taget_id/photos-of
Comments - https://www.facebook.com/search/taget_id/photos-commented
Friends - https://www.facebook.com/search/taget_id/friends
Videos Tagged - https://www.facebook.com/search/taget_id/videos
Videos By - https://www.facebook.com/search/taget_id/videos-by
Videos Liked - https://www.facebook.com/search/taget_id/videos-liked
Videos Commented - https://www.facebook.com/search/taget_id/videos-commented
Events Attended - https://www.facebook.com/search/taget_id/events-joined
Relatives - https://www.facebook.com/search/taget_id/relatives
or you can use dork for spesific example
id site:facebook.com
page site: facebook.com
id site:facebook.com *
page site: facebook.com *
For this case u must know the context also dorking for better results
Pro Tips
Note is for investigator like search scandal (Adult), deepfake porn or blackmail, red district review, night life and club, women, dating platform and porn actress. Searching for scandal or blackmail or deepfake porn doesn't have to be on the listed sites, there are many predators uploading on several platforms You need to do massive scrapping to collect this information, but there are times when they do it on platforms such as telegram, X or adult sites, you can search using dork, regex and linguistic like slang, abbreviation of word and other things
Twitter Search Engine
Google queries for LinkedIn
Public Profiles: site:linkedin.com inurl:pub
Updated Profiles: site:linkedin.com inurl:updates
Company Profiles: site:linkedin.com inurl:companies
Google queries for MySpace
Profiles: site: myspace.com inurl:profile
Blogs: site:myspace.com inurl:blogs
Videos: site:myspace.com inurl:vids
Jobs: site:myspace.com inurl:jobs
Videos: site:myspace.com 'TARGET NAME' 'videos'
Comments: site:myspace.com 'TARGET NAME' 'comments'
Friends: site:myspace.com 'TARGET NAME' 'friends'
Mostly general for searching data like web enumerate, attack surface, email, person and etc with hosted and manual installation (local install) in your machine
Search channel, username, bot and anymore
Telegram Tips
View and parse the data like usernanme, private group, phone number and etc
Telegram tips. Change the hash value, username, phone number on the endpoint or url's
Scribd viewer
Scribd downloader
Conveter tool
*This for you have data like .shp and .kml or geojson and want to viewer or convert with the spesific tool for you analsis or sciene and other
Geojson viewer
3D Map & Building
List Country Code
Guides
Guide
Transaction Analysis
Guide
Pro Tips
If you has found the person phone number you can check at data breach, e wallet, social media, email address (via reset password), getcontact, truecaller, ipqs, fraud checker and last trying to dork or search any info into social media too
Telegram
Build your sockpuppet account and proctect your privacy
Build your own deepfake
*Generate your deepfake (is taking longer time, need high gpu)
Virtual Camera or Camera Replacement
*Beware, make sure installed on not primary device use device for research
FakeGPS Location
Social Network and blogging
Browser Sandbox
Truncated โ view the full README on GitHub.
507 followers ยท starred Jan 2025
72 followers ยท starred Sep 2026
138 followers ยท starred Jul 2026
20 followers ยท starred Oct 2023
OSINT cheat sheet, list OSINT tools, wiki, dataset, article, book , red team OSINT for hackers and OSINT tips and OSINT branch. This repository will grow every time will research, there is a research, science and technology, tutorial. Please use it wisely.
See the codeContains a list of OSINT tools, OSINT tips, datasets, Maltego transform and others. There are free and paid tools you can use and owner is not responsible (take your own risks), only for knowledge or educational purposes. Apologies if some of the resources are no longer available or contain errors, as the owner does not regularly check the status of these resources, If there is new information, the owner will add it to this repo along with the category. If you want to read about techniques and intelligence some have already been added to the Wiki page Jieyaboo Wiki The owner will add them back. If there are any errors let us know thank you.
