🔍 AWESOME OSINT ARSENAL

The Ultimate Open-Source Intelligence + Security Toolkit

753+ tools · 50 categories · Multi-distro installers · Georgian OSINT · Termux support

The most comprehensive OSINT and security toolkit on the internet — every tool with installation instructions or a verified link.

⚡ Get everything in one command

git clone https://github.com/rawfilejson/awesome-osint-arsenal && cd awesome-osint-arsenal && sudo bash install.sh

🎯 Or pick just what you need

sudo bash osint.sh        # 🔍 OSINT only (Sherlock, Maigret, Amass, …)

sudo bash redteam.sh      # ⚔️  Red team (Sliver, BloodHound, Mimikatz, Nuclei, …)

sudo bash blueteam.sh     # 🛡️  Blue team (Wazuh, Sigma, Suricata, Velociraptor, …)

sudo bash forensics.sh    # 🔬 DFIR + RE (Volatility, Ghidra, radare2, …)

sudo bash hardware.sh     # 🔌 Hardware + SDR (binwalk, hackrf, openocd, …)

sudo bash labs.sh         # 🎓 Vulnerable apps for practice (DVWA, Juice Shop, …)

bash termux.sh            # 📱 Android (Termux subset, no sudo needed)

Works on Kali, Debian, Ubuntu, Parrot, Mint, Pop!_OS (best — apt) Partial on Arch / Manjaro / Fedora / RHEL (auto-detected, falls back to git/pip/go) Termux subset on Android

[!IMPORTANT]

🙏 A note before you fork

This repo has 753 tools across 50 categories. Keeping that current — links, install commands, new tools every week — is a lot for one person.

If nobody helps, parts of this list will go stale. That's just real talk.

How you can help in 30 seconds:

• ⭐ Star the repo (more stars = more contributors find it)
• 🐛 Spotted a dead link? Open an issue, takes 1 minute
• 🧩 Adding a tool? Skim CONTRIBUTING.md first — keeps your PR from getting closed
• ☕ Buy me a coffee so weekends keep going to this
• 📢 Share it — tweet, Discord, wherever the security crowd hangs out

If something's broken: don't just complain — open an issue or PR. That's how this stays useful.

[!WARNING] DISCLAIMER: This repository is for educational and authorized security research only. Always obtain written permission before testing systems you do not own. The authors are not responsible for any misuse of the tools or techniques listed here. See the full Legal Disclaimer at the bottom.

📋 Table of Contents

⚙️ Installation Guide

Quick install — Kali / Debian / Ubuntu / Parrot

git clone https://github.com/rawfilejson/awesome-osint-arsenal

cd awesome-osint-arsenal

sudo bash install.sh

Pick a single stack

Other Linux distros

The installers auto-detect your package manager:

What every installer does

• Detects your distro and uses the right package manager
• Skips what's already installed (idempotent — safe to re-run)
• Color output: 🟢 installed · 🟡 skipped · 🔴 failed
• Logs failures to ~/osint-install-errors.log
• Prints a summary at the end
• Tools cloned via git go to /opt/osint-arsenal/ (or $HOME/osint-arsenal/ on Termux)

After install — add tools to your PATH

echo 'export PATH="$PATH:/opt/osint-arsenal"' >> ~/.bashrc

source ~/.bashrc

Tools installed via apt/pip/go install are already on your $PATH.

📊 Stats at a Glance

1. Username & Social Media OSINT

🎯 Find accounts, profiles, and digital footprints across hundreds of platforms.

Pro tip: Start with Sherlock for a quick sweep, then use Maigret for depth — it covers 3000+ sites.

# Kali Linux / Ubuntu
pip install sherlock-project
sherlock "username"

# From GitHub source (always latest)
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
pip install -r requirements.txt
python3 sherlock "username"

# Search multiple usernames at once
sherlock user1 user2 user3

pip install maigret
maigret "username"

# From source
git clone https://github.com/soxoj/maigret.git
cd maigret
pip install -r requirements.txt
python3 -m maigret "username"

# Generate HTML report
maigret "username" --html

2. Email OSINT Tools

📧 Verify emails, find linked accounts, check breach exposure, and analyze headers.

