Tools & Resources

A categorized, chapter-by-chapter starting point — not an exhaustive or guaranteed-current directory.

This is a categorized starting-point list, not an exhaustive directory — OSINT tooling changes fast, and a printed (or static HTML) list is a snapshot, not a living resource. Every category below carries the same warning: check that a tool still exists and still works before you build a workflow around it. Treat this page as a map of categories worth knowing, not a guarantee that every named tool is still the best (or even still online) by the time you read it.

Search & General Reconnaissance (Ch. 3)

• Google, Bing, DuckDuckGo, Startpage, Brave Search — general-purpose search with operator support
• Baidu, Yandex, Naver — regional engines for non-Western content
• Wayback Machine (web.archive.org), archive.today — web archiving
• Google Hacking Database (GHDB) — cataloged dork queries

Identity & Username Investigation (Ch. 4)

• Sherlock, Maigret — username enumeration across platforms
• ExifTool — metadata extraction/editing (also central to Ch. 6)
• dirb, Photon, curl — web/directory reconnaissance

Social Media Intelligence (Ch. 5)

• Gephi, Maltego (Community Edition), Neo4j Community Edition — social network / link analysis
• Bot-scoring browser extensions — treat scores as leads, not verdicts (see Ch. 5's verification note)

Image, Video & Media Forensics (Ch. 6)

• Google Lens, TinEye, Yandex Images, Bing Visual Search — reverse image search
• ExifTool — full metadata extraction (EXIF/IPTC/XMP)
• Forensically, FotoForensics — Error-Level Analysis, clone detection
• FFmpeg / FFprobe — video frame extraction, technical inspection

Geolocation & Mapping (Ch. 7)

• Google Maps / Earth / Street View — imagery and measurement
• Mapillary, KartaView — crowdsourced street-level imagery
• OpenStreetMap, Overpass Turbo, Bellingcat OSM Search — feature-based map queries
• SunCalc — sun position / shadow analysis
• Copernicus Browser, NASA Worldview, USGS EarthExplorer — satellite imagery
• GeoHints — comparative road-furniture/regional-tell reference

Dark Web (Ch. 8)

• Tor Browser — standard access point
• Ahmia and similar Tor-specific search indexes
• Commercial breach/leak monitoring services — the safer alternative to manual dark-web browsing for ongoing monitoring

Domain & Network Infrastructure (Ch. 9)

• WHOIS lookup services; historical WHOIS lookup services
• Subfinder, Sublist3r — subdomain enumeration
• Shodan, Censys — internet-wide device/service scanning
• crt.sh and other Certificate Transparency log viewers
• mxtoolbox and similar — DNS record lookups

Financial & Cryptocurrency (Ch. 10)

• OFAC SDN list (US Treasury) — sanctions screening, including crypto addresses
• Block explorers (one exists per major chain) — wallet/transaction lookup
• National company registries (Companies House, EDGAR, etc.) — see also Ch. 12

Python for OSINT (Ch. 11)

• requests — HTTP/API calls
• beautifulsoup4 (+ lxml) — HTML/XML scraping
• selenium — browser automation for JavaScript-heavy pages
• re (built-in) — pattern extraction
• python-whois, dnspython — domain/DNS automation (Ch. 9)
• wayback — Wayback Machine automation
• Streamlit, Flask, Django — turning a script into a small web app

Corporate Due Diligence (Ch. 12)

• SEC EDGAR (US public company filings) and equivalent national registries
• National company registries (officer/filing history)
• Tax-authority nonprofit filing lookups (e.g. IRS Form 990 search, US)
• UN Security Council and national/EU sanctions/blacklist search tools

Verification & Disinformation (Ch. 13)

• Established fact-checking archives — check before you verify from scratch
• Reverse image search tools (see Ch. 6) — for tracing image/video origin
• Web archive tools (see Ch. 3) — for establishing publication timelines

OPSEC (Ch. 14)

• Tor, I2P, Freenet — anonymizing networks
• Reputable commercial VPN providers — vet for audit history and breach record before choosing one
• Virtual machine software (for a disposable investigation environment)
• AI face-generation tools — for sock-puppet profile photos, used with the ethical caveats in Ch. 14