Research path

Discovery

A focused view of OSINT4ALL tool profiles mapped to this investigation path.

75 mapped profiles No pay-to-rank ordering

How to use this path

  • Start broad here, then narrow in the directory filters.
  • Open profiles for limits, pricing, and verification notes.
  • Use collections when you need a workflow stack, not one tool.

Tool profile

Netlas.io

Internet asset and attack-surface search

WorkflowDiscovery AccessFreemium
Editorial
Open profile
FOFA official-page screenshot

Official-page screenshot

FOFA

Source checked 2026-05-07

Cyberspace asset mapping and search

Verification: Verification status not listed Workflow: Discovery Pricing: Freemium

Best for: Use it when a scoped technical clue needs another asset-search dataset, especially for product or service fingerprinting.

Editorial

Tool profile

FOFA

Cyberspace asset mapping and search

WorkflowDiscovery AccessFreemium
Editorial
Open profile
Namechk official-page screenshot

Official-page screenshot

Namechk

Source checked 2026-05-07

Username and domain availability checker for quick handle triage

Verification: Pending Verification Workflow: Discovery Pricing: Free

Best for: Checking whether a username, brand string, or domain idea appears available across common social platforms and domain extensions.

Editorial

Tool profile

Namechk

Username and domain availability checker for quick handle triage

WorkflowDiscovery AccessFree
Editorial
Open profile
DNSDumpster official-page screenshot

Official-page screenshot

DNSDumpster

Source checked 2026-05-07

Passive DNS and subdomain reconnaissance

Verification: Verification status not listed Workflow: Discovery, Pivoting Pricing: Freemium

Best for: Use it when a domain is already in scope and the next job is quick passive mapping before…

Editorial

Tool profile

DNSDumpster

Passive DNS and subdomain reconnaissance

WorkflowDiscovery, Pivoting AccessFreemium
Editorial
Open profile
OSINT Framework official-page screenshot

Official-page screenshot

OSINT Framework

Source checked 2026-05-07

Reference index for OSINT tool categories and discovery paths

Verification: Pending Verification Workflow: Discovery Pricing: Free

Best for: Finding OSINT tool categories and candidate resources during early workflow planning or training.

Editorial

Tool profile

OSINT Framework

Reference index for OSINT tool categories and discovery paths

WorkflowDiscovery AccessFree
Editorial
Open profile
Nmap official-page screenshot

Official-page screenshot

Nmap Project

Source checked 2026-05-07

Open-source network mapper for authorized exposure and service discovery

Verification: Pending Verification Workflow: Discovery, Verification Pricing: Free

Best for: Authorized network inventory, service discovery, exposure validation, and defensive technical assessment.

Editorial

Tool profile

Nmap

Open-source network mapper for authorized exposure and service discovery

WorkflowDiscovery, Verification AccessFree
Editorial
Open profile

Tool profile

theHarvester

Open-source passive reconnaissance for domains, subdomains, hosts, and emails

WorkflowDiscovery, Enrichment AccessFree
Editorial
Open profile

Tool profile

OpenSecrets

U.S. campaign finance and lobbying research database

WorkflowDiscovery, Mapping AccessFree
Editorial
Open profile

Tool profile

GHunt

Open-source Google account OSINT lead-generation tool

WorkflowDiscovery, Enrichment AccessFree
Editorial
Open profile

Tool profile

Sherlock

Open-source username discovery across public services

WorkflowDiscovery, Pivoting AccessFree
Editorial
Open profile

Tool profile

Maigret

Open-source username search with broad site coverage and reports

WorkflowDiscovery, Pivoting AccessFree
Editorial
Open profile

Tool profile

FOCA

Open-source document metadata analysis for OSINT and exposure review

WorkflowDiscovery, Enrichment AccessFree
Editorial
Open profile
LittleSis official-page screenshot

Official-page screenshot

LittleSis

Source checked 2026-05-27

Public influence and relationship mapping

Verification: Pending Verification Workflow: Discovery, Mapping Pricing: Free

Best for: Mapping public relationships among people, companies, nonprofits, donors, officials, and organizations during influence research.

Editorial

Tool profile

LittleSis

Public influence and relationship mapping

WorkflowDiscovery, Mapping AccessFree
Editorial
Open profile

Tool profile

Holehe

Open-source email registration checker for public account-signal triage

WorkflowDiscovery, Enrichment AccessFree
Editorial
Open profile

Tool profile

Recon-ng

Open-source modular reconnaissance framework for technical OSINT

WorkflowDiscovery, Enrichment AccessFree
Editorial
Open profile

Tool profile

WhatsMyName

Open-source username discovery

WorkflowDiscovery AccessFree
Editorial
Open profile
Advanced Search Operators Workflow official-page screenshot

Official-page screenshot

OSINT4ALL Editorial

Source checked 2026-05-27

Search operator playbook for precise web discovery

Verification: Verification status not listed Workflow: Discovery Pricing: Free

Best for: Precise public-web discovery using exact phrases, site/domain searches, file-type searches, exclusions, and advanced-search fields.

Editorial

Tool profile

Advanced Search Operators Workflow

Search operator playbook for precise web discovery

WorkflowDiscovery AccessFree
Editorial
Open profile

Tool profile

Aleph

Document-led investigative research across public datasets

WorkflowDiscovery AccessFree
Editorial
Open profile