Please take a notes. Due to the large number of supply chain attacks, refer to OWASP TOP 10 2025 also the TA campaign like fake captcha, injected script, obfuscate script and other. My advice is to use a sandbox machine that does not contain your personal data and office. With the rise of malware stealers, crypto miners, and other threats, to reduce this risk, you can use fake accounts on social media, email, phone numbers, and your sandbox machine, as well as turn on your AV (Anti Virus) and firewall. For malicious activiy also untracked resouces Jieyab will remove it
Tips:
Contains information about OSINT tips, OSINT branches and knowledge about intelligence
Contains information about OSINT tips, write up usage resouces, use case, my research also other Intelligence base
Info
| Date | Remarks |
|---|---|
| 8 Aug 2026 | Sorry. Update, all the Gitbook and Github Wiki are not public. This site has been made private. If want to read latest update and the change you can chat me in Email "julisandipratam<@_at>gmail.com" you can also using my pub GPG key to send a message Lang used is English and Bahasa Indonesia. Is free no payment and donation. If you want to read access access here : https://forms.gle/AV3MTvzy4ovjYT6Y6 |
| 20 Aug 2026 | Update Jieyab exclusive content Intelligence Base & Knowledge Base, Cell Investigation, Talk About Data Breach, Signal Intel, all about open source data, all about darkweb |
| 21 Aug 2026 | Update Jieyab wiki Github content add article all about android pentest, all about programming, darkweb scrapping, telegram dork also etc |
| Country / Region | Legal Framework | Key Legal Considerations | OSINT / PII Implications |
|---|---|---|---|
| Indonesia ๐ฎ๐ฉ | Personal Data Protection Law (Law No. 27 of 2022) โ UU PDP Electronic Information and Transactions Law (UU ITE) โ Law Overview | Requires a lawful basis for processing personal data (consent, contract, legal obligation, legitimate interest, etc.). Data subjects have rights. UU ITE prohibits unlawful access and misuse of electronic data. | OSINT using publicly available data is generally permissible, but processing identifiable personal data must comply with PDP Law principles such as purpose limitation and data minimization. |
| European Union ๐ช๐บ | General Data Protection Regulation (GDPR) โ Official EU Text | Processing requires a lawful basis (consent, legitimate interest, etc.). Transparency, accountability, and data subject rights apply. High-risk processing may require a DPIA. | Public availability does not remove GDPR obligations. OSINT involving EU residentsโ personal data must meet GDPR compliance standards. |
| Spain ๐ช๐ธ | LOPDGDD (Spainโs Organic Law on Data Protection) + GDPR โ Official Text (BOE) | Supplements GDPR with national rules. Legitimate interest may apply for research under strict necessity and proportionality tests. | OSINT research must document lawful basis and balance privacy impact against legitimate interest. |
| Mexico ๐ฒ๐ฝ | Federal Law on Protection of Personal Data Held by Private Parties โ Official Government Portal | Requires privacy notice, lawful basis, and safeguards when processing personal data. Individuals have rights to access, rectify, cancel, or oppose data use. | Collecting public data is allowed, but processing personal data still falls under legal protections. |
| United States ๐บ๐ธ | Computer Fraud and Abuse Act (CFAA) โ Cornell Law School Reference State Privacy Laws (e.g., CCPA/CPRA) โ California DOJ | Prohibits unauthorized access to computers and bypassing authentication. Privacy laws vary by state. | OSINT is legal when using publicly accessible sources. Accessing restricted systems or circumventing security controls is illegal. |
| China ๐จ๐ณ | Personal Information Protection Law (PIPL) โ Official Text (NPC) Cybersecurity Law (CSL) โ Overview Data Security Law (DSL) โ Overview | PIPL requires lawful basis and strict consent rules for personal data processing. Strong state controls on data handling, cross-border transfer restrictions, and broad definitions of sensitive personal information. | Even publicly available personal data can be regulated under PIPL. Large-scale OSINT data aggregation, profiling, or export outside China may trigger compliance reviews or security assessments. |
| International (Human Rights) | International Covenant on Civil and Political Rights (ICCPR), Article 17 โ UN Text | Recognizes the right to privacy and protection from arbitrary interference. Applies to digital environments. | OSINT activities should respect fundamental privacy rights even when data is publicly accessible. |
| OSINT Ethical Principles (Non-Legal) | Community-driven OSINT codes of conduct and research ethics | Use only lawfully and publicly available sources. Avoid doxxing, stalking, harassment, or data resale. Minimize sensitive data collection. | Ethical practice often goes beyond legal requirements and reduces risk of harm, misuse, or reputational damage. |
You can build it with VM or Live USB, Docker, Deploy on VPS make sure you have sandbox machine!
