Offensive-OSINT-Tools

This repository consists of tools/links that a expert can use during Pentest/RedTeam. At the moment there are a huge number of awesome lists that contain a ton of tools, but the Offensive specialist most often doesn't need them, which is what motivated the creation of this list. These tools cover almost all the needs of the Offensive specialist and will help you get the job done well.

If the tool performs multiple functions, for example collecting subdomains and URLs, it will be listed in two places.

📖 Table of Contents

↑ Contributing

Welcome! If you find that any of your favourite offensive tools is not on the list, you can suggest adding it.


↑ Search Engines

Search Engines for Investigation Domains/IP Addresses.

↑ Emails collector

Tools that help you collect email addresses. Usually the search requires the domain of the company.

↑ References in the code

Tools for finding mentions in code. Useful to search for company/company mentions to find passwords/secrets/confidential information.

↑ SubDomain collector

Tools for automatic search of subdomains. Most of them require API keys to work correctly.

Tools

Only sites/tools whose search is not automated by the tools above are listed here.

Tools for passive collection and analysis URLs

↑ Dark web

An undiscovered area, the author is too dumb for that. Will gradually expand.

↑ Intelligence

Threat Intelligence tools containing extensive company information, subdomains, DNS information, URLs and much more.

↑ Network Info

IP/Domain network analysis tools.

↑ DnsHistory

Tools for viewing the DNS history of a domain.

↑ FTP servers

Tools allowing you to search for and download files located on public FTP servers.

↑ Passive Infrastructure scanner

Tools for automated passive IP address/subnet scanning.

↑ Microsoft Excange

Tools to help with passive/semi-passive analysis of Microsoft Excgange.

↑ Telegram

Tools for investigating Telegram chats.

↑ Google Dorks

Tools for Google Dorks.

↑ Nickname search

Nickname search tools.

↑ Phone number

Sometimes situations happen that require analysing an employee's phone number to get more information.

  • 3Wifi - free base of access points

↑ Cloud

Tools for searching, gathering information from cloud.

↑ Information gathering tools

↑ Usefull links

Links to guide, methodologies and any information that would be useful.

Todo

  • Add mobile number analysis tools (put into a category)
  • Make a mindmap

Warning

Some of the sites included might require registration or offer more data for $$$, but you should be able to get at least a portion of the available information for no cost.


Inspired by https://github.com/jivoi/awesome-osint