OSINT

Recon-ng

Modular recon framework with workspace DB and API-backed modules.

intermediate

Linux

Reconnaissance

Authorized testing only. Practice on systems you own, isolated labs, or targets with written permission. Unauthorized access is illegal.

Structured multi-module OSINT campaigns you want stored and queryable.

Create workspace, add domains, run marketplace modules, query database.

Repeatable recon pipelines with auditability.

Commands & usage

recon-ng

workspaces create acme

db insert domains example.com

marketplace search whois

modules load recon/domains-hosts/hackertarget

run

Commands are educational examples. Adapt hosts, paths, and rates to your authorized scope.

Maltego

Graph-based link analysis for people, domains, infrastructure, and relationships.

theHarvester

Gathers emails, subdomains, hosts, and employee names from public sources.

SpiderFoot

Automated OSINT scanner with web UI covering 200+ data sources.

Sherlock

Hunt usernames across hundreds of social sites.

Maigret

Username OSINT tool with report generation across many sites.

holehe

Checks if an email is registered on various sites.