XFTFSecurity For the Folks

Lesson 5.12

Curated Directories, Toolkits & Staying Current

Learning Objectives

  • Use the major OSINT tool directories to find a tool for a specific task
  • Name reliable books, newsletters, and communities for keeping skills current
  • Evaluate a new or unfamiliar OSINT tool for maintenance, data handling, OPSEC, legality, and cost
  • Build a personal, maintained bookmark kit instead of relying on memory

Why Directories Matter

OSINT tools appear and disappear constantly. Sites go offline, free tools go paid, APIs get closed (X/Twitter’s 2023 API changes broke many free tools), and companies get acquired or rebranded (Maxar Intelligence became Vantor in 2025). Any list of tools you memorize will be partly wrong within a year.

The durable skill is knowing where the maintained lists are and how to judge a tool before trusting it. This file covers both.

The Major Directories

OSINT Framework (osintframework.com)

  • What it is: A web-based, clickable tree of free OSINT tools and data sources, organized by investigation type (usernames, email addresses, domains, social networks, images, public records, and more).
  • Maintenance: Open source on GitHub (lockfale/OSINT-Framework), with about 11.8k stars, 1.9k forks, and issues being opened through mid-2026. It’s community-curated.
  • Best for: Beginners who know what they want to find but not which tool finds it.
  • Caveat: Some links in any big directory will be dead or changed. Check before relying on one.

Bellingcat’s Online Investigation Toolkit

  • What it is: A tool directory maintained by the investigative journalism group Bellingcat, hosted on GitBook with source on GitHub (bellingcat/toolkit).
  • Why it’s valuable: Each tool page explains what the tool does, cost, requirements, limitations, and ethical considerations, written by working investigators. It covers many tools referenced in this module (Google Earth Pro, Overpass Turbo, OpenStreetMap Search, OpenCorporates, Intelligence X, DeHashed).
  • Bonus: Bellingcat also publishes step-by-step guides and runs hackathons that produce new open-source tools (for example, the OpenStreetMap Search tool).

awesome-osint (GitHub: jivoi/awesome-osint)

  • What it is: A very large, community-maintained “awesome list” of OSINT tools and resources across categories (search engines, social media, threat intelligence, geospatial, and more).
  • Popularity: About 27.4k stars and 3.8k forks on GitHub.
  • Best for: Browsing a category deeply; contributors submit updates via pull requests.

Cyber Detective’s OSINT tool collection (GitHub: cipher387/osint_stuff_tool_collection)

  • What it is: A collection of 1,000+ online OSINT services organized by purpose, maintained since 2021. The same author maintains specialty lists such as awesome-overpass-turbo (Overpass Turbo learning materials).
  • Best for: Finding niche tools (court searches, grave searches, map tools).

OSINT Newsletter Tools Library (tools.osintnewsletter.com)

  • What it is: A searchable tool library with individual tool pages (e.g., Hudson Rock, Epieos, TinEye, IntelligenceX), plus a companion GitHub repository.

Other useful references

  • OSINTBench (osintbench.com): Tool reviews and guides, including a guide to OSINT newsletters (verify before class for how actively it’s maintained).
  • Trace Labs OSINT VM: A preconfigured virtual machine with OSINT tools, from the nonprofit that runs Search Party CTFs (verify before class for current version; see Module 8 OPSEC for research environments).

Books

OSINT Techniques: Resources for Uncovering Online Information — Michael Bazzell (IntelTechniques)

  • The most widely used OSINT reference book, formerly titled Open Source Intelligence Techniques.
  • The 11th edition (co-authored with Jason Edison) is the latest found as of this writing (verify before class in case a newer edition is out).
  • Bazzell spent over 20 years investigating computer crimes for the government, including time on the FBI’s Cyber Crimes Task Force. His books are used by government agencies as training manuals.
  • Recent editions emphasize self-reliance: building and hosting your own search tools and investigation environment locally rather than depending on third-party websites that may disappear.
  • His companion book Extreme Privacy covers the defensive side (links to Module 9).

Finding more books

  • The community-maintained ubikron/OSINT-Books list on GitHub tracks OSINT books.

