A curated awesome-style index of more than a thousand online services and techniques for open-source intelligence gathering, aimed at investigators working authorized engagements.
| Tool | cipher387/osint_stuff_tool_collection — curated directory of 1000+ online OSINT services and techniques |
| Category | OSINT resource directory / awesome list |
| Primary Use | Finding the right online lookup service for geolocation, social media, domain/IP, email, image, and archival investigations |
| Safe Use | Intended for authorized investigations, security assessments, journalism, and defensive research on data that is already public |
| Telemetry Note | The repository itself is a passive reading list; the linked third-party services each generate their own logs, so investigators should assume queries against external sites are observable by those providers |
cipher387/osint_stuff_tool_collection, presented in the README as "Cyber Detective's OSINT tools collection", is not a single executable but a long-running curated index of online services for open-source intelligence work. The maintainer, who publishes as @cyb_detective, states that the collection aggregates links originally shared via tweets and has grown past one thousand services. With roughly nine thousand stars on GitHub and topics including osint, geoint, socmint, and humint, it functions as one of the de facto reference catalogs for practitioners who need to pick the right public-data lookup service quickly during authorized investigations.
Structurally, the repository is an awesome-style document rather than a codebase. The README opens with orientation notes and a category table, then moves into a deep table of contents and per-section link tables pairing each service with a one-line description. There is no install step, no dependencies, and no license declared at the repository level; the value is entirely editorial. That makes it closest in spirit to other awesome-list projects, except that the curation is unusually granular — categories cascade into subcategories, such as Maps, Geolocation and Transport branching into Aviation, Maritime, Railway, Street View, and Satellite/aerial imagery.
The geographic section illustrates the collection's depth. Under Social media and photos, entries like app.skylens.io aggregate geotagged posts from five social networks onto a single map, BirdHunt returns recent tweets within a chosen radius, and YouTube Geofind plots geotagged video. Historical context is covered by Pastvu.com for archival photos of locations and COPERNIX for geolocated Wikipedia articles. For investigators doing timeline or location verification in an authorized case, this clustering of map-based lookups in one place saves the scattered searching that otherwise dominates geolocation work.
The Social Media section is the longest in the table of contents, enumerating per-platform subsections that span mainstream and niche services alike: Twitter, YouTube, TikTok, Facebook, LinkedIn, Reddit, Instagram, and GitHub sit alongside Parler, 4chan, Usenet, Mastodon, Steam, Minecraft, VK, and even Office365 and OneDrive. A Universal subsection and a Downloaders subsection round it out. This breadth signals the maintainer's editorial thesis: identity traces are scattered across every platform with a public API or web surface, and an investigator's effectiveness depends on knowing where to look rather than on any single tool.
For infrastructure-oriented work, the Domain/IP/Links section is the most operationally dense part of the list. It covers Dorks/Pentest/Vulnerabilities resources, Searchers, scrapers, extractors, parsers, Wordlists generators, Redirect lookup, Cookies analyze, Favicon search, Subdomains scan/brute, Website technology look up, and URL unshorteners. From a defensive standpoint, this section doubles as a map of the recon surface an adversary may walk before an engagement: reviewing categories like Public buckets search tools or Open directories search engines is a useful exercise for teams auditing their own external exposure.
Media analysis gets similarly thorough treatment. Image Search and Identification splits into Reverse Image Search Engines and automation tools, Image editing tools, Face recognition and search, Exif Analyze and editing, and Font Indenfication — the last being a nice example of the collection's willingness to include niche, single-purpose services. Adjacent sections cover Sound search and analyze, Video editing and analyze, and Text Analyze, which supports verification workflows where a piece of media must be authenticated, sourced, or traced to its origin using only public material.
Identity pivoting is covered through the Nicknames, Emails, Phone numbers, IDs, and Universal Contact Search and Leaks Search sections, which are the classic axis points of OSINT investigations — a single username, address, or number expanded across services to map a subject's footprint. A Passwords section and a Sock Puppets section also exist, the latter being standard tradecraft vocabulary for research accounts. In an authorized context these support breach-exposure assessments for clients; used carelessly against third parties, they would raise obvious legal and ethical issues, which is why the professional framing matters.
The README also carries a notable endorsement of automation. It directs readers to Consensus, a command-line tool from the OSINT-Experts-Society organization that bundles over 7,900 lookup modules drawn from 19 open-source projects, as a fast starting point when gathering information from a username, email address or phone number. It further recommends the Netlas Cookbook under the argument that "OSINT's main strength is in automation." Both references are worth following: they mark the natural progression from browsing a static list to scripted, repeatable collection pipelines.
Honesty about decay is one of the list's more distinctive qualities. The maintainer notes the repository has been maintained since the summer of 2021 and that many tools have become obsolete, unsupported, or dead — but they are deliberately not removed, so that investigators can use their names and descriptions to hunt for modern analogues. This is a pragmatic editorial decision, though it means every link must be treated as unverified: expect a meaningful fraction of the catalog to 404 or have changed behavior since annotation.
Operationally, the safest way to consume this resource is as a reference during scoping: pick a category matching an authorized investigative question, review the linked services, and record which ones were consulted. Because every entry is a third-party web service, queries leave logs with those providers and may be subject to their terms of service, so investigators handling sensitive matters should evaluate each service's data handling before submitting lookups. Nothing in the repository itself executes code, which keeps the trust boundary comparatively simple for a security-adjacent resource.
For defenders, the collection doubles as a red-team map of public visibility. Sections like Archives, Datasets, Public buckets search tools, Browser analyze, and Website's files metadata analyze and files downloads describe exactly the classes of public exposure that leakage reviews and external attack-surface assessments try to enumerate. Reading the list from the blue-team side — asking "which of these services return data about my organization" — is a legitimate and productive exercise.
In sum, osint_stuff_tool_collection earns its popularity through breadth, longevity, and editorial candor rather than technical novelty. It is not a framework and will not replace dedicated tooling, but as a discovery layer between "I have a username" or "I have a domain" and "I know which services can answer this," it remains one of the stronger public catalogs in the OSINT space, provided its entries are treated as leads to verify rather than guarantees.
cipher387/osint_stuff_tool_collection.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.