Pro tip: Holehe is free and fast. h8mail is best for breach correlation when API keys are configured.

pip install h8mail

# Basic scan
h8mail -t "target@email.com"

# With API keys (unlocks more breach sources)
# Create config.ini with your API keys from HIBP, BreachDirectory, etc.
h8mail -t "target@email.com" -k config.ini

# Scan a list of emails
h8mail -t emails.txt

3. Phone Number OSINT

📱 Identify carriers, locations, registrations, and linked accounts from phone numbers.

Pro tip: PhoneInfoga is the gold standard CLI tool. GetContact reveals how a number is saved by others.

# Binary install (Kali Linux)
curl -sSL https://raw.githubusercontent.com/sundowndev/phoneinfoga/master/support/scripts/install | bash

# Open web UI at localhost:8080
phoneinfoga serve -p 8080

# Scan from CLI
phoneinfoga scan -n "+1234567890"

# pip install (alternative)
pip install phoneinfoga

4. Domain & IP OSINT

🌐 Enumerate subdomains, query DNS records, discover IP ranges, and map attack surfaces.

Pro tip: Run amass + subfinder together for maximum subdomain coverage, then pipe into httpx to check which hosts are live.

# Step 1: Enumerate subdomains passively (fast)
subfinder -d example.com -o subs.txt

# Step 2: Deep active enumeration (slower but more complete)
amass enum -d example.com -o amass_subs.txt

# Step 3: Combine and deduplicate
cat subs.txt amass_subs.txt | sort -u > all_subs.txt

# Step 4: Check which subdomains are live
cat all_subs.txt | httpx -status-code -title -o live_subs.txt

# Step 5: Screenshot all live hosts
cat live_subs.txt | eyewitness --web -d screenshots/

5. Geolocation & Maps OSINT

🗺️ Geolocate images, analyze satellite data, and verify photo locations.

Pro tip: Combine SunCalc (shadow analysis) + ShadowMap + Mapillary for precision image geolocation.

6. Image & Video OSINT

🖼️ Extract metadata, reverse search images, verify authenticity, and detect AI-generated content.

Pro tip: Yandex reverse image search consistently outperforms Google for finding faces and locations.

# Install
apt-get install libimage-exiftool-perl

# Basic metadata read
exiftool image.jpg

# Extract GPS coordinates specifically
exiftool -GPSLatitude -GPSLongitude image.jpg

# Strip ALL metadata (for privacy)
exiftool -all= image.jpg

# Show all metadata groups
exiftool -a -u -g1 image.jpg

# Batch process a whole folder
exiftool /path/to/images/

7. Facial Recognition & People Search

👤 Find people across the web using photos, names, or usernames.

⚠️ Warning: Facial recognition has serious privacy and legal implications. Use only with explicit authorization.

8. Social Media Monitoring

📡 Monitor, scrape, and investigate social media accounts and communities.

Pro tip: Combine Osintgram (Instagram) + Telepathy (Telegram) + snscrape (Twitter/X) for full platform coverage.

9. Data Breach & Leak Search Engines

💥 Check if credentials, emails, or phones have been exposed in data breaches.

Pro tip: HIBP is free and safe. DeHashed and LeakCheck offer the most data for paid tiers.

# Start Tor service first
sudo systemctl start tor

# Clone pwndb
git clone https://github.com/coj337/pwndb.git
cd pwndb

# Install requirements
pip install -r requirements.txt

# Search by email
python3 pwndb.py --target email@example.com

# The .onion address (open in Tor Browser)
# pwndb2am33lno4bq.onion

10. WikiLeaks, DDoSecrets & Whistleblower Platforms

📁 Archives of leaked government, corporate, and classified documents.

11. Password Cracking & Credential Tools

🔑 Tools for authorized password auditing and credential recovery on systems you own.

# Install
apt install hashcat

# Crack MD5 hash with wordlist
hashcat -m 0 hash.txt /usr/share/wordlists/rockyou.txt

# Crack SHA-256 with rules
hashcat -m 1400 hash.txt wordlist.txt -r rules/best64.rule

# Common hash types:
# -m 0    = MD5
# -m 100  = SHA-1
# -m 1400 = SHA-256
# -m 1800 = SHA-512crypt (Linux)
# -m 1000 = NTLM (Windows)
# -m 2500 = WPA/WPA2 (Wi-Fi)

12. Dark Web Search Engines & Tools

🕶️ Search .onion sites, darknet markets, and hidden services.

