Production-grade multi-language toolkit for Open Source Intelligence (OSINT) gathering and reconnaissance
Features • Installation • Usage • Documentation • Contributing • License
Zero mock code. Zero placeholders. Zero bullshit. This toolkit provides fully functional OSINT capabilities with enterprise-grade privacy, anonymity, and operational security features.
Built for professionals who need:
- Comprehensive intelligence gathering
- Privacy-preserving reconnaissance
- Operational security (OPSEC)
- Multi-language implementations
- Production-ready code
- WHOIS information with registrar details
- Complete DNS record enumeration (A, AAAA, MX, NS, TXT, SOA, CNAME, CAA)
- SSL certificate analysis
- Subdomain discovery
- Domain age and expiry monitoring
- Geolocation with multiple providers
- ASN (Autonomous System Number) details
- ISP and organization information
- Reverse DNS lookup
- Network range identification
- RFC-compliant email validation
- MX record verification
- Disposable email detection
- Social media profile discovery
- Email pattern generation
- Email and phone number extraction
- Social media link discovery
- Technology stack detection
- Meta information extraction
- JavaScript library detection
- Cross-platform username search
- Profile availability checking
- Account analysis
- Related username generation
from privacy.tor_proxy import TorSession
session = TorSession()
response = session.get('https://target.com')
session.renew_circuit() # New exit nodefrom privacy.proxy_rotation import ProxyRotator, ProxySession
rotator = ProxyRotator()
rotator.add_proxy('socks5', 'proxy1.com', 1080)
session = ProxySession(rotator, strategy='random')- Randomized browser fingerprints
- User-Agent rotation
- HTTP header obfuscation
- Rate limiting
- Anti-detection patterns
from privacy.secure_credentials import SecureCredentialStore
store = SecureCredentialStore()
store.unlock("master_password")
store.set("SHODAN_API_KEY", "your_key")
store.save() # Encrypted at rest- PII detection (emails, phones, SSN, credit cards, IPs)
- Data redaction and masking
- Pseudonymization
- Data minimization
- Audit trail logging
- Encrypted sensitive data
- Automatic PII sanitization
- Session tracking
Multi-language implementations with zero dependencies:
| Tool | Language | Purpose |
|---|---|---|
domain_recon.py |
Python | Domain reconnaissance |
email_hunter.py |
Python | Email discovery |
portscanner.js |
Node.js | Asynchronous port scanning |
dns_lookup.ps1 |
PowerShell | Windows DNS analysis |
whois_lookup.sh |
Bash | UNIX WHOIS tool |
ip_geolocator.rb |
Ruby | IP geolocation |
http_headers.php |
PHP | HTTP header analysis |
network_scanner.go |
Go | High-performance scanning |
ssl_checker.pl |
Perl | SSL/TLS checking |
dns_leak_checker.py |
Python | DNS leak detection |
metadata_scrubber.py |
Python | Remove metadata from files |
secure_delete.py |
Python | Secure file deletion |
mac_randomizer.sh |
Bash | MAC address randomization |
- Historical data retrieval
- WAF/CDN detection
- Security header analysis
- Common port scanning
- Email address extraction
- Reputation scoring
- Threat intelligence
- Network topology mapping
- BGP route analysis
Professional implementations:
- Node.js: Advanced reconnaissance, web scraping, threat intel
- C/C++: High-performance port scanner, DNS resolver, subdomain finder
- .NET: Enterprise OSINT framework with domain analyzer, WHOIS, email validator
- Assembly: Low-level network probe
# Clone repository
git clone https://github.com/Lackadaisical-Security/public-osint-and-intel-tools.git
cd public-osint-and-intel-tools
# Install Python dependencies
pip install -r requirements.txt
# (Recommended) Use virtual environment
python3 -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
pip install -r requirements.txtCreate .env file for enhanced functionality:
# Social Media APIs
TWITTER_API_KEY=your_twitter_api_key
TWITTER_API_SECRET=your_twitter_api_secret
# Security APIs
SHODAN_API_KEY=your_shodan_api_key
VIRUSTOTAL_API_KEY=your_virustotal_api_key
HIBP_API_KEY=your_hibp_api_key
# Geolocation
IPINFO_TOKEN=your_ipinfo_tokenSecure credential storage:
from privacy.secure_credentials import SecureCredentialStore
store = SecureCredentialStore()
store.unlock()
store.set("SHODAN_API_KEY", "your_key_here")
store.save() # Encrypted with passwordPython Tools:
- Python 3.7+
- See
requirements.txtfor packages
Standalone Scripts:
- Python 3.6+, Node.js 12+, PowerShell 5.0+
- Bash 4+, Ruby 2.5+, PHP 7.0+, Go 1.16+, Perl 5.10+
Multi-Platform:
- Node.js 14+, GCC/MinGW, .NET 6.0 SDK, NASM
# Domain intelligence
python osint_cli.py -d example.com