Artist string
Author string
Caption string
Categories string
Collections string
DateTime date
DPP lang-alt
EditStatus string
FixtureIdentifier string
Keywords string
Notes string
ObjectCycle string
OriginatingProgram string
Rating real
Rawrppused boolean
ReleaseDate string
ReleaseTime string
RPP lang-alt
Snapshots string
Tagged boolean
More : man exiftool (Run on your terminal)
Site :
example : exiftool -Author="Bayu" test.txt
you can add multiple tag and multiple file
example : exiftool -Author="" test.txt
example : exiftool -all="" file
Usage : man exiftool or read documentation exiftool.org
Not there are tag no writetable, make sure tagname can write
Automated tool by David Bombal
Use fresh file, if your file has been compressed or edit metadata you got a default metadata You can use xmp format for edit, write and delete metadata Check the documentation
Site and forums OSINT community arround world
All demonstrations in this repository are performed in isolated, self-hosted lab environments. Do not use any information here against real, third-party infrastructure, devices, or networks without explicit written authorization. The author are not responsible for misuse.
Legal Considerations
SIGINT work spans multiple signal domains (cellular, WiFi, RFID/NFC, Sub-GHz radio, etc.), each governed by different areas of law depending on jurisdiction. Broadly:
Rule of thumb: if a tool or technique in this repo can transmit, intercept, or interact with real third-party infrastructure, it needs either (a) your own isolated lab environment with no real target involved, or (b) explicit written authorization from the owner/operator, or (c) a license from the relevant regulator.
| Jurisdiction | Regulator | Reference |
|---|---|---|
| ๐ฎ๐ฉ Indonesia | Kominfo / Ditjen SDPPI | UU No. 36 Tahun 1999 tentang Telekomunikasi |
| ๐ฎ๐ฉ Indonesia | โ | UU ITE (unauthorized access / computer misuse) |
| ๐บ๐ธ United States | FCC | Communications Act of 1934, ยง301 (47 U.S.C. ยง301) |
| ๐บ๐ธ United States | โ | Computer Fraud and Abuse Act (CFAA) โ unauthorized access |
| ๐ช๐บ European Union | ETSI / national NRAs | ETSI EN 301 893 (spectrum access rules; check individual member-state telecom & cybercrime law) |
| International | ITU-R | ITU Radio Regulations |
Add your own country's regulator/law here as needed โ this table is not exhaustive.
