OSINT tools


cewl [options] <url>
Example: cewl -m 6 -w megacorp-cewl.txt
-d = depth to spider, default 2
-m = minimum word length, default 3
-w = write the output to file, include file name
-c = count, show word count for each word entry
-v = verbose


  • Metadata search tool that can search, download and analyze all documents on a domain and provide a list of metadata
  • Metadata often includes users, directories, printers, emails, passwords, operating systems/software and servers


  • From the site: "Hunter lets you find professional email addresses in seconds and connect with the people that matter for your business."


OSINT framework


  • Module based framework for web information gathering
  • Run tool (Kali): recon-ng
  • Search available modules: marketplace search $keyword
  • Learn about available modules: marketplace info $modulename
  • Add a module: marketplace install module
  • Load module: modules load $modulename
    • Display required parameters: info
    • Configure options: options set $option
    • Execute module: run
  • Information from each module used is stored in a database
    • Exit module: back
    • Display information: show


  • Allows searching for computers and IoT devices
  • May reveal items that should be in scope but were not included by the client
  • Search by client name; devices outside the client's IP range are likely managed by third parties

Social media tools

  • Social-Searcher - a search engine for social media sites
  • Twofi - scans a user's Twitter feed and generates wordlists
  • linkedin2username - a script for generating username lists based on LinkedIn data


  • Gathers emails, names, subdomains, IP addresses, and URLs from multiple search engines
  • Run with (Kali): Theharvester -d -b google
    • -d: specifies the target domain
    • -b: specifies which data source to search

whois enumeration

  • Regular lookup: whois
  • Reverse lookup: whois $ipaddress