Requires: Tor Browser or Tor service running on port 9050.

# Install Tor
sudo apt install tor proxychains4

# Start Tor service
sudo systemctl start tor
sudo systemctl enable tor

# Test Tor is working
curl --socks5 127.0.0.1:9050 https://check.torproject.org/api/ip

# Use proxychains with any tool
proxychains4 nmap -sT target.onion
proxychains4 curl http://example.onion

# Edit /etc/proxychains4.conf if needed
# Make sure this line is present: socks5 127.0.0.1 9050

13. Anonymous & Privacy Tools

🔒 Maintain anonymity during OSINT investigations and protect your identity.

Pro tip: Use Tails OS for investigations requiring full anonymity — it leaves zero trace on disk.

14. Web Application OSINT & Scanning

🕸️ Fingerprint web technologies, discover hidden directories, and crawl for endpoints.

Pro tip: Run Whatweb first to fingerprint, then Nikto for quick vulns, then Nuclei for deep scanning.

15. Social Engineering & Phishing

🎭 Phishing simulation frameworks for authorized red team engagements.

⚠️ For authorized penetration testing and security awareness training ONLY.

git clone https://github.com/htr-tech/zphisher.git
cd zphisher
chmod +x zphisher.sh
bash zphisher.sh

# Select template from menu (Facebook, Google, Instagram, etc.)
# Tool generates a phishing URL with Cloudflare/Serveo tunnel
# Captured credentials are saved locally

16. Vulnerability Scanning & Exploitation

💣 Frameworks for finding and verifying vulnerabilities on authorized targets.

⚠️ Always have written permission before running any of these tools.

17. Network & Wireless Tools

📶 Analyze traffic, audit Wi-Fi networks, and perform MITM on authorized targets.

18. Mobile Hacking & Phone Exploitation

📲 Android/iOS security testing for authorized assessments.

19. AI-Powered OSINT & Free AI Tools

🤖 AI tools for automating research, analyzing images, and accelerating investigations.

Pro tip: Perplexity AI is excellent for OSINT research — it cites sources so you can verify everything.

AI-Powered OSINT Tools

Free AI Tools for OSINT Research

20. Financial & Corporate Intelligence

💰 Research companies, track crypto, and uncover financial relationships.

21. Vehicle, Property & Public Records

🚗 Access public records, vehicle history, property data, and court documents.

22. Metadata & Digital Forensics

🔬 Extract hidden data, recover deleted files, and analyze digital evidence.

Pro tip: CyberChef is a must-bookmark — it handles encoding, encryption, and data manipulation all in-browser.

23. IP Camera & Webcam OSINT

⚠️ WARNING: Accessing cameras without authorization is illegal everywhere. This section is for educational awareness only — to understand how exposed devices are found so you can protect them.

Shodan Searches for Exposed Cameras

Google Dorks for Camera Discovery

24. Google Dorking Bible

🔍 Advanced search operators for finding information that isn't easily discoverable.

Pro tip: Combine multiple operators for maximum precision. Always test in a private/incognito window.

Core Operators

High-Value OSINT Dorks

Dork Generator Tools

25. Credential & Data Dorking

🗄️ Advanced dorks for finding inadvertently exposed sensitive data on the web.

26. IP Tracking & Geolocation Links

📍 Tools for tracking IP addresses through crafted links.

⚠️ For authorized use only — e.g., tracking your own email campaigns or authorized phishing simulations.

💡 Trick: Mask a logger URL using the VK redirect: https://vk.com/away.php?to=YOUR_LOGGER_URL

27. Telegram OSINT Bots & Channels

💬 Telegram-based OSINT tools, bots, and intelligence communities.

OSINT Bots

OSINT Channels

Telegram Scraping Tools

28. Russian OSINT & Person Lookup Services

🇷🇺 Services widely used in Russian-speaking OSINT communities.

VK (VKontakte) OSINT

29. Social Media Searcher Platforms

30. Termux Hacking Toolkit (Complete)

📱 Full OSINT & security toolkit setup for Android via Termux.

