Views · 7 daysTop 5%
OSINT & Reconnaissance
Open-source intelligence tools for investigating usernames, domains, organizations and public records.
9 results in OSINT & Reconnaissance
Active Pro listings from this category appear first. Your sort applies within Pro and Free results.
5 views9,859 stars
God's Eye ViewOSINT & ReconnaissanceGod's Eye View combines public aircraft, satellite, earthquake and camera feeds in a Cesium globe. Run it locally, inspect each data source, add optional voice control and connect agents through MCP.Open sourceSelf-hostedViews · 7 daysTop 1%
Views · 7 daysTop 10%
Views · 7 daysTop 10%
Views · 7 daysTop 7%
Views · 7 daysNo views in 7 days
theHarvesterOSINT & ReconnaissancetheHarvester gathers public intelligence about domains and organizations through a command line, local browser interface and REST API for authorized security assessments.Open sourceSelf-hostedViews · 7 daysNo views in 7 days
VoidAccessOSINT & ReconnaissanceVoidAccess is an MIT-licensed threat intelligence tool that searches Tor search engines, code hosts and security feeds, extracts actors, wallets, CVEs and IOCs into a graph and exports STIX, MISP or Sigma. It runs as a CLI, a Docker stack or a hosted service.Open sourceSelf-hostedFreemiumViews · 7 daysNo views in 7 days
Views · 7 daysTop 4%
Shortlists for OSINT & Reconnaissance
Explore collections with tools relevant to this category, grouped by deployment, source model or workload.
Self-hosted IT tools →
9 matching tools from this category
Open-source IT tools →
8 matching tools from this category
IT tools with an API →
4 matching tools from this category
How to choose osint & reconnaissance tools
OSINT and reconnaissance tools gather and correlate information that is already public: usernames across social networks, email footprints, domains, subdomains, IP addresses, messaging channels and live geospatial feeds. Investigators, red teams and defenders use them to map an organization's exposure or trace a person's online presence. They differ from vulnerability scanners, which probe systems for weaknesses, because OSINT collection mostly reads public sources rather than testing targets.
Who uses these tools
- Threat intelligence analysts mapping attacker infrastructure
- Red teamers profiling a target organization's footprint
- Journalists and researchers verifying online identities
Capabilities to compare
- Username and email lookups across many sites
- Domain, subdomain and certificate enumeration
- Modular data sources with API key support
- Correlation graphs and exportable reports
- Evidence capture with timestamps and edit history
Operating considerations
- Legal basis and privacy rules for personal data
- API keys and rate limits for data sources
- False positives from shared or reused usernames
- Operational security of the investigator's own traffic
- Secure storage of collected case data
Selection checklist
- Define the investigation scope and legal basis in writing before collecting any personal data.
- Check which data sources each tool queries and which require paid API keys for useful results.
- Test accuracy on known accounts or your own domains to gauge false positive rates.
- Prefer tools that record sources and timestamps, so findings can be verified and reported later.
What belongs in this category: Tools belong here when they collect, enrich or visualize publicly available data about people, organizations or infrastructure, rather than exploiting vulnerabilities, monitoring internal logs or scanning owned assets.
OSINT & Reconnaissance on iThub in figures
iThub lists 9 tools in OSINT & Reconnaissance. 8 of 9 are open source, 9 of 9 can be self-hosted, 8 of 9 have a free, freemium or open-source pricing model and 4 of 9 offer an API.
- Tools listed
- 9
- Open source
- 8
- Self-hostable
- 9
- Free to start
- 8
- With an API
- 4
- Web app
- 5
- Desktop app
- 6
Recently added: VoidAccess, TgWitness, theHarvester, sn0int
Typical use cases
- Mapping an organization's public attack surface before a pentest
- Checking which sites expose an employee's reused username
- Preserving messaging channel content for an investigation
- Monitoring public sources for leaked company domains
Trade-offs to model
- Single-purpose command-line tools are fast and scriptable, while automation frameworks correlate many sources but need more setup and keys.
- Running tools locally keeps case data private, whereas hosted platforms add convenience but place sensitive findings with a third party.
Common mistakes
- Treating a username match on several sites as proof of identity without corroborating evidence.
- Running reconnaissance from a corporate network address and revealing the investigation to its subject.
Browse SIEM and threat intelligence tools →Browse vulnerability management tools →See open source security tools →
Decision resources
Continue the technical evaluation
Use the resources that match your decision stage. Profile data and linked sources were refreshed through November 10, 2026.
0 tools selectedCompare selected