OSINT Framework (Advanced Reconnaissance Framework)

repository·master·Indexed 11 days ago

https://github.com/lockfale/osint-framework

A collection of free tools and resources for Open Source Intelligence (OSINT) gathering. The framework provides a structured catalog of tools categorized by capabilities, pricing, and operational security (OPSEC) profiles, including domain enrichment, WHOIS records, and subdomain reconnaissance tools like Aquatone, Recon-ng, and XRay.

Tokens: 3.9K
Snippets: 9
Records: 16
Agent score: 46%

What's inside OSINT Framework

Understand OSINT Framework tool markers and metadata
master
The OSINT Framework categorizes tools using specific markers in their names and structured metadata in the arf.json file.
Name Markers
- (T): Tool must be installed and run locally.
- (D): Google Dork.
- (R): Requires registration.
- (M): The URL contains a search term that must be edited manually.
Metadata Fields
Tools are described using several metadata fields to help users understand their capabilities and operational security (OPSEC) requirements.
https://github.com/lockfale/osint-framework/blob/master/README.md

Add a new tool to the OSINT Framework

master

To contribute a new resource, ensure the site is publicly available and free to use.

Locate the appropriate category folder in the repository.
Update arf.json with a new tool entry.
Important: Append the relevant marker ((T), (D), (R), or (M)) to the name string and set the corresponding boolean field to true.
At minimum, include name, type, and url. It is strongly encouraged to include all metadata fields for better usability.

{
  "name": "Example Name (T)",
  "type": "url",
  "url": "https://example.com",
  "description": "Brief description of what the tool does and its key capabilities.",
  "status": "live",
  "pricing": "free",
  "bestFor": "Primary use case in one sentence",
  "input": "What the tool accepts (e.g., Username, Domain, IP address)",
  "output": "What the tool returns (e.g., Profile matches, DNS records)",
  "opsec": "passive",
  "opsecNote": "Any operational security considerations for using this tool.",
  "localInstall": true,
  "googleDork": false,
  "registration": false,
  "editUrl": false,
  "api": false,
  "invitationOnly": false,
  "deprecated": false
}

Use Netlas.io API for attack surface discovery

master

Netlas.io is an internet-wide scanning platform used for attack surface discovery and vulnerability research. It provides DNS, WHOIS, SSL, and network reconnaissance. It offers a freemium model with a free tier allowing 50 daily requests via API.

{
  "description": "Comprehensive internet-wide scanning and OSINT platform providing DNS, WHOIS, SSL, and network reconnaissance with attack surface discovery capabilities.",
  "status": "live",
  "pricing": "freemium",
  "bestFor": "Internet reconnaissance, DNS and WHOIS lookups, attack surface discovery, vulnerability research",
  "input": "Domain name, IP address, ASN, DNS records",
  "output": "DNS records, WHOIS data, open ports, SSL certificates, service information, historical data",
  "api": true
}

Use IP2WHOIS API for registrant research

master

IP2WHOIS is a free service for looking up registration details, registrant information, and location data for both domain names and IP addresses. It provides API access.

{
  "description": "Free WHOIS lookup service for domain names and IP addresses, providing registration details, registrant information, location data, and API access.",
  "status": "live",
  "pricing": "free",
  "bestFor": "Domain and IP WHOIS lookups, registrant research",
  "input": "Domain name or IP address",
  "output": "WHOIS records, registrant details, location information, registration dates",
  "api": true
}

Use ViewDNS.info API for DNS and reverse lookups

master

ViewDNS.info provides comprehensive DNS lookups, reverse IP lookups, and reverse WHOIS searches. It supports API access for automated queries including historical DNS tracking.

{
  "description": "Comprehensive DNS lookup and WHOIS service providing detailed DNS records, reverse IP lookups, reverse WHOIS searches, and API access for automated queries.",
  "status": "live",
  "pricing": "free",
  "bestFor": "DNS reconnaissance, reverse IP and reverse WHOIS lookups, historical DNS tracking",
  "input": "Domain name, IP address, registrant name/email, nameserver",
  "output": "DNS records, WHOIS information, reverse lookups, IP hosting, historical DNS changes",
  "api": true
}

Use Domaincrawler.com API for large-scale domain research

master

Domaincrawler.com provides access to a massive database of over 1.4 billion domains and 80+ billion historical records. It is designed for brand protection, zone file analysis, and market intelligence. It offers a paid API.