Initial Setup

# First-time Termux setup
pkg update -y && pkg upgrade -y
pkg install python python2 git wget curl nmap
pip install requests colorama
termux-setup-storage

Tool List

pkg update -y && pkg upgrade -y && \
pkg install -y python git wget curl nmap hydra perl openssh php clang make openssl && \
pip install requests colorama sherlock-project maigret holehe h8mail && \
cd ~ && \
git clone https://github.com/htr-tech/zphisher && \
git clone https://github.com/Manisso/fsociety && \
git clone https://github.com/ultrasecurity/Storm-Breaker && \
git clone https://github.com/wishihab/userrecon && \
echo "Done! All tools installed."

31. Kali Linux OSINT Toolkit

🐉 Tools pre-installed on Kali, plus recommended additions.

Pre-installed on Kali

Quick Kali Setup (additional tools)

# From this repo's installer (recommended — installs everything)
sudo bash install.sh

# Or add specific tools manually:
sudo apt update && sudo apt install -y \
  amass subfinder httpx nuclei gobuster feroxbuster \
  spiderfoot eyewitness phoneinfoga metagoofil

pip install maigret holehe h8mail socialscan social-analyzer \
  deepface face_recognition volatility3 telepathy

32. All-in-One Hacking Frameworks

🧰 Comprehensive frameworks that bundle dozens of tools under one roof.

33. Wordlist Generation & Brute Force

📖 Build custom wordlists or use proven collections.

Pro tip: CeWL is great for targeted attacks — it generates wordlists from the target's own website.

# Use RockYou (already in Kali)
/usr/share/wordlists/rockyou.txt.gz
gunzip /usr/share/wordlists/rockyou.txt.gz

# Generate a pattern-based wordlist with Crunch
# Format: crunch <min> <max> <charset>
crunch 8 10 abcdefghijklmnopqrstuvwxyz0123456789 -o wordlist.txt

# Generate custom wordlist from a target website
cewl https://example.com -m 6 -w cewl_wordlist.txt

# Profile-based wordlist (interview the target)
python3 cupp.py -i

34. Hardware Hacking Tools

🔧 Physical devices for authorized penetration testing and hardware security research.

35. OSINT Operating Systems

🖥️ Specialized operating systems built for security research, OSINT, and privacy.

36. OSINT APIs & Developer Tools

🔌 Programmatic access to OSINT data sources for building your own tools.

37. Browser Extensions for OSINT

🧩 Must-have browser extensions for every OSINT investigator.

38. OSINT Learning Resources

📚 The best resources for learning OSINT — from beginner to professional.

📺 YouTube Channels

39. Awesome OSINT GitHub Repos

⭐ The best curated OSINT resource lists on GitHub.

40. One-Click Install Scripts

🐉 Kali Linux — Full Arsenal

# Option 1: Direct from this repo (one command)
curl -sL https://raw.githubusercontent.com/rawfilejson/awesome-osint-arsenal/main/install.sh | sudo bash

# Option 2: Clone first (recommended — inspect before running)
git clone https://github.com/rawfilejson/awesome-osint-arsenal.git
cd awesome-osint-arsenal
sudo bash install.sh

📱 Termux (Android)

pkg update -y && pkg upgrade -y
pkg install -y python git wget curl nmap hydra perl openssh php clang make openssl
pip install requests colorama sherlock-project maigret holehe h8mail
cd ~ && git clone https://github.com/htr-tech/zphisher && git clone https://github.com/Manisso/fsociety

🔧 Manual Kali Snippet

sudo apt update && sudo apt upgrade -y
sudo apt install -y git python3 python3-pip golang-go nmap wireshark \
  sqlmap hydra john hashcat aircrack-ng nikto dirb wpscan \
  theharvester maltego spiderfoot set exiftool masscan whatweb \
  gobuster feroxbuster wfuzz libimage-exiftool-perl binwalk \
  foremost bulk-extractor macchanger tor proxychains4

pip3 install sherlock-project maigret holehe h8mail socialscan \
  social-analyzer phoneinfoga snscrape instaloader deepface \
  face_recognition volatility3 blackbird-osint nexfil \
  socid-extractor osrframework telepathy twayback toutatis \
  dnstwist waybackpy trufflehog

