awesome-osint-arsenal

What it is

rawfilejson/awesome-osint-arsenal (v2.1, badge dated 2026-05-10) is a single-maintainer link list that doubles as an installer bundle. Its 50 sections run from OSINT through red team, blue team, DFIR and hardware. A further 500+ entries sit in a Georgian-language section. The "753+" figure is the README's own badge count.

How it works

Each installer detects the package manager and installs what it can. Per the README, it:

• is idempotent and safe to re-run;
• skips apt-only tools on Arch and Fedora;
• falls back to git, pip or go where needed;
• clones git-based tools into /opt/osint-arsenal/ ($HOME/osint-arsenal/ on Termux);
• logs failures to ~/osint-install-errors.log.

Tools in /opt/osint-arsenal are not on $PATH until you add them:

echo 'export PATH="$PATH:/opt/osint-arsenal"' >> ~/.bashrc

Preconditions / Affected

• Apt-based Linux (Kali, Debian, Ubuntu, Parrot) is the supported target. macOS and Windows are marked unsupported (use a Kali VM or WSL2).
• Every installer except termux.sh is run as sudo bash. The one-liner is:

git clone https://github.com/rawfilejson/awesome-osint-arsenal && cd awesome-osint-arsenal && sudo bash install.sh

• redteam.sh pulls offensive tooling (the README names Sliver, Mimikatz, Impacket and NetExec). The full list is in the repo, not on the page I saw.

What to do

• Don't run install.sh as root on a workstation you care about. I didn't see the script contents. It fetches many third-party repos, including Mimikatz, LaZagne, Responder and the AhMyth Android RAT. Read it first, then run it in a disposable Kali VM or container.
• Prefer the narrow stack scripts (osint.sh, blueteam.sh, forensics.sh) over install.sh if you only need one area.
• Use it as a discovery index, not an authority. Install commands are given inline (e.g. pip install sherlock-project, pip install maigret, pip install h8mail). Check each package name against the upstream project before installing.
• For subdomain recon, the page's chain is:

subfinder -d example.com -o subs.txt
amass enum -d example.com -o amass_subs.txt
cat subs.txt amass_subs.txt | sort -u > all_subs.txt
cat all_subs.txt | httpx -status-code -title -o live_subs.txt
cat live_subs.txt | eyewitness --web -d screenshots/

The eyewitness step isn't covered by the OSINT stack list on the page I saw, so install it separately. Only run this against scopes you're authorized to test.

Caveats

• The page says it may go stale: the maintainer asks for help keeping links and install commands current, and solicits stars and donations. Expect dead links.
• I only saw the first 60,000 of about 204,000 characters, ending mid-way through the Termux section. The installer scripts, the red/blue team sections and the Georgian section were not visible.
• The README disclaimer says "authorized research only". The page includes material that goes beyond defensive use:
• phishing kits (Zphisher, Evilginx2);
• IP-logger links with a VK-redirect trick to mask the logger URL;
• Telegram people-lookup bots;
• Google dorks for exposed credentials and cameras.

Treat the authorization language as boilerplate, not a control.