{
  "description": "Enterprise-grade domain database covering 1.4+ billion registered and unregistered domains...",
  "status": "live",
  "pricing": "paid",
  "bestFor": "Large-scale domain research, brand protection monitoring, zone file analysis, market intelligence",
  "input": "Domain name, DNS data, technology stack filters",
  "output": "Domain metadata, DNS configuration, SSL certificates, technology stack, ownership connections, historical data",
  "api": true
}

Use DomainTools Whois API for enterprise intelligence

master

DomainTools Whois is an enterprise-grade service providing historical WHOIS data and rapid query responses. It is suitable for threat actor tracking and enterprise domain intelligence. It offers a paid API for automated integration.

{
  "description": "Enterprise-grade WHOIS API with decades of historical domain data and rapid query response.",
  "status": "live",
  "pricing": "paid",
  "bestFor": "Historical WHOIS research, threat actor tracking, enterprise domain intelligence",
  "input": "Domain name or IP address",
  "output": "Current and historical WHOIS records, registrant details, hosting history",
  "opsec": "passive",
  "api": true
}

Use Google Dorks for indexed subdomain discovery
master
You can enumerate subdomains that are indexed by Google using the site: operator. This is a passive technique that does not contact the target domain directly.
- Input: Domain name using Google Dork syntax (e.g., site:domain.com)
- Output: Indexed subdomains and pages from Google search results
- OPSEC: Passive
```
site:domain.com
```
https://github.com/lockfale/osint-framework/blob/master/THE-127-domain-enrichment-batch1.md
Use FindSubDomains for automated subdomain enumeration
master
FindSubDomains is a free web-based tool that provides automated subdomain discovery with filtering and analysis capabilities, such as organization name filtering and popularity metrics.
- Input: Domain name or keyword
- Output: Discovered subdomains, organization associations, popularity metrics, filtering options
- OPSEC: Passive (uses passive DNS and search-based methods; no active probing)
https://github.com/lockfale/osint-framework/blob/master/THE-127-domain-enrichment-batch1.md

Reference: Domain Name Tools (Whois Records Category)

master

This section provides a catalog of tools used for domain name enrichment and WHOIS record retrieval. These tools are categorized by their capabilities, pricing models, and operational security (OPSEC) profiles. Most tools listed are 'passive', meaning they query public databases or cached records without contacting the target infrastructure directly.

[
  {
    "name": "Domain Dossier",
    "description": "Free web-based tool that aggregates WHOIS, DNS, and network information...",
    "status": "live",
    "pricing": "free",
    "bestFor": "Quick domain and IP reconnaissance with DNS and WHOIS data",
    "input": "Domain name or IP address",
    "output": "WHOIS records, DNS records, IP information, registration details",
    "opsec": "passive"
  },
  {
    "name": "domainIQ",
    "description": "Comprehensive domain intelligence platform...",
    "status": "live",
    "pricing": "freemium",
    "bestFor": "Domain ownership history, reverse analytics lookup, competitor domain research",
    "input": "Domain name",
    "output": "Domain owner information, historical ownership, similar domains, analytics data, reverse MX/IP/DNS lookups",
    "opsec": "passive"
  },
  // ... (additional tools follow this schema)
]

Use SynapsInt for unified OSINT research
master
SynapsInt is a web-based OSINT platform used for domain, IP, SSL, analytics, email, phone, and social media lookups. It supports subdomain enumeration and multi-vector intelligence gathering.
- Input: Domain, IP, email, phone, username, CVE ID
- Output: Subdomains, DNS records, WHOIS data, open ports, vulnerabilities, social media accounts, historical data
- OPSEC: Passive (aggregates publicly available information; no direct target contact)
https://github.com/lockfale/osint-framework/blob/master/THE-127-domain-enrichment-batch1.md

Reference tool metadata fields in arf.json

master

When working with the framework's data, use the following metadata fields for tool entries:

| Field | Type | Description |
|-------|------|-------------|
| `description` | string | What the tool does |
| `status` | string | `live`, `degraded`, `down`, or `deprecated` |
| `pricing` | string | `free`, `freemium`, or `paid` |
| `bestFor` | string | Primary use case in one line |
| `input` | string | What the tool takes as input |
| `output` | string | What the tool returns |
| `opsec` | string | `passive` or `active` |
| `opsecNote` | string | Operational security considerations |
| `localInstall` | boolean | Corresponds to `(T)` marker |
| `googleDork` | boolean | Corresponds to `(D)` marker |
| `registration` | boolean | Corresponds to `(R)` marker |
| `editUrl` | boolean | Corresponds to `(M)` marker |
| `api` | boolean | Whether the tool offers an API |
| `invitationOnly` | boolean | Whether access requires an invitation |
| `deprecated` | boolean | Whether the tool is deprecated |

OSINT Framework (Advanced Reconnaissance Framework)

What's inside OSINT Framework

Name Markers

Metadata Fields