OSINT-Resources

A list of resources for OSINT, in particular searching attributes related to people.

APIs for automation

https://numverify.com/ https://numverify.com https://www.plivo.com/lookup/ https://github.com/kovinevmv/getcontact Phone lookup

https://mailboxlayer.com/ https://emailcrawlr.com/ https://www.voilanorbert.com/api/ Email lookup

https://haveibeenpwned.com/API/v2 https://psbdmp.ws/api https://psbdmp.ws/api https://breachdirectory.com/api?lang=en https://leak-lookup.com/api https://rapidapi.com/rohan-patra/api/breachdirectory/pricing Pastebin / Leaks (Using this algorithm to anonymise password lookups https://en.wikipedia.org/wiki/K-anonymity)

https://search4faces.com/api.html Face search

https://developers.google.com/custom-search/v1/overview https://serpapi.com https://www.microsoft.com/en-us/bing/apis/bing-web-search-api https://products.wolframalpha.com/api/pricing/ https://duckduckgo.com/api Search engines

https://darksearch.io/apidoc https://www.darkowl.com/vision-api Dark web

https://www.scraperapi.com/ scraping API

Email <-> phone

https://github.com/martinvigo/email2phonenumber This looks pretty epic. Shame it's only US numbers.

https://github.com/lorien/awesome-osint List of URLs and info on what info password resetting provides

https://github.com/sharsil/mailcat Find existing email addresses by nickname using API/SMTP checking methods

Online monitoring

https://github.com/jordan-wright/dumpmon

https://raidersec.blogspot.com/2013/03/introducing-dumpmon-twitter-bot-that.html

https://github.com/andrew-vii/hookshot

Google Alerting

https://raidersec.blogspot.com/2013/01/google-as-ids-using-google-alerts-to.html

https://www.google.co.uk/alerts

Doxing tutorials, tools and frameworks

https://haxf4rall.com/2019/05/19/doxing-tools/

https://github.com/brut0s/DFW

https://pythonrepo.com/repo/Cryptonian007-Garuda

https://github.com/davidtavarez/pwndb/ leaked credentials using the Onion service script

https://raidforums.com/Forum-Doxing-Tutorials

https://slate.com/technology/2020/02/how-and-why-dox-yourself.html - this is really good

Data Broker Opt-Out

https://github.com/yaelwrites/Big-Ass-Data-Broker-Opt-Out-List

https://joindeleteme.com/ service

Account Deletion & Password Changing

https://www.deleteme.com/

https://backgroundchecks.org/justdeleteme/ or https://justdeleteme.xyz/

https://backgroundchecks.org/

Account Enumeration

https://grep.app/search Search across a half million git repos

https://whatsmyname.app/

https://github.com/WebBreacher/WhatsMyName/

https://github.com/megadose/holehe - uses forgotten password function to enumerate emails

https://github.com/megadose/ignorant - ** but with phone

https://tools.epieos.com/email.php Finds websites an email is signed up to

https://github.com/mxrch/GHunt investigate Google accounts, or objects.

https://github.com/megadose/holeheEfficiently finding registered accounts from emails.

https://github.com/blackeko/yesitsme Simple OSINT script to find Instagram profiles by name and e-mail/phone

Databases

http://pwndb2am4tzkvold.onion/ PWNDB (ONION)

https://scamsearch.io/ Gobal scam database. Search by picture, email, username, pseudo name, number or crypto address.

Wayback machine

https://web.archive.org/

Other OSINT resources

https://osintframework.com/ OSINT framework. Good framework but some outdated tools / sites

https://start.me/p/rxRbpo/ti

https://awesomeopensource.com/projects/osint

https://github.com/soxoj/socid-extractor parse key info from social media accounts

https://github.com/OhShINT/ohshint.gitbook.io Loads of great OSINT resources