List for learn SIGINT. There is a hardware also the software
Hardware
Software
Visualization
U can integrate with commercial satellite platform like Sentinel, Planet labs and etc
Simulation and Labs
Resources
Pro Tips
Try search on forum like programmer forums, web framework forums, social media and other things. Use a google dork to easy way find information with site target
List endpoint Github for search code
Endpoint list Github (Better login with your account for best results)
Guide Github search code by Jieyab89 : https://github.com/Jieyab89/OSINT-Cheat-sheet/tree/main/Script/Github-Search
Hastag and keyword analysis in search engine, social media or other platform (Text Intel)
Notes this is for surface web or clearnet site
Use this if google cache was gone (no index sites)
https[:]//www[.]google[.]com/search?q=cache:<url of interest>
There is a resouces to investigae malicious link and bypass url shortlink
Tips
You can find the file hash or other threat indicator
Github Dork
Dorking is a wonderful thing, you can use this technique to search for anything such as index of a website, looking for live online camera server and other specifics, as for dorking commands that you can do for example
Example
Example
Web Defacement Archive
Tips
You can use dork and cache for Google index search hacker nickname also try search into archiver data broker like wayback, archive today and etc
Politic and Geopolitic Archive
Malware Database Archive
Crack medium article
Pro Tips
You can also use Google dork to search blogger profile
Pro Tips
If you has found the person phone number you can check at data breach, e wallet, social media, email address (via reset password), getcontact, truecaller, ipqs, fraud checker and last trying to dork or search any info into social media too
Group Search: site:facebook.com inurl:group
Group Wall Posts Search: site:facebook.com inurl:wall
Pages Search: site:facebook.com inurl:pages
Public Profiles: allinurl: people 'name' site:facebook.com
Photos By - https://www.facebook.com/search/taget_id/photos-by
Photos Liked - https://www.facebook.com/search/taget_id/photos-liked
Photos Of - https://www.facebook.com/search/taget_id/photos-of
Comments - https://www.facebook.com/search/taget_id/photos-commented
Friends - https://www.facebook.com/search/taget_id/friends
Videos Tagged - https://www.facebook.com/search/taget_id/videos
Videos By - https://www.facebook.com/search/taget_id/videos-by
Videos Liked - https://www.facebook.com/search/taget_id/videos-liked
Videos Commented - https://www.facebook.com/search/taget_id/videos-commented
Events Attended - https://www.facebook.com/search/taget_id/events-joined
Relatives - https://www.facebook.com/search/taget_id/relatives
or you can use dork for spesific example
id site:facebook.com
page site: facebook.com
id site:facebook.com *
page site: facebook.com *
For this case u must know the context also dorking for better results
Pro Tips
Note is for investigator like search scandal (Adult), deepfake porn or blackmail, red district review, night life and club, women, dating platform and porn actress. Searching for scandal or blackmail or deepfake porn doesn't have to be on the listed sites, there are many predators uploading on several platforms You need to do massive scrapping to collect this information, but there are times when they do it on platforms such as telegram, X or adult sites, you can search using dork, regex and linguistic like slang, abbreviation of word and other things
Twitter Search Engine
Google queries for LinkedIn
Public Profiles: site:linkedin.com inurl:pub
Updated Profiles: site:linkedin.com inurl:updates
Company Profiles: site:linkedin.com inurl:companies
Google queries for MySpace
Profiles: site: myspace.com inurl:profile
Blogs: site:myspace.com inurl:blogs
Videos: site:myspace.com inurl:vids
Jobs: site:myspace.com inurl:jobs
Videos: site:myspace.com 'TARGET NAME' 'videos'
Comments: site:myspace.com 'TARGET NAME' 'comments'
Friends: site:myspace.com 'TARGET NAME' 'friends'
Mostly general for searching data like web enumerate, attack surface, email, person and etc with hosted and manual installation (local install) in your machine
Search channel, username, bot and anymore
Telegram Tips
View and parse the data like usernanme, private group, phone number and etc
Telegram tips. Change the hash value, username, phone number on the endpoint or url's
Scribd viewer
Scribd downloader
Conveter tool
*This for you have data like .shp and .kml or geojson and want to viewer or convert with the spesific tool for you analsis or sciene and other
Geojson viewer
3D Map & Building
List Country Code
Guides
Guide
Transaction Analysis
Guide
Pro Tips
If you has found the person phone number you can check at data breach, e wallet, social media, email address (via reset password), getcontact, truecaller, ipqs, fraud checker and last trying to dork or search any info into social media too
Telegram
Build your sockpuppet account and proctect your privacy
Build your own deepfake
*Generate your deepfake (is taking longer time, need high gpu)
Virtual Camera or Camera Replacement
*Beware, make sure installed on not primary device use device for research
FakeGPS Location
Social Network and blogging
Browser Sandbox
Truncated โ view the full README on GitHub.
507 followers ยท starred Jan 2025
72 followers ยท starred Sep 2026
138 followers ยท starred Jul 2026
20 followers ยท starred Oct 2023