OSINT toolkit

ExploitDB is a curated archive of exploit code and vulnerability data designed for penetration testing and security research. It serves as an offensive security knowledge base and a repository of publicly available proof-of-concept code used to validate software flaws. The project provides a searchable collection of historical and current exploit vectors. It supports security threat intelligence by tracking public releases and aids in vulnerability research by providing a reference library for analyzing how specific systems can be compromised. The archive is managed through a curated input p

This project is a curated collection of frameworks, libraries, and toolsets designed for social engineering and public data gathering. It aggregates specialized software and educational materials used to perform human-centric attacks during professional security engagements. The directory provides resources for gathering and visualizing open source intelligence to identify sensitive information leaks. It also includes a collection of methods and software for executing phishing campaigns to harvest credentials and session cookies. The repository further covers educational materials focused on

This repository serves as a comprehensive educational guide and curriculum for individuals beginning their journey in web security and bug bounty hunting. It functions as a centralized hub that aggregates foundational knowledge, technical guides, and practical resources to assist newcomers in mastering the core principles of vulnerability research and ethical hacking. The project distinguishes itself through a community-driven curation model, where educational materials such as books, blogs, and labs are organized into structured learning paths. By leveraging a version-controlled, markdown-ba

This repository contains a curated list of open source intelligence tools and resources focused on geolocation and chronolocation. A bookmark version of the most recent iteration of the following recourses is also available.

OpenCTI is a cyber threat intelligence platform and knowledge base used to store, manage, and analyze technical security data. It functions as a threat intelligence visualization tool and an enterprise security data orchestrator that maps relationships between threat actors, malware, and vulnerabilities. The platform utilizes the STIX and TAXII standards for data representation and exchange, allowing for the sharing and receiving of standardized intelligence bundles. It distinguishes itself by converting complex security information into visual relationship diagrams and geographic maps to ide

T-Pot is a multi-honeypot orchestration platform and threat intelligence collector. It utilizes a Docker-based security sandbox to deploy and manage a collection of diverse decoy services that simulate vulnerable targets to lure attackers and record their activity. The system features a distributed sensor network where remote nodes capture attack logs and transmit them via encrypted communication to a central hub. This central hub employs an analytics stack to transform raw logs into geographic maps and interactive dashboards for adversary behavior visualization. To increase the realism of si

MISP is an open-source threat intelligence sharing platform designed for collecting, storing, and distributing structured threat indicators and intelligence. At its core, it provides a distributed synchronization protocol for transferring events between instances, an attribute-based correlation engine that links matching indicators across events, and a REST API with an OpenAPI specification for programmatic access to threat data. The platform uses formal data formats for JSON, taxonomy, galaxy, and object templates to enable compatibility across tools and communities. The platform distinguish

Depix is a pixelation recovery tool and digital forensics utility designed to reconstruct plaintext from pixelated images. It functions as a brute-force text reconstructor that identifies original text sequences by matching pixel blocks against a library of rendered characters. The tool operates as a proof of concept for image de-pixelation, utilizing pattern analysis to reveal hidden information. It is used for digital forensic analysis and redaction security testing to evaluate the effectiveness of pixelation as a method of obscuring sensitive data. The reconstruction process involves colo

Robin is an AI-powered open source intelligence framework and dark web investigation tool. It functions as a multi-model AI orchestrator that integrates search engines and web scrapers with language models to automate information gathering and data synthesis. The system utilizes a crawl-and-filter architecture to isolate high-value data from raw web content and employs a query-refinement pipeline to optimize search terms. It specifically supports dark web investigations by routing requests through proxies to access hidden services and using language models to analyze and summarize findings fr