CORVUS MIND

← Back to home

TOOLBOX

OSINT Toolbox

A selection of genuinely useful tools, sorted by use. For each one: what it is for and, when it is a paid service, what the free version allows compared with what premium unlocks.

Free Open source Freemium Paid

OSINT is practised within a legal and ethical framework: public sources only, never any intrusion. See our introduction to OSINT.

GETTING STARTED

Starting points & frameworks

OSINT Framework

Free
A tree of links to hundreds of tools, sorted by goal (email, username, image…). The go-to "where do I start" reflex.

IntelTechniques

Freemium
The tools and methodology of Michael Bazzell, a reference in the field. Free vs paid: the online search tools are free; the books and in-depth training are paid.

Bellingcat Toolkit

Free
The tool spreadsheet maintained by Bellingcat: a selection verified and annotated by professional investigators.

start.me OSINT

Freemium
OSINT bookmark pages shared by the community, ready to use. Free vs paid: browsing is free; team/private features are paid.

SEARCH

Search engines & advanced search

Google Dorks

Free
Operators (site:, filetype:, intitle:, "") turn Google into a surgical tool. The most rewarding skill in OSINT.

Yandex

Free
Often better than Google for image and face search, and for areas outside the EU/US. An essential complement.

Startpage / DuckDuckGo

Free
Search without personalisation or tracking: useful to get out of your "bubble" and see neutral results.

DorkSearch

Free
Assisted dork generator: builds the advanced query for you.

IDENTIFIERS

Email, username & leaks

Holehe

Open source
Checks whether an email address is registered on dozens of sites, without alerting the target. Command line.

Epieos

Freemium
Reverse email & phone lookup: linked accounts, Google account info, etc. Free vs premium: one-off searches are free; premium opens up volume, history and more sources.

Hunter.io

Freemium
Finds the email addresses associated with a domain and their format. Free vs paid: small monthly quota of searches/verifications on the free plan; paid plans greatly increase volume and export.

Have I Been Pwned

Freemium
Tells you whether an address appears in known data breaches. Free vs paid: manual checks on the website are free; API access (automation) is paid.

Maigret / Sherlock

Open source
Search for a username across hundreds of platforms and compile the profiles found.

WhatsMyName

Free
Username enumeration right in the browser, nothing to install.

IMINT

Images & verification

Google Lens / Images

Free
Reverse image search and object/text recognition. The first step for any photo.

Yandex Images

Free
The best reverse image engine for places and faces. Always worth a try.

TinEye

Freemium
Reverse image search that finds the first appearance of an image online (useful for dating). Free vs paid: web search is free; the API and high-volume monitoring are paid.

InVID / WeVerify

Free
Verification extension: splits a video into keyframes, reverse search, metadata reading, magnifier.

FotoForensics

Free
ELA (Error Level Analysis) to spot edited areas of an image.

Forensically

Free
In-browser image analysis toolkit: clone detection, magnifier, metadata, levels.

GEOINT

Geolocation & mapping

SunCalc

Free
Sun position at a given date/time: lets you date a photo from the length and angle of shadows.

Overpass Turbo

Open source
Queries OpenStreetMap: "every stadium / water tower / bridge in this area". Powerful for narrowing a search.

what3words

Free
Converts three words into coordinates accurate to 3 m, and back.

GeoHints

Free
Catalogue of visual clues by country: licence plates, bollards, poles, signage. The ally of "by eye" geolocation.

WEBINT

Domains & infrastructure

Shodan

Freemium
The "search engine for connected devices": servers, cameras, services exposed on the Internet. Free vs paid: the free account is very limited (few results, restricted filters); a "membership" unlocks filters and results, and the full API is paid. Frequent discounts for .edu addresses.

Censys

Freemium
Detailed view of exposed hosts and certificates. A complement to Shodan. Free vs paid: free query quota; advanced searches and volume require a paid plan.

crt.sh

Free
TLS certificate transparency: reveals a target's subdomains. Free and no account needed.

DNSdumpster

Free
DNS and subdomain mapping of a domain, with a diagram.

urlscan.io

Freemium
Analyses a URL in a sandbox: screenshots, requests, technologies, without visiting it yourself. Free vs paid: public scans are free; private scans and high-volume API use are paid.

Wayback Machine

Free
Web archive: shows how a page looked on a past date. Essential to prove what was published and then deleted.

ANALYSIS

Link analysis & automation

Maltego

Freemium
The standard for link visualisation: connects emails, domains, people and accounts in an interactive graph. Free vs paid: the Community Edition is free but restricted (registration required, limited results per transform, non-commercial use); the Pro/Enterprise editions remove these limits.

SpiderFoot

Open source
Automates collection: give it a target (email, IP, domain) and it queries hundreds of sources. Free vs paid: the open source tool is complete and free; the hosted cloud version (HX) is paid.

Lampyre

Freemium
Investigation data analysis and visualisation, with ready-to-use queries. Free vs paid: installation is free; queries that draw on sources run on paid credits.

Recon-ng

Open source
Command-line reconnaissance framework, structured like Metasploit. Free and modular.

OPSEC

Environment & investigation hygiene

Virtual machine

Free
VirtualBox: isolates each investigation in a disposable environment, separate from your personal system.

Tails

Open source
Amnesic OS on a USB stick, with all traffic routed through Tor. For investigations that require anonymity.

Tor Browser

Free
Anonymised browsing and access to .onion services. Use it knowing its limits.

Sock puppets

Method
Accounts dedicated to the investigation, never personal accounts: the investigator's identity and the one used in the field are never mixed.

A tool never replaces method. The right reflex is always the same: start from a clue, cross-check, document. Detailed techniques are in our writeups.