cd /opt
sudo git clone https://github.com/Manisso/fsociety
sudo git clone https://github.com/Z4nzu/hackingtool
sudo git clone https://github.com/ultrasecurity/Storm-Breaker
sudo git clone https://github.com/htr-tech/zphisher
sudo git clone https://github.com/s0md3v/Orbit
sudo git clone https://github.com/s0md3v/Photon
sudo git clone https://github.com/danielmiessler/SecLists
sudo git clone https://github.com/lgandx/Responder
sudo git clone https://github.com/commixproject/commix
sudo git clone https://github.com/opsdisk/pagodo
sudo git clone https://github.com/RedSiege/EyeWitness

41. Top 50 Must-Have Tools (Quick Reference)

42. ⚔️ Red Team & Offensive Security

C2 frameworks, AD attacks, exploitation kits, post-exploitation. Authorized testing only.

Pro tip: Sliver and Havoc are the modern open-source Cobalt Strike alternatives — start there before paying.

43. 🛡️ Blue Team & Defensive Security

SIEM, EDR, network monitoring, detection engineering, IR.

Pro tip: Wazuh is your free Splunk replacement. Pair it with Sigma rules + Suricata for a full SOC stack on commodity hardware.

44. 🛰️ Threat Intel Platforms

CTI platforms — open-source and enterprise.

Pro tip: MISP is free and powerful. OpenCTI gives you a STIX2-native graph DB. Both run as Docker stacks.

45. 🔬 Digital Forensics & Reverse Engineering

Disk/memory forensics, malware reverse engineering, timeline tools, binary analysis.

Pro tip: Volatility 3 + Plaso (log2timeline) + KAPE = the modern DFIR triage stack. Ghidra > IDA Free for static analysis.

46. 🎓 Training, Labs & CTF

Hands-on practice — paid platforms and free local labs.

Pro tip: Free path: TryHackMe → PortSwigger Academy → HackTheBox retired boxes. Paid path: HTB Academy + OffSec PG.

47. 🎯 Bug Bounty Platforms

Where to actually earn money from your skills.

Pro tip: Start on Bugcrowd or YesWeHack public programs — easier triage and lower competition than HackerOne H1.

48. 📚 Learning Resources

Books, courses, blogs, YouTube channels, awesome lists.

Pro tip: IppSec.rocks indexes EVERY HackTheBox walkthrough — search any retired box and watch how a pro solves it.

49. ✨ Extra Tools (curated additions)

Tools added in v2.x — modern recon, archive lookups, niche services, research-grade pivots.

Pro tip: This section gets refreshed every release — check before you reach for an older tool.

50. 🇬🇪 Georgian OSINT Arsenal (500+ resources)

🇬🇪 The most comprehensive OSINT resource collection for the country of Georgia (Sakartvelo).

28 sub-sections · 500+ verified resources — government databases, public registries, investigative tools, open-data portals, Telegram bots & more.

Pro tip: Pair this with my Georgian-Wordlist (760K Georgian words for security research) and Wordlist-Generator.

[!WARNING] Educational and lawful investigative use only. Respect Georgia's Law on Personal Data Protection and the GDPR. Authors are not responsible for any misuse.

1. Go to ecd.court.ge/Decision
2. Select court instance (First Instance / Appeals / Cassation)
3. Select court name (e.g., Tbilisi City Court)
4. Select case category (Civil / Criminal / Administrative)
### 50.5 Enter case number or date range

### 50.6 Note: Personal data is anonymized in published decisions

### 50.7 For cases after April 2020 -- many are NOT published online

1. Get person's name or company ID
2. Search NAPR (napr.gov.ge) for registered properties
3. Cross-reference with ss.ge/myhome.ge for listings (may show photos, addresses)
4. Check nsdi.gov.ge for cadastral boundaries and neighbors
5. Search eauction.ge for any auctioned/seized properties
6. Check ecd.court.ge for property-related litigation

### Georgian plates follow these formats:

- Standard: AA-123-AA (two letters, three numbers, two letters)
- Government: GOV followed by numbers
- Diplomatic: D followed by numbers
- Military: GEO followed by numbers
- Regional codes vary by area

### Note: Georgian plates use Latin letters