What is sn0int?
sn0int is an open-source OSINT framework and package manager for security professionals, bug bounty hunters, law enforcement investigators and security awareness trainers. It processes public information semi-automatically and maps findings into a unified format for follow-up investigations of organizations or individuals.
Its investigation capabilities are supplied by modules executed in a sandbox rather than hardcoded into the framework. Modules can discover subdomains, resolve infrastructure, enrich IP addresses, identify exposed accounts and collect public profile information. Users can write their own modules and publish them to the sn0int registry independently of the core project.
The project provides local installation instructions for Linux and macOS, alongside a Docker deployment option. It is distributed under the GPLv3+ license. Investigations require selecting modules, defining scope and interpreting the resulting information.
The README says sn0int is inspired by recon-ng and maltego but remains more flexible. Packages are listed for Arch Linux (pacman), macOS (Homebrew), Alpine (apk), OpenBSD (pkg_add) and NixOS, alongside prebuilt Debian, Ubuntu and Kali packages and a Docker image.
Key capabilities
- Infrastructure discovery Harvests subdomains from certificate transparency logs and passive DNS, resolves them and scans for HTTP or HTTPS services.
- IP enrichment Adds autonomous system and geolocation information to IP addresses.
- Account research Collects email addresses from PGP keyservers and WHOIS, discovers compromised logins and finds public profiles.
- Personal exposure research Gathers phone number information, social media activity and images, with basic image processing.
- Structured investigations Maps collected information into a unified format for subsequent investigation steps.
- Module management Runs investigation modules in a sandbox and supports publishing custom modules through its registry.
Where sn0int fits
sn0int fits into reconnaissance for red team assessments and bug bounty work, where investigators need to understand an organization's externally discoverable attack surface. It also supports personal exposure reviews and security awareness training by showing what information about an individual is publicly accessible.
Before deployment, teams should verify the installation requirements for their environment, the behavior and requirements of their selected modules, and the authorized investigation scope. Personal information collection and active service scanning should be reviewed against the engagement's permissions and boundaries.
Install
brew install sn0intReviews of sn0int
Be the first to share your experience with sn0int.
Write a review
Loading review form…
Alternatives to sn0int
God's Eye ViewGod's Eye View combines public aircraft, satellite, earthquake and camera feeds in a Cesium globe. Run it locally, inspect each data source, add optional voice control and connect agents through MCP.SSherlockSherlock searches social networks for accounts matching supplied usernames. It runs from the command line, supports local installation or Docker, and exports findings for further review.