Projects sharing features with Mr.Holmes

Snoop is an open-source intelligence framework designed for username scanning, digital footprint analysis, and geospatial intelligence gathering. It functions as a modular scanner that identifies profiles associated with specific usernames and nicknames across thousands of public websites to map a target's online presence. The system features a plugin-based extension architecture that allows for the addition of new platform scrapers and data sources. It provides specialized capabilities for evidence archiving, such as capturing HTML snapshots of discovered profiles and resolving numeric coord

Th3inspector is a command-line open-source intelligence reconnaissance tool used for gathering public information on websites, phone numbers, and network records. It functions as a central interface for collecting technical metadata and performing various lookups to build profiles of target entities. The project provides specialized verification utilities for validating email addresses, phone numbers, and credit card bank identification numbers. It also includes tools for retrieving domain registration age, ownership records, and identified subdomains from global databases. Additional capabi

Twint is an open-source intelligence and data extraction framework designed to gather public social media information. It functions as a command-line utility that retrieves posts, user profiles, and follower lists directly from web interfaces, bypassing the need for official platform developer credentials or authentication keys. The tool distinguishes itself by enabling automated, large-scale data collection through terminal-based orchestration. It supports granular filtering by keywords, geographic locations, time ranges, and account status, allowing researchers to build targeted datasets fo

reconftw is an attack surface management framework and reconnaissance workflow orchestrator designed to automate the discovery, mapping, and monitoring of external digital assets. It operates as a modular tool-chain pipeline that coordinates a sequence of security tools to perform intelligence gathering and vulnerability scanning. The project distinguishes itself through a cloud-native deployment model that parallelizes scanning workloads across a fleet of remote VPS instances to bypass local resource constraints. It utilizes container-based environment isolation to ensure consistent executio

Maskphish is a comprehensive security toolkit that integrates capabilities for digital forensics, network vulnerability scanning, open-source intelligence, penetration testing, and social engineering. It functions as a multi-purpose framework for automating reconnaissance and executing security audits across diverse network environments. The project features a specialized phishing and social engineering toolkit used for cloning websites, masking URLs, and deploying deceptive pages to capture user credentials. It also includes a remote access Trojan builder for generating platform-specific exe

Toutatis is an open-source intelligence tool designed to extract public account information, emails, and phone numbers from Instagram profiles. It functions as a command-line utility for gathering user details and contact information for research purposes. The tool provides capabilities for public identity verification and account intelligence by translating usernames into internal unique identifiers to retrieve associated profile data. The system handles data extraction through a command line interface, utilizing request simulation and session-based API interactions to parse structured data

Mosint is an email OSINT framework and intelligence tool designed to gather data and identify digital footprints associated with email addresses. It functions as a suite of automated utilities for email validation, breach scanning, and social account discovery. The tool maps digital identities by linking email addresses to social media profiles and identifying related identities to expand the scope of investigations. It includes a breach scanner that checks email addresses against known database leaks and password dumps to detect compromised accounts. The framework also covers network intell

Flowsint is an open-source intelligence framework and reconnaissance orchestrator used for cybersecurity investigations. It functions as a containerized tool runner and data mapper, automating the collection of intelligence from open-source providers and APIs to profile targets and map threat intelligence. The platform distinguishes itself through a graph-based investigation interface, where processed raw intelligence is converted into nodes and edges to visualize relationships between entities. It allows for the creation of sequenced pipelines that chain data enrichment tools, enabling the o

Osintgram is a command-line utility designed for open-source intelligence gathering and the extraction of public data from social media profiles. It functions as a framework for collecting and processing user information to assist in digital investigations and the mapping of digital footprints. The tool distinguishes itself through a modular architecture that organizes intelligence-gathering tasks into independent scripts, all sharing a unified session state and data processing pipeline. It utilizes headless browser automation and session-based interactions to mimic legitimate user behavior,

MyIP is a network diagnostics toolbox designed for analyzing public IP addresses, geolocation, and network connectivity performance. It provides utilities for identifying IPv4 and IPv6 addresses and analyzing their associated organization, ASN, and geographic details. The project features specialized privacy and security tools, including a network leak tester to detect DNS and WebRTC leaks used to verify VPN or proxy configurations. It also includes a browser fingerprint analyzer that generates unique client identifiers to audit how device attributes are used for online tracking. The platfor

ip2region is an offline IP geolocation library and framework designed to resolve IPv4 and IPv6 addresses to city-level regional information using local binary data files. It functions as a binary IP database compiler and a cross-language search client, allowing for regional lookups without relying on external APIs. The project distinguishes itself through a specialized binary format that supports high-performance query optimization. It employs adjacent-segment IP merging and deduplicated region storage to minimize the database footprint, while utilizing memory-mapped file caching and vector-i

Social Mapper is an open-source intelligence framework designed to gather and structure digital footprints from social media networks. It functions as a platform for correlating online identities across multiple platforms, enabling the construction of a unified digital profile for a specific subject. The tool distinguishes itself by integrating automated facial recognition to verify identities, comparing target photographs against profile pictures found during the search process. This capability allows for the filtering of search results to improve the accuracy of identity correlation before

