17 OSINT Tools Every Hacker Must Know

Main ideas / lessons conveyed

• The video aims to help viewers “level up” their OSINT (Open-Source Intelligence) skills using tools that real investigators and hackers rely on.
• It emphasizes avoiding common mistakes—such as:
  • getting overwhelmed,
  • using the wrong tools,
  • wasting time on dead ends.
• Instead, it promotes straightforward tool setups that can uncover:
  • usernames,
  • emails,
  • leaked data,
  • exposed devices,
  • file/image metadata.
• Each tool is described with “sniper precision”: what it does, typical use, main category, and key pros/cons.
• Tool 13 (“the weird one”) is specifically highlighted for finding dormant accounts by monitoring leak/paste hosting.

---

Methodology / tool list

Tool 1: Sherlock (username searcher)

• What it does: Cross-site username checks.
• How to use: Map a social handle to the platforms where it appears.
• Core work: Username footprinting (quickly identifying where a username exists).
• Category: Username search / footprinting
• Pros: Fast; CLI-friendly.
• Cons: Some sites block bots or rate-limit results.
• Important note from narrator: Verify results manually.

Tool 2: MGRE (deep username dossier / user lookup)

• What it does: Produces a user dossier across services.
• How to use: Perform user lookups to gather detailed outputs (including from APIs and public pages).
• Core work: Extensible, high-volume profiling and correlation of data.
• Category: Account search
• Pros: Python-based; extensible.
• Cons: Depends on external APIs and can hit rate limits.

Tool 3: Instagram/public media recon tool (title text garbled)

• What it does: Collects social/media signals from Instagram accounts, including follower analysis.
• How to use: Gather Instagram-specific data on profiles/relationships.
• Core work: Instagram-focused media recon and profiling by email/username across services and breaches.
• Category: (Implied) Account/recon using email/username signals + breaches
• Pros/Cons: Not clearly enumerated; noted limitation:
  • can break with platform changes.

Tool 4: Email/username recon + breach-linked traces

• What it does: Finds linked accounts and leaked traces using email/username across services and breaches.
• Core work: Email and account profiling across breach-linked sources.
• Category: (Implied) Email/account reconnaissance
• Pros/Cons: Not clearly enumerated as a standalone tool in the subtitles.

Tool 5: Have I Been Pwned (breach lookup service)

• What it does: Checks whether emails/accounts appear in known breaches.
• How to use: Search breach databases for exposed accounts.
• Category: Breach search
• Pros: Easy web interface; widely known.
• Cons: Primarily older/recorded leaks; not exhaustive.

Tool 6: Shodan

• What it does: Exposed device mapping (Internet-connected systems).
• How to use: Find hosts/services facing the internet via recon/pen-test style queries.
• Core work: Indexing internet-connected devices and their “banners.”
• Category: Device discovery
• Pros: Strong web + CLI access; rich metadata.
• Cons: Rate-limited; some features require premium access.

Tool 7: Censys

• What it does: Internet-wide scanning for vulnerable hosts/IPs.
• How to use: Use it for continuous scanning/indexing of public-facing hosts for discovery.
• Core work: Network asset discovery + vulnerability reconnaissance.
• Category: Net asset scan
• Pros: Free web usage; strong scanning results.
• Cons: API/advanced features are premium.

Tool 8: ExifTool (“metadata extractor for files and images”)

• What it does: Extracts metadata from files and images.
• How to use: Image location forensics and file metadata extraction.
• Core work: Parsing embedded metadata.
• Category: Metadata analysis
• Pros: Powerful CLI and GUI wrappers.
• Cons: Only useful if metadata exists—often scrubbed/absent.

Tool 9: SpiderFoot

• What it does: Automated multi-source OSINT scanning.
• How to use: Run scans to build asset/threat mapping across many public sources.
• Core work: Orchestrates many OSINT checks and correlates results.
• Category: Automation
• Pros: Highly automated; extensible.
• Cons: Premium model; cloud features behind a paywall.

Tool 10: Maltego

• What it does: Relationship and graph mapping for investigations.
• How to use: Visualize threat actor connections and digital relationships.
• Core work: Graph-based link analysis and enrichment.
• Category: Visualization / link analysis
• Pros: Free tier available; strong visualization; premium features exist.
• Cons: Steep learning curve; advanced uses can cost money.

Tool 13: Pastebin aggregator for leak monitoring (“pacebin” in subtitles)

• What it does: Aggregates paste/leak hosting content for monitoring.
• How to use: Hunt for leak data, code snippets, and disclosures by scanning paste services.
• Core work: Searching paste sites for relevant leaks.
• Category: Paste-bin scanning / leak monitoring
• Pros: Many platforms; frequently used for leaks.
• Cons: Noisy; manual scanning requires heavy filtering.

Tool 14: “Rentry” (paste-style content hosting for leak discovery)

• What it does: Finds leaked notes and posted content similar to paste sites.
• How to use: Search paste-style hosts for relevant content.
• Core work: Scanning paste-style content for leak discovery leads.
• Category: Paste bins / paste hosting
• Pros: Easy free web access.
• Cons: Content can be volatile and removed quickly.

Tool 15: Phone Infoga

• What it does: Phone number reconnaissance and carrier lookup.
• How to use: Support social-engineering analysis and scam investigations.
• Core work: Enumerates carrier/account traces for a phone number.
• Category: Phone recon
• Pros: CLI; open-source; scriptable.
• Cons: Coverage varies by country and carrier.

Tool 16: “Creepy” (geolocation from public posts/images)

• What it does: Geolocation from public posts and images.
• How to use: Do geolocation investigation to map where posts/photos likely originated.
• Core work: Image/post geoforensics and timeline mapping.
• Category: Geolocation
• Pros: Free with a “GUI” mentioned; visual maps.
• Cons: Works best when explicit location tags or identifiable metadata are available.

Tool 17: OSINT Framework

• What it does: Provides a structured directory of OSINT tools/resources.
• How to use: Resource-hunt to find the right tool for a specific task.
• Core work: Aggregates and organizes OSINT resources by category.
• Category: Aggregator
• Pros: Extremely comprehensive and well organized.
• Cons: It’s “only a list”—you must still use the tools yourself.

---

Speakers / sources featured

• Speaker: The video narrator/host (unnamed in the subtitles).
• Sources / tools listed: Sherlock; MGRE; Shodan; Censys; “XF tool” (metadata extractor); SpiderFoot; Maltego; paste hosting aggregator (Tool 13); Rentry; Phone Infoga; “Creepy” geolocation tool; OSINT Framework; plus Have I Been Pwned.