Reconnaissance Python Packages

sherlock-project

Hunt down social media accounts by username across social networks

maigret

🕵️‍♂️ Collect a dossier on a person by username from 6K websites

recon-tool

Map a domain's public technical footprint with provenance, confidence, and explicit uncertainty. Passive by default, machine-readable, and built to report evidence, not guesses.

theharvester

E-mails, subdomains and names Harvester - OSINT

secator

secator - the pentester's swiss knife

openosint

AI-powered OSINT agent with interactive REPL, MCP server, and CLI. 20 tools. Works with Claude, GPT-4, or local models. For authorized security research only.

social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

phoneintel

PhoneIntel is an OSINT tool for retrieving detailed information about phone numbers.

fierce

A DNS reconnaissance tool for locating non-contiguous IP space.

netlas

Netlas.io Python SDK & CLI Tool

spaf

🎯 AI-orchestrated offensive security framework. Automated recon, CVE mapping, exploit POC generation & remediation across a discovery → validation → report pipeline. CLI · API · MCP · dashboard. Powered by Gemini, Claude, Ollama & LM Studio. Authorized testing only.

pywerview

A (partial) Python rewriting of PowerSploit's PowerView

pyadrecon

Python3 implementation of ADRecon with support for NTLM and Kerberos authentication querying LDAP. Generates individual CSV files and a single XSLX + HTML report about your AD domain.

osint-toolbox-mcp

MCP server that lets AI agents run 12 classic OSINT tools locally, no API keys needed

chiasmodon

Chiasmodon is an OSINT tool designed to assist in the process of gathering information about a target domain. Its primary functionality revolves around searching for domain-related data, including domain emails, domain credentials, CIDRs , ASNs , and subdomains, the tool also allows users to search Google Play application ID.

opendoor

OWASP Web Recon & Directory Discovery Platform

subdominator

SubDominator helps you discover subdomains associated with a target domain efficiently and with minimal impact for your Bug Bounty

maryam

Maryam: Open-source Intelligence(OSINT) Framework

facebook-snooper

Scrapes Facebook profile pages using a normal login (without an API key)

cewler

CeWLeR - Custom Word List generator Redefined. CeWL alternative in Python, based on the Scrapy framework.

gyntoolkit

All-in-one Python security toolkit for reconnaissance, network scanning, vulnerability analysis and authorized penetration testing

vamp-passive-recon

VampSecure Labs: Passive recon engine — subdomain enumeration + HTTP headers analysis

aarya

validate the existence of email address on various online platforms, find digital footprint related to it, like Google maps contributions, reviews etc. | aarya was featured on https://osintool.org/

subx-recon

SubX is an open-source asset discovery framework that helps security professionals uncover and map internet-facing assets through subdomain enumeration and reconnaissance techniques.