# IP analysis
python osint_cli.py -i 8.8.8.8
# Email investigation
python osint_cli.py -e user@example.com
# Web scraping
python osint_cli.py -w https://example.com
# Save results
python osint_cli.py -d example.com -o results.jsonfrom tools.domain_intel import DomainIntel
from tools.ip_intel import IPIntel
from privacy.tor_proxy import TorSession
# Use Tor for anonymity
session = TorSession()
# Domain intelligence
domain_intel = DomainIntel()
results = domain_intel.gather_intel("example.com")
# IP intelligence
ip_intel = IPIntel()
results = ip_intel.gather_intel("8.8.8.8")from privacy.tor_proxy import TorSession
from privacy.request_obfuscation import ObfuscatedSession
from privacy.secure_logging import AuditLogger
# Setup anonymization
tor = TorSession()
session = ObfuscatedSession()
# Setup audit logging
logger = AuditLogger(encrypt=True)
# Perform operation
logger.log_operation('domain_lookup', 'target.com')
response = tor.get('https://target.com')
logger.log_success('domain_lookup', 'target.com', 'Complete')# DNS leak check
python standalone/dns_leak_checker.py
# Remove metadata from images
python standalone/metadata_scrubber.py photo.jpg -o clean_photo.jpg
# Secure file deletion
python standalone/secure_delete.py sensitive.txt
# MAC address randomization (requires root)
sudo bash standalone/mac_randomizer.sh wlan0
# Port scanning
node standalone/portscanner.js example.com 1 1000 50
# Run all tools
python standalone/run_all.py example.com- CODE_OF_CONDUCT.md: Merit-based contribution standards
- CONTRIBUTING.md: How to contribute
- SECURITY.md: Security practices and vulnerability reporting
- PRIVACY.md: Data handling and privacy guidelines
- OPSEC_GUIDE.md: Operational security procedures
- LICENSE: MIT License
✅ Tor integration for anonymity
✅ Proxy rotation to avoid detection
✅ Request obfuscation (fingerprints, headers, timing)
✅ Encrypted credential storage
✅ PII detection and redaction
✅ Secure audit logging
✅ DNS leak prevention
✅ Metadata removal
✅ Secure file deletion
- Always obtain authorization before reconnaissance
- Use Tor/VPN for sensitive operations
- Check for DNS leaks before operations
- Sanitize data before sharing
- Encrypt all stored intelligence
- Follow rate limits to avoid detection
- Review OPSEC_GUIDE.md before operations
This toolkit is for:
- ✅ Authorized security assessments
- ✅ Bug bounty programs (within scope)
- ✅ Penetration testing (with permission)
- ✅ Educational purposes
- ✅ Personal privacy audits
- ✅ Legitimate research
NOT for:
- ❌ Unauthorized surveillance
- ❌ Stalking or harassment
- ❌ Corporate espionage
- ❌ Privacy violations
- ❌ Illegal activities
Users must comply with:
- CFAA (Computer Fraud and Abuse Act)
- GDPR (General Data Protection Regulation)
- CCPA (California Consumer Privacy Act)
- ECPA (Electronic Communications Privacy Act)
- Export control laws
- Local jurisdiction laws
See PRIVACY.md and SECURITY.md for details.
This software may be subject to U.S. Export Administration Regulations (EAR) and other export control laws.
Classification: This software is believed to be classified under ECCN 5D002 (Information Security Software) or may qualify for License Exception TSU (Technology and Software - Unrestricted) under EAR §740.13(e) as publicly available encryption source code.
Encryption Notice: This software includes or may use cryptographic functionality that is subject to export controls. Users are responsible for complying with all applicable export control laws and regulations.
OFAC Sanctioned Countries (as of January 2026):
- 🚫 Cuba
- 🚫 Iran
- 🚫 North Korea (DPRK)
- 🚫 Syria
- 🚫 Crimea, Donetsk, and Luhansk regions of Ukraine
- 🚫 Other countries subject to comprehensive U.S. sanctions
Additional Restrictions:
- Countries subject to U.S. arms embargo
- Entities on the U.S. Denied Persons List, Entity List, or Specially Designated Nationals (SDN) List
- Any individual or entity prohibited from receiving U.S. exports
Note: Sanctions lists change frequently. Users must verify current restrictions at:
- U.S. Department of Commerce Bureau of Industry and Security (BIS): https://www.bis.doc.gov/
- U.S. Department of Treasury Office of Foreign Assets Control (OFAC): https://ofac.treasury.gov/
- U.S. Department of State Directorate of Defense Trade Controls (DDTC): https://www.pmddtc.state.gov/
By downloading, using, or distributing this software, you agree that:
-
Compliance: You are solely responsible for compliance with all applicable export control laws and regulations, including but not limited to the U.S. Export Administration Regulations (EAR), International Traffic in Arms Regulations (ITAR), and sanctions administered by OFAC.
