Top 25 OSINT Tools (Whats Hot🔥! Whats Not!)

Summary

In this video, the host takes viewers through 25 essential open-source intelligence (OSINT) tools, exploring their features, benefits, and whether they are worth using. The tools range from basic username checks and breach detection to advanced frameworks for target investigation and vulnerability scanning. Tools like Recon-ng, Nmap, and Shodan are highlighted as industry staples, while others like Jigsaw and WebShack are flagged as unreliable or abandoned. The video provides a comprehensive look at OSINT, offering valuable insights for both beginners and experienced professionals looking to enhance their investigative capabilities.

Takeaways

• 😀 OSINT tools are powerful for gathering publicly available information, helping in investigations such as tracking missing persons.
• 😀 The video reviews 25 different OSINT tools, ranging from beginner-friendly to more advanced ones, for various investigative purposes.
• 😀 OSINT Framework is a great starting point for beginners, offering a collection of free tools and resources.
• 😀 Check Usernames is useful for finding social media profiles associated with a particular username.
• 😀 Have I Been Pwned helps users verify if their email has been involved in any data breaches.
• 😀 Some tools, like Been Verified, require payment but provide detailed personal and vehicle information.
• 😀 Shodan and Census are both powerful tools for discovering internet-connected devices, with Shodan being more established.
• 😀 Google Dorks is an advanced search technique that leverages Google’s search operators to find specific information.
• 😀 Maltego is a link analysis tool, although it's difficult to use for those unfamiliar with it.
• 😀 Recon-ng is a highly recommended tool for OSINT due to its focus on target enumeration and investigative capabilities.
• 😀 SpiderFoot is an automated OSINT tool, but it's not as effective as some of the other tools reviewed.
• 😀 Nmap remains a critical tool for network discovery and security auditing, essential for OSINT professionals.
• 😀 Some OSINT tools, like Creepy, Webshag, and UnicornScan, appear to be abandoned or no longer functional.
• 😀 ExifTool is useful for extracting metadata from files, but it also seems to be abandoned at the moment.
• 😀 The video emphasizes the importance of using the right tools based on your experience level, with beginners starting with easier options like OSINT Framework.

Q & A

What is the primary focus of the video?

The video focuses on reviewing 25 open-source intelligence (OSINT) tools, explaining their purpose, functionality, and whether they are worth using for OSINT gathering and investigative purposes.

What is open-source intelligence (OSINT)?

Open-source intelligence (OSINT) refers to publicly available information on individuals, businesses, networks, domains, and other areas, which can be accessed and utilized for various investigative and cybersecurity tasks.

What is the OSINT Framework mentioned in the video?

The OSINT Framework is a tool that helps users find free OSINT resources, providing links to various tools and resources based on specific types of information they are looking to gather.

How does the 'Check Usernames' tool work?

The 'Check Usernames' tool allows users to check whether a specific username is used across 160 different social networks. It helps in profiling individuals by identifying other sites they may be registered on using the same username.

What is 'Have I Been Pwned' and how is it useful?

'Have I Been Pwned' is a tool that checks if an email address has been involved in a data breach. It's useful for determining whether your email has been compromised in past breaches and for identifying potential vulnerabilities in a target's online accounts.

What is the benefit of using 'Censys'?

Censys is a tool similar to Shodan that allows users to input IP addresses, domains, or hosts to gather information on internet-connected assets. It crawls the internet to provide details about these assets, which can be useful for investigations or security assessments.

What is 'Maltego' and why is it considered complex?

Maltego is an OSINT tool designed for graphical link analysis, used to gather and connect information during investigations. It's considered complex due to its steep learning curve and the difficulty in using its API calls and modules for effective analysis.

Why is 'Recon-ng' highly recommended in the video?

Recon-ng is recommended because it's a powerful, command-line OSINT tool widely used by cybersecurity professionals for target enumeration, investigation, and intelligence gathering. It’s an essential tool for penetration testers and red teamers.

What is the limitation of 'BeenVerified'?

'BeenVerified' allows users to find personal information, including contact details and property data, but the tool requires payment after accessing initial information, making it impractical for casual or free users.

What is the purpose of 'Shodan'?

Shodan is a search engine for internet-connected devices. It crawls the internet to collect data on devices and systems, including their ports, IP addresses, and even their geolocation, making it a valuable tool for cybersecurity professionals.

What is the problem with the 'Creepy' OSINT tool?

Creepy is a geolocation tool designed to gather location information from social networks. However, the project has been abandoned, and users have reported issues with its APIs and the inability to download functional executables, making it no longer reliable.

What is 'Nmap' and how is it used in OSINT?

Nmap is a well-known network discovery and security auditing tool that allows users to scan networks and systems for open ports, identify operating systems, and discover services running on them. It's widely used for reconnaissance in both offensive and defensive security practices.

How does the 'Foca' tool help in OSINT investigations?

Foca is used to extract metadata from various file types like PDFs and Office documents. It helps gather hidden information, such as file authors, geolocations, and creation dates, which can be useful in building profiles of individuals or organizations.

What is the role of 'Zuma' in OSINT?

Zuma is an OSINT tool similar to Shodan and Censys. It continuously scans the internet for internet-connected assets and allows users to query this data. It provides a powerful database and fast query responses, making it an emerging favorite for security professionals.

What tools does the video recommend for scanning IPs and vulnerabilities?

The video recommends using 'Nmap' for scanning IPs and ports. For vulnerability scanning, it suggests using paid options like Nessus, as well as mentioning open-source alternatives like OpenVAS, though it's noted that OpenVAS can be difficult to set up.