OSINT Tools Guide

Your comprehensive resource for free Open Source Intelligence tools and techniques

40+ Free Tools

Professional Grade

Open Source Intelligence

Explore powerful, no-cost resources for cybersecurity reconnaissance, social media intelligence, geospatial analysis, and corporate due diligence. Perfect for investigators, analysts, journalists, and researchers.

Explore Tool Categories

Discover specialized OSINT tools organized by their primary investigative function

Asset Discovery & Identification

Tools for mapping digital infrastructure, identifying exposed services, and assessing security posture from an external perspective.

10 tools

Due Diligence Tools

Resources for investigating individuals and organizations, crucial for background checks, corporate investigation, and fraud detection.

6 tools

Geo-Intelligence (GEOINT)

Geospatial tools that leverage geographic and satellite data to provide location-based intelligence and environmental analysis.

5 tools

Social Media Intelligence (SOCMINT)

Tools for gathering and analyzing data from social media platforms to understand public sentiment, investigate individuals, and track online conversations.

7 tools

Featured Tools

Essential OSINT tools with comprehensive guides and proven effectiveness

Shodan

Search engine for connected devices that scans the internet and indexes metadata from servers, webcams, routers, and IoT devices.

Key Features:

Internet-wide device scanning
Banner grabbing and metadata collection
Advanced search filters (port, country, OS)

Beginner

Guide

Nmap

A powerful utility for network discovery and security auditing that identifies active hosts, open ports, and running services.

Key Features:

Network discovery and host detection
Port scanning (TCP/UDP)
Service and version detection

Intermediate

Guide

OWASP Amass

In-depth attack surface mapping and asset discovery tool with extensive subdomain enumeration capabilities.

Key Features:

Extensive subdomain enumeration
Passive and active reconnaissance
Integration with 55+ data sources

Advanced

Guide

theHarvester

Classic passive reconnaissance tool for gathering emails, subdomains, and employee names from public sources.

Key Features:

Email harvesting
Subdomain discovery
Employee name collection

Beginner

Recon-ng

Modular web reconnaissance framework with powerful command-line interface for gathering web data.

Key Features:

Modular architecture
Database integration
Multiple data sources

Advanced

Maltego Community Edition

Powerful link analysis tool that visualizes connections between people, companies, domains, and documents.

Key Features:

Visual link analysis
Entity relationship mapping
Transform-based data gathering

Intermediate

Guide