Newsletters & Communities

Resource Format Notes
Week in OSINT by Sector035 (sector035.nl) Weekly newsletter, published Mondays Widely considered essential reading: new tools, technique updates, and community discussion
The Weekly OSINT Newsletter (osint-jobs Substack) Weekly newsletter with archive Tools, techniques, and OSINT jobs
OSINT Curious (osintcurio.us) Blog and videos The project has closed, but its articles and YouTube videos remain online and are still useful (e.g., its WiGLE Wi-Fi tracking guide)
Bellingcat (bellingcat.com) Guides and investigations Methods explained through real investigations
Flare Academy Free training, Discord community, Darkroom lab Dark web and threat intel focus (see Module 6)
Trace Labs Search Party CTFs and community Ethical OSINT practice for missing persons cases (strict rules)

Tip: Subscribe to one or two newsletters rather than ten. Consistent reading beats a pile of unread email.

How to Evaluate a New OSINT Tool

Before you use an unfamiliar tool, especially one you found on a list, ask these questions. Consider handing this checklist out as a worksheet.

1. Is it maintained?

  • When was it last updated? (Check the GitHub commit history, release dates, or the site’s changelog/blog.)
  • Are issues being answered, or are there hundreds of open bug reports?
  • Does it still work? APIs change, and many older tools fail silently.

2. Who runs it, and what happens to my data?

  • Is the operator identifiable (company, nonprofit, known researcher)?
  • Does the privacy policy say what they log and keep? Do they keep your search terms? Your uploaded images?
  • Where are they based, and which laws apply to them?
  • Rule of thumb: Every search you run is data you hand to the operator.

3. What are the OPSEC implications?

  • Does the tool touch the target directly (active) or only query third-party data (passive)?
  • Could the target be notified (e.g., password reset probes, profile views)?
  • Are your scans or submissions public (e.g., urlscan.io public scans)?
  • Does it require logging in with an account tied to your identity?
  • Does using it violate the Terms of Service of the sites it scrapes?
  • Does it rely on stolen or leaked data?
  • Is its use in scope for your engagement?

5. What does it cost, really?

  • Free, freemium, or paid? What are the free tier’s limits?
  • Does the free tier watermark or truncate results?
  • Is there an education or research program?

6. Can I verify its output?

  • Does it cite where each result came from?
  • Can you reproduce the finding manually? (If not, treat the result as a lead, not a fact.)

7. Is the software itself safe?

  • For downloadable tools: is the source code available? Is it from the official repository, not a lookalike fork?
  • Run new tools in a VM, not on your main machine.

Quick scoring template

Criterion Score (0–2) Notes
Maintained / working
Operator & data handling
OPSEC impact
Legal / ToS
Cost & limits
Verifiable output
Software safety
Total (out of 14)

Build Your Own Kit

  • Keep a personal bookmark collection organized by the source categories in this module (search, social, organization, code, infrastructure, archives, public records, data brokers, imagery, breach, news/academic, dark web intel).
  • Review it once per semester and remove dead links.
  • Note the date you last confirmed each tool worked.
  • Keep it inside your research environment (see Module 8), not your personal browser.

Key Terms

  • Awesome list: A community-curated GitHub list of resources on one topic.
  • Freemium: Free basic access with paid upgrades.
  • Changelog: A record of changes in each version of a tool.
  • Fork (GitHub): A copy of a repository; unofficial forks may be outdated or malicious.

Key Takeaways

  • Tools change constantly; knowing where maintained lists live matters more than memorizing tools
  • Start with OSINT Framework (what tool?) and Bellingcat’s Toolkit (how and with what caveats?)
  • awesome-osint and Cyber Detective’s collection cover deep and niche categories
  • Bazzell’s OSINT Techniques (11th ed.) is the standard reference book
  • Stay current with one or two newsletters (e.g., Sector035’s Week in OSINT)
  • Evaluate every tool: maintenance, data handling, OPSEC, legality, cost, verifiability, software safety
  • Every search you run hands data to the tool’s operator

References

Free to use, copy, change and teach. Security For the Folks dedicates this course to the public domain under CC0 1.0 Universal: no permission or credit needed. Quoted material and the sources it links to belong to their own authors.