New tools constantly appear, and old ones are getting deprecated. More and more tools are having issues, and developers fail to fix errors on time. It's hard to keep up with what's current. It's impossible to rely on the same tool thinking it will keep working forever. That's why OSINT researchers always monitor the latest updates and keep backup tools in case something breaks.

This article will teach you to search for the best tools, organise them, and seamlessly find the replacement. All for free, because that's how people prefer it to be.

Where to find?

Tools are scattered around the Internet and finding them requires OSINT skills. To point you in the right direction I have listed the most popular places to look for.

OSINT Framework

I had to mention it first because it's the most famous and established toolkit. Developed by Justin Nordine more than 8 years ago it created a huge buzz! However, it's no longer properly maintained. Today, Malfrat's OSINT Map is usually referred to as the successor of the legendary framework.

StartMe

StartMe is used by various professionals to organise OSINT tools. Many creators leave their pages publicly accessible. That opens an opportunity to scavenge across hundreds of collections. You can leverage the platform's search capabilities:

Searching across the website using Google Dorks is efficient as well. Modify the following query to your preference: site:start.me "OSINT".

StartMe team has a gallery of OSINT pages. You can submit your page and get more visits by following their Page Gallery tutorial.

• AML Toolbox – resources for combating financial crime by Travis Birch.
• Paranoid_ch1ck – a great collection of OSINT resources, organised in subcategories. Her collection is focused on Cyber Threat Intelligence (CTI).
• Nordic Cyber Security – an impressive collection of resources organised in pages. Created by NSO.
• BBC Eye Forensics – essential tools tailored to journalists using open source intelligence (OSINT) to carry out investigations on the African continent.

Search engines

Don't limit yourself to Google, try different search engines for diverse results. Create Google Alerts to automatically receive notifications when new OSINT tools come out. I like to search for tools and read the tutorial straight away to see if it's any good: site:medium.com "username" "enumeration" tool.

It's even easier to subscribe to the The OSINT Newsletter and receive updates directly in your inbox. Additionally, Cyber Detective regularly posts notes with tools on Substack and X.com.

Personal Websites

Not all OSINT professionals have a personal website. Even if they do, not all of them keep OSINT tools. But when they do it's a goldmine! Those resources are usually carefully selected and trusted by the person who has put them together. Links on personal websites are more vetted, so you can usually trust what you click on.

• Research Clinic – Paul Myers has put together links for the research and investigation purposes. It's a good reference for investigative journalists.
• UK-OSINT – links & techniques for online investigators & researchers. Has a lot of UK-specific resources.
• Aware Online – a collection of tools as well as custom scripts to do OSINT search straight on the website.
• OSINT Essentials – a small selection of good tools from investigative journalist Eoghan Sweeney.
• OSINT Dojo – a collection of tools and learning resources put together by Sinwindie.

OSINT Subreddit

Redditors love tools! The 5th most popular post of all time is called "Possibly Largest Osint List". It was posted only a year ago. Apart from that people are asking for help with tools every other day.

The question you have has probably been answered. Take a minute to find it properly. Haven't found it? Ask and you shall receive. r/OSINT is a great place to come for advice when you are stuck in your search.

GitHub

GitHub is where creators develop and maintain their tools. Try searching right on Github, as its native search has many advantages. You can sort by the amount of stars and forks to find the most popular projects. Advanced search allows you to filter by programming languages and many other useful parameters.

• MetaOSINT –  thousands of resources sourced from the most popular tool collections. Ability to switch between an interactive visualisation and the table view.
• Cyber Detective's tools – 1000+ tools are divided into different sections. One of the most popular and contributed-to tools collection of tools.
• Awesome OSINT – the most popular OSINT tool collection on Github with more than 150 contributors. This intelligence tools collection is suitable for various purposes.
• Awesome Hacker Search Engines – curated list of search engines useful during pentesting, vulnerability assessments, Red/Blue Team operations, bug Bounty and more.
• Awesome On-Chain Investigations HandBook – a comprehensive collection for investigating crypto hacks and security incidents. Created by OfficerCIA, an experienced Threat Researcher.

