sherlock-project/sherlock
Hunt down social media accounts by username across social networks
A star delta has been computed for 61,707 of 62,629 tracked repositories in this period, and only those can be ranked in it.
A repository missing here has not been measured far enough back yet. That does not mean it did not move.
Star counts measured between 00:37 and 02:27 (BKK).
Hunt down social media accounts by username across social networks
🕵️♂️ Collect a dossier on a person by username from 6K websites
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
🎯 The ultimate OSINT toolkit: investigation graph, confidence scoring, alias families, map, timeline and reports. 49 modules, 400+ sites, no API keys required.
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.
Quickly discover exposed hosts on the internet using multiple search engines.
Modern attack-surface reconnaissance & asset monitoring platform — rebuilt from classic ARL with async decoupled scheduling, enterprise asset correlation and native MCP support. Docker-ready.
E-mails, subdomains and names Harvester - OSINT
A Modern Orchestration Engine for Security
secator - the pentester's swiss knife
Fast passive subdomain enumeration tool.
Fast service fingerprinting CLI for 170+ protocols (TCP/UDP/SCTP) - built by Praetorian
Simple LLM service identification - translate IP:Port to Ollama, vLLM, LiteLLM, or 60+ other AI services in seconds
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
Blitz Strike — a universal MCP security-audit toolbelt. Reconnaissance at speed. Analysis in depth. Validation before report.
Custom Bash and Python scripts used to automate various penetration testing tasks including recon, scanning, enumeration, and malicious payload creation using Metasploit. For use with Ubuntu. Limited support for Kali Linux.
Passive leak enumeration tool.
This project aims to be a drop-in replacement for the certstream server by Calidog. This tool aggregates, parses, and streams certificate data from multiple certificate transparency logs via websocket connections to the clients.
Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?
Information Gathering tool - DNS / Subdomains / Ports / Directories enumeration
Discover new target domains using Content Security Policy
Use favicons to improve your target recon phase. Quickly detect technologies, WAF, exposed panels, known services.
AIRecon is an autonomous cybersecurity agent that combines a self-hosted Large Language Model (Ollama) with a Kali Linux Docker sandbox and a Textual TUI. It is designed to automate security assessments, penetration testing, and bug bounty reconnaissance — without any API keys or cloud dependency.
OWASP Web Recon & Directory Discovery Platform
A command-line tool for discovering URLs for a given domain in a simple, efficient way. It works by gathering information from a variety of passive sources, meaning it doesn't interact directly with the target but instead gathers data that is already publicly available.
A high-speed tool for passively gathering URLs, optimized for efficient and comprehensive web asset discovery without active scanning.
That's all 27 repositories in this period.