Explore and search our hand-picked collection of open-source security research, CTI, and intelligence investigation tools.
BinaryEdge is an internet intelligence platform that continuously scans the IPv4 and IPv6 address space to provide real-time data on exposed services and vulnerabilities.
Dehashed is a breach data search engine that allows security professionals to search for compromised credentials, email addresses, usernames, and passwords across multiple data breaches.
Sherlock is a powerful social media OSINT tool that hunts for usernames across over 300 social networks and platforms.
The world's first search engine for internet-connected devices, enabling cybersecurity professionals to discover exposed systems, analyze network infrastructure, and assess global attack surfaces.
OWASP open-source subdomain enumeration and network mapping tool using passive and active techniques to discover attack surfaces.
CRT.sh is a certificate transparency log search engine that provides comprehensive visibility into SSL/TLS certificates issued for domains worldwide.
IPinfo is a comprehensive IP address intelligence platform that provides geolocation, ASN, carrier, and threat data for any IP address.
Azul is an open-source malware analysis platform released by the Australian Signals Directorate in 2026 that scales to handle tens of millions of malware samples.
Industry-leading threat intelligence platform that analyzes files, URLs, and IP addresses using 70+ antivirus engines and threat detection systems.
Fast, passive subdomain discovery tool written in Go that uses certificate transparency logs, search engines, and DNS data sources.
Recon-ng is a full-featured reconnaissance framework written in Python, designed for OSINT gathering with a modular architecture and interactive command-line interface.
ZoomEye is a leading Chinese cyberspace search engine developed by Knownsec's 404 Lab that provides comprehensive internet asset discovery and network mapping.
Industry-leading graphical link analysis and data visualization tool for OSINT investigations, enabling analysts to uncover hidden relationships between entities like domains, IP addresses, people, and organizations through an intuitive visual interface.
Open-source intelligence automation platform that integrates with over 200 data sources to perform comprehensive reconnaissance, threat intelligence gathering, and attack surface mapping for cybersecurity professionals and investigators.
Comprehensive internet-wide scanning platform providing visibility into hosts, networks, and certificates, enabling security teams to discover and analyze global attack surfaces.
Wappalyzer is a technology fingerprinting tool that identifies content management systems, frameworks, and libraries used by websites through browser extension and API.
Bitsight is a leading enterprise cyber threat intelligence platform that monitors over 40 million organizations globally with AI-enriched OSINT and dark web monitoring.
OSINT Framework is a comprehensive curated directory of open-source intelligence tools organized by intelligence category and purpose.
GreyNoise is a cybersecurity platform that analyzes and categorizes internet-wide scanning activity to help security professionals distinguish between random scans and targeted threats.
ThreatConnect is a comprehensive threat intelligence platform acquired by Dataminr in 2025, offering TI Ops, Risk Quantifier, and Polarity capabilities.
BuiltWith is a comprehensive technology profiler that identifies websites' technology stack, including frameworks, CMS, analytics, and hosting providers.
AlienVault OTX (Open Threat Exchange) is a community-powered threat intelligence platform that enables sharing and collaboration on global security threats.
Modat is a European internet intelligence platform that provides unique Device DNA and internet scanning intelligence with a focus on cybersecurity and asset discovery.
SecurityTrails is a comprehensive domain and DNS intelligence platform that provides historical DNS data, subdomain discovery, and passive DNS reconnaissance capabilities.
Quake is a Chinese network asset discovery engine developed by 360 that provides comprehensive scanning and intelligence on internet-connected infrastructure.
Global Eagle is a Chinese cyberspace mapping platform developed by Qi'anxin that provides comprehensive internet asset discovery and intelligence.
Exploit-DB is a comprehensive database of exploits, vulnerabilities, and proof-of-concept code maintained by Offensive Security.
Command-line OSINT tool for gathering emails, subdomains, and employee names from public sources including search engines, PGP key servers, and social media platforms.
Vulners is a comprehensive vulnerability database that aggregates security advisories, CVEs, exploits, and vulnerability intelligence from multiple sources.
Popular service for checking if email addresses or passwords have been exposed in data breaches, providing essential security intelligence.
MISP (Malware Information Sharing Platform) is an open-source threat intelligence platform designed for sharing, storing, and correlating indicators of compromise and threat data.
SOCRadar Free Tools is a comprehensive OSINT platform offering free threat intelligence tools for SOC analysts and security professionals.
URLScan.io is a free website scanner and threat analysis platform that captures screenshots, DOM snapshots, and HTTP details of any URL.
Webamon is a London-based threat intelligence platform that scans, monitors, and indexes the web daily, positioning itself as The Google of Threat Intelligence.
Hunter.io is an email discovery and verification platform that helps find, verify, and connect with professional email addresses associated with domains.
Free, community-driven platform for sharing Indicators of Compromise (IOCs) related to malware infrastructure, enabling threat intelligence enrichment.
FOFA is a leading Chinese cyberspace search engine that indexes internet-connected devices with over 350,000 fingerprint rules and 4 billion assets.
Hybrid Analysis is a powerful malware analysis platform that provides dynamic and static analysis of suspicious files and URLs with comprehensive threat intelligence.
CyberChef is the Cyber Swiss Army Knife - a powerful web-based tool for data transformation, encoding, encryption, and analysis developed by GCHQ.