To find an alternative tool open GitHub, or any other collection (including StartMe and Google Sheets). Activate browser search using Ctrl + F and type in the name of the deprecated tool. Once you find the relevant category research all the other tools to find what's suitable for you.

How to manage?

You have to organise tools to easily find later and conveniently use in your working environment. I particularly like this quote from OH SHINT!, it puts a smile on my face:

This is my list. There are many like it, but this one is mine. My list is my best friend. It is my life. I must master it as I must master my life. Without me, my list is useless. Without my list, I am useless.

Google Sheets

Google Sheets is a great place to store and manage tools in a collaborative environment. Bellingcat store their toolkit in a spreadsheet, which allows team members to seamlessly collaborate in one file. I think they chose this method because they needed a low-friction option that would allow quick edits.

• Bellingcat’s investigation toolkit – this online open-source investigation toolkit includes guidance on satellite and mapping services, tools for verifying photos and videos, websites to archive web pages, and much more.
• AaronCTI's OSINT Resource Collection – a collection for Cyber Threat Intelligence. Tools have descriptions and use cases, which is useful for someone exploring new tools. A good library of training and learning resources.
• Set it on 🔥 child – Various OSINT tools and detailed investigation workflows. OSINT tools are nicely categorised and rated.

StartMe pages

Start.me has got very popular in the OSINT community. So popular people started doing StartMe of StartMe pages. The problem with StartMe pages is once the list becomes huge it is hard to find that one tool you need. As a workaround you can navigate thorough the page using Ctrl + F.

By default, your Start.me page is private and only accessible to you. You can also share your page, so other people can access or edit it. Read more about sharing your page on their support website.

With PRO account you get the broken link checker. All your links are then scanned automatically and it removes the tedious task of doing it yourself. "It’s easy to manage all my bookmarks and links. This is so crucial for OSINT" – Lorand Bodo talks about start.me.

• The Ultimate OSINT Collection – probably the most famous OSINT collection put together by Griffin Glynn. It contains a lot of of learning resources and links to the best tool collections.
• Nixintel's OSINT Resource List – collection from OSINT & Cyber Security Specialist Steven Harris. The page managed to get the biggest audience in 2022.
• Technisette Tools – a collection of tools, search engines and tutorials put together by Technisette. It won the title of one of the most followed start.me pages.

GitHub

GitHub is popular with developers and highly-technical people. You might face some friction if you didn't use version control systems before. GitHub allows you build GitBook pages which is a good option to document your tools.

• OH SHINT! – a collection of tools, techniques and tips that conveniently formatted and categorised.
• A.R.P. SYNDICATE – curated collection of cybersecurity resources. Can be searched by region and tag (tool category).

Personal website

Putting your tool on a self-hosted website requires technical skills. It's the hardest, but the most flexible option. You can organise your tools the way you like. Even put them on the map, as Cyber Detective did:

A personal website is also a good way to promote your own tools. OSINT-FR has a hand-picked tool collection and marks tools from their community. Your website doesn't have to be complicated. The main objective is the ability for people to easily find tools. The website can be powered by static state generator and have a simple template. For example, check this Offensive Security Cheatsheet built by Haax. Nothing fancy, but it beautifully does the job.

Browser bookmarks

I keep my tools bookmarked in the browser. It makes them easy to access right in my working environment. The ability to open all bookmarks in the folder in one click streamlines my workflow. Whenever I see a useful resource I just drag it right in the folder where it has to be.

I can't share and collaborate with others on my list. But I don't have to. This is my personal framework of favourite and tested tools. Recently I stumbled upon a video from Gary Rudell. Watching it I understood I'm using my framework the right way.

I haven't seen anyone sharing their bookmarks except for OSINT Combine. They have a section with resources where you can download two stacks: OSINT and DarkWeb.

Conclusion

The way you manage and search for tools depends on your personal preference. How you keep your tools will be affected by your working environment. Every approach has pros and cons, but having all your tools in one place simplifies the workflow. You have explored different strategies and ready to pick the one that works for you.

I will write more on this topic in the future. I need to research more on how people organise and use their tools to come back with new insights. Subscribe using the form below and get my insights right in your inbox.