Post cover image

October 13, 2026

10 GitHub OSINT Tools I Actually Reach For During Recon

Hi Everyone, My name is Nitin Gavhane. Last month I was helping a friend scope a bug bounty target. We had the domain, nothing else. Twenty…

By Nitin Gavhane

4 min read

Hi Everyone, My name is Nitin Gavhane. Last month I was helping a friend scope a bug bounty target. We had the domain, nothing else. Twenty minutes later we had a pile of subdomains, employee emails, a couple of forgotten staging sites, and one username that linked three different social profiles. Half of that came from tools that have been sitting on GitHub for years. The other half came from knowing which ones still work and which ones just look shiny in screenshots.

OSINT is not magic. It is mostly public data plus patience plus the right scripts. Here are ten GitHub tools that keep showing up in real recon work. Not the longest list. Just the ones that still earn their place.

1. Sherlock — Username Hunting

When you only have a handle, start here. Sherlock checks hundreds of sites at once and gives you direct profile links when it finds a hit.

Repo: https://github.com/sherlock-project/sherlock

git clone https://github.com/sherlock-project/sherlock
cd sherlock
python3 -m pip install -r requirements.txt
python3 sherlock.py targetusername

It is not perfect. False positives happen. But it is fast and still one of the cleanest starting points.

2. Amass — Attack Surface Mapping

OWASP Amass is the heavy hitter for domain and subdomain discovery. Passive mode stays quiet. Active mode digs deeper when you are allowed to.

Repo: https://github.com/owasp-amass/amass

go install -v github.com/owasp-amass/amass/v4/…@master
amass enum -passive -d example.com -o results.txt

I have watched Amass pull subdomains that Subfinder missed and the other way around. Running both is still the safe play.

3. Subfinder — Quiet Subdomain Discovery

ProjectDiscovery's Subfinder is built for passive collection. It pulls from a long list of sources without touching the target.

Repo: https://github.com/projectdiscovery/subfinder

go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
subfinder -d example.com -o subs.txt

Pair it with httpx right after and you instantly know which ones are alive.

4. theHarvester — Emails, Hosts, Names

Old but still useful. theHarvester scrapes public sources for emails, subdomains, and names tied to a domain.

Repo: https://github.com/laramies/theHarvester

pip install theHarvester
theHarvester -d example.com -b all -f report

Results vary by source. Some engines have gotten stricter. Still worth running early.

5. SpiderFoot — Automated Collection

If you want one tool that can pull from dozens of sources and give you a report, SpiderFoot is hard to beat. It has a web UI and a CLI.

Repo: https://github.com/smicallef/spiderfoot.git

Stable build (packaged release):

 wget https://github.com/smicallef/spiderfoot/archive/v4.0.tar.gz
 tar zxvf v4.0.tar.gz
 cd spiderfoot-4.0
 pip3 install -r requirements.txt
 python3 ./sf.py -l 127.0.0.1:5001

Development build (cloning git master branch):

 git clone https://github.com/smicallef/spiderfoot.git
 cd spiderfoot
 pip3 install -r requirements.txt
 python3 ./sf.py -l 127.0.0.1:5001

Good when you need breadth more than speed. It can feel heavy, so I usually point it at a single domain or email and let it run while I work on something else.

6. Recon-ng — Modular Framework

Recon-ng feels like Metasploit for OSINT. You create a workspace, load modules, and chain them.

Repo: https://github.com/lanmaster53/recon-ng

Useful when you want structure. Less useful when you just need a quick subdomain list. I keep it around for longer investigations.

7. PhoneInfoga — Phone Number Recon

Give it a phone number and it tries to pull carrier data, possible social links, and other public signals.

Repo: https://github.com/sundowndev/phoneinfoga

Not every number yields gold, but when it does the results can be surprisingly useful for people-focused work.

8. Holehe — Email to Account Discovery

Holehe checks whether an email is registered on a long list of sites. Fast and quiet.

Repo: https://github.com/megadose/holehe

With PyPI

pip install holehe

With Github

git clone https://github.com/megadose/holehe.git
cd holehe/
python3 setup.py install

With Docker

docker build . -t my-holehe-image
docker run my-holehe-image holehe test@gmail.com

I use this right after theHarvester when I want to see where those emails actually live.

9. httpx — Live Host Checking

Once you have a list of domains or subdomains, httpx tells you what is actually responding, what status codes they return, and often what tech is running.

Repo: https://github.com/projectdiscovery/httpx

subfinder -d example.com -silent | httpx -status-code -title -tech-detect

Simple pipeline. High value.

10. TruffleHog & Gitleaks — Secrets in Repos

These two are more "GitHub OSINT" than pure people or domain OSINT, but they belong on the list. Developers still leave API keys and tokens in public repos and commit history.

TruffleHog: https://github.com/trufflesecurity/trufflehog

None

MacOS Installation:

brew install trufflehog

Gitleaks: https://github.com/gitleaks/gitleaks

Installation:

# MacOS
brew install gitleaks

# Docker (DockerHub)
docker pull zricethezav/gitleaks:latest
docker run -v ${path_to_host_folder_to_scan}:/path zricethezav/gitleaks:latest [COMMAND] [OPTIONS] [SOURCE_PATH]

# Docker (ghcr.io)
docker pull ghcr.io/gitleaks/gitleaks:latest
docker run -v ${path_to_host_folder_to_scan}:/path ghcr.io/gitleaks/gitleaks:latest [COMMAND] [OPTIONS] [SOURCE_PATH]

# From Source (make sure `go` is installed)
git clone https://github.com/gitleaks/gitleaks.git
cd gitleaks
make build

Both scan for high-entropy secrets and known patterns. Run them against organization accounts or interesting repositories during recon. You would be surprised how often something useful turns up.

How I Actually Use Them

I rarely run all ten on every target. A normal flow looks more like this:

  1. Subfinder + Amass for subdomains
  2. httpx to filter live hosts
  3. theHarvester and Holehe for emails and account presence
  4. Sherlock if I have a username
  5. SpiderFoot or Recon-ng if the target justifies deeper collection
  6. TruffleHog or Gitleaks if there is any GitHub footprint

The tools that survive are the ones that still return useful data without constant babysitting. Many older projects have gone quiet or broken because APIs changed. These ten have stayed relevant longer than most.

One practical note: always stay inside legal and authorized boundaries. Public data is public, but rate limits, terms of service, and local laws still apply. Get permission when the work moves beyond pure passive collection.

Most of the real value is not in any single tool. It is in chaining a few reliable ones, filtering the noise, and knowing when to stop collecting and start analyzing.