-
No Prohibited Use: You will not use, export, re-export, or transfer this software:
- To or from any sanctioned country or region
- To any denied party or restricted entity
- For any prohibited end-use (e.g., nuclear, chemical, or biological weapons; missile technology)
- In violation of any applicable laws or regulations
-
Due Diligence: You will conduct appropriate due diligence to ensure your use complies with all applicable laws, including:
- Screening parties against denied party lists
- Determining proper export classification
- Obtaining necessary licenses or authorizations
- Maintaining appropriate records
-
No Warranty of Compliance: The maintainers make no representations or warranties regarding export control classification or compliance. Users must make their own determinations.
IMPORTANT: While this software is open source and publicly available, its distribution may still require export licenses or authorizations in certain circumstances. The maintainers do not provide legal advice regarding export compliance.
Consult with legal counsel or export control specialists if:
- You are located in or exporting to a sanctioned country
- You are exporting to a denied party or restricted entity
- You are using the software for sensitive applications
- You are uncertain about your export control obligations
This software includes cryptographic and security analysis capabilities that may be subject to export controls under EAR Category 5, Part 2 (Information Security). These capabilities include:
- Encryption and decryption functionality
- Network security analysis tools
- Penetration testing capabilities
- Intelligence gathering software
Users outside the United States must comply with local laws regarding:
- Import of cryptographic software
- Use of encryption technology
- Cybersecurity tools and applications
- Intelligence gathering and surveillance technology
The maintainers:
- Are not export control experts or legal advisors
- Make no representations regarding export control status
- Do not provide legal advice regarding export compliance
- Recommend consulting with qualified legal counsel
This information is provided for general awareness only and does not constitute legal advice.
For complete legal terms including indemnification clauses, see the LICENSE file.
For official guidance, contact:
-
U.S. Department of Commerce, Bureau of Industry and Security (BIS)
- Website: https://www.bis.doc.gov/
- Email: exportcontrol@bis.doc.gov
- Phone: +1 (202) 482-4811
-
U.S. Department of State, Directorate of Defense Trade Controls (DDTC)
- Website: https://www.pmddtc.state.gov/
- Email: DDTCResponseTeam@state.gov
Last Updated: January 2026
Note: Export control laws and sanctions lists are subject to change. Users are responsible for staying informed of current regulations.
We welcome quality contributions from skilled developers.
Before contributing:
- Read CODE_OF_CONDUCT.md
- Review CONTRIBUTING.md
- Check SECURITY.md for security requirements
Contribution requirements:
- Production-ready code (no TODOs, no placeholders, no mocks)
- Comprehensive tests
- Security review
- Documentation
- PEP 8 compliance (Python)
See CONTRIBUTING.md for details.
public-osint-and-intel-tools/
├── tools/ # Core Python OSINT modules
│ ├── domain_intel.py # Domain intelligence
│ ├── ip_intel.py # IP intelligence
│ ├── email_intel.py # Email intelligence
│ ├── web_scraper.py # Web scraping
│ └── social_media_intel.py # Social media intelligence
├── advanced/ # Advanced intelligence tools
│ ├── advanced_domain_intel.py
│ └── advanced_ip_intel.py
├── privacy/ # Privacy & anonymity utilities
│ ├── tor_proxy.py # Tor integration
│ ├── proxy_rotation.py # Proxy rotation
│ ├── request_obfuscation.py # Request obfuscation
│ ├── secure_credentials.py # Encrypted credential storage
│ ├── data_sanitization.py # PII detection/redaction
│ └── secure_logging.py # Audit logging
├── standalone/ # Multi-language standalone tools
│ ├── domain_recon.py # Python domain recon
│ ├── dns_leak_checker.py # DNS leak detection
│ ├── metadata_scrubber.py # Metadata removal
│ ├── secure_delete.py # Secure file deletion
│ ├── mac_randomizer.sh # MAC randomization
│ └── ... # Other standalone tools
├── tools-multiplatform/ # Multi-language implementations
│ ├── nodejs/ # Node.js tools
│ ├── c/ # C tools
│ ├── cpp/ # C++ tools
│ ├── dotnet/ # .NET tools
│ └── asm/ # Assembly tools
├── scripts/ # Installation scripts
├── osint_cli.py # Main CLI interface
├── osint_aggregator.py # Intelligence aggregator
└── config.py # Configuration
| Category | Status | Details |
|---|---|---|
| Core Python Tools | ✅ 100% | Fully functional |
| Privacy/Anonymity | ✅ 100% | Production ready |
| Standalone Scripts | ✅ 100% | All languages complete |
| Multi-Platform | ✅ 95% | Minor testing needed |
| Documentation | ✅ 100% | Comprehensive |
No placeholders. No TODOs. Production-grade code.
- OSINT community for techniques and inspiration
- Open source projects that made this possible
- Security researchers and testers
- Contributors and supporters
Maintainer: Lackadaisical Security
- Email: lackadaisicalresearch@pm.me
- XMPP+OTR: thelackadaisicalone@xmpp.jp
- Website: https://lackadaisical-security.com
- GitHub: https://github.com/Lackadaisical-Security
For security issues, see SECURITY.md.
This project is licensed under the MIT License - see the LICENSE file for details.
Built with technical excellence. Used with ethical responsibility.
Copyright © 2025-2026 Lackadaisical Security. All rights reserved.