Maigret is an open-source intelligence framework designed for automated digital footprint discovery and identity investigation. It functions as a search engine that aggregates profile metadata by querying thousands of websites for specific usernames, mapping an individual's online presence across diverse platforms. The tool distinguishes itself through recursive discovery capabilities, which identify links within discovered profiles to expand the scope of an investigation automatically. It supports cross-platform identity correlation by mapping disparate accounts and pseudonymous personas, in

Geocoder is a PHP library for converting addresses to geographic coordinates and coordinates back into addresses using various third-party services. It functions as a multi-provider geocoding wrapper and a reverse geocoding engine, providing an abstraction layer to manage multiple geocoding APIs. The project allows for switching between providers or chaining requests for failover to ensure high availability. It also serves as a GeoIP location resolver, translating IP addresses into geographic coordinates and location details through either remote services or local binary databases. The libra

AllHackingTools is a security tool orchestrator and suite designed to install, update, and manage a wide array of third-party hacking and security utilities from a single command interface. It functions as a centralized hub for network analysis, open source intelligence, penetration testing, and social engineering tools. The project provides specialized frameworks for gathering open source intelligence and searching for user profiles across social platforms. It includes toolkits for network reconnaissance, vulnerability scanning, and the execution of security exploits, as well as a social eng

Blackbird is an open-source OSINT investigation tool that searches across hundreds of online platforms to discover accounts linked to a given username or email address. It functions as a username and email search engine, consolidating discovered profiles into a single list with low false positives for investigative analysis. The tool incorporates an AI-enhanced profile analyzer that uses a built-in AI API to generate behavioral and technical summaries of discovered online profiles. It also provides a documentation query interface that accepts natural-language questions via HTTP GET requests t

Trippy is a network diagnostic tool and terminal user interface that combines ping and traceroute functionality to analyze network paths and performance. It provides a network packet parser and path analyzer to detect packet loss, jitter, and multipath routing through continuous network probing. The project is distinguished by its support for specialized tracing strategies, including Paris and Dublin, to ensure consistent path discovery. It identifies network address translation devices and utilizes heuristic analysis to distinguish genuine packet loss from rate-limiting. Broad capability ar

GHunt is a Google account investigator and open-source intelligence framework designed to retrieve publicly available information and metadata associated with Google accounts. It functions as an OSINT data extractor and offensive security framework used to identify user identities and uncover hidden metadata. The tool extracts public profile data from various Google services and exports the findings into structured JSON formats. This allows for the collection and analysis of digital footprints to support security research and reconnaissance.

This project is a comprehensive, community-curated directory of resources and methodologies for open-source intelligence gathering. It serves as a centralized reference framework for researchers, providing a structured index of specialized tools, databases, and search techniques used to collect and analyze publicly available information from across the global internet. The directory distinguishes itself through a hierarchical taxonomy that organizes complex investigative domains, ranging from cyber threat intelligence and digital forensic investigation to geospatial analysis and operational s

DefaultCreds-cheat-sheet is a searchable reference database of default usernames and passwords for thousands of hardware and software products, designed for use during security assessments. It functions as a curated directory that maps vendor products to their known factory-set login credentials, enabling rapid lookup during penetration testing and security preparation workflows. The tool is delivered as a single-file client application with no backend dependencies, serving static content from any web server or local file system for offline use. It stores credential mappings in a flat JSON da

OSINT-SPY is an open-source reconnaissance framework designed for gathering intelligence on digital infrastructure and tracking financial activity across distributed ledgers. It functions as a centralized orchestrator that queries multiple third-party services and public databases to aggregate security data points into a unified format. The system utilizes a modular, plugin-based architecture that allows for independent data gathering tasks, ranging from domain and IP address reconnaissance to the analysis of remote files for malicious signatures. It supports specialized investigations into c

recon-ng is an open source intelligence reconnaissance framework designed to automate the collection and aggregation of public information. It is a modular intelligence tool that utilizes a system of pluggable modules to harvest target data, resolve DNS queries, and parse web content. The framework is built as an API-driven tool with a programmatic interface to integrate with other security workflows. It is provided as a containerized application, using Docker to ensure a consistent environment for running reconnaissance tasks and managing a persistent data store. Its capabilities cover exte

Crucix is an open-source intelligence system comprising an OSINT aggregator, a geospatial intelligence dashboard, and an LLM intelligence agent. It functions as a real-time signal monitor and automated alerting system designed to collect, analyze, and visualize geopolitical, economic, and satellite data from diverse open-source intelligence sources. The system utilizes large language models to synthesize intelligence feeds, generate actionable trade ideas, and classify signal priority with confidence scores. It features a geospatial visualization interface that plots intelligence events, such

SpiderFoot is an open-source reconnaissance and intelligence automation framework designed to streamline the collection and correlation of data for security investigations. It functions as a comprehensive platform that automates the querying of hundreds of public data sources to map digital footprints, identify exposed assets, and uncover potential security threats across an organization's external perimeter. The platform distinguishes itself through a modular, plugin-based architecture that executes data gathering tasks in parallel, supported by a directed graph data model that tracks relati

Instaloader is a Python library and command-line utility designed for the automated retrieval, archiving, and analysis of Instagram content. It provides a programmatic interface to fetch media, captions, and metadata from public or private profiles, hashtags, and stories, while maintaining persistent user sessions for authorized access. The tool distinguishes itself through robust archive management and traffic control mechanisms. It supports incremental synchronization, allowing users to resume interrupted downloads and update local collections without redundant requests. To ensure reliable