Skip to content

Back to the catalog

lockfale/OSINT-Framework
github.comrepo

lockfale/OSINT-Framework

OSINT Framework is a curated, categorized index of free (mostly) open-source intelligence tools and resources, organized by data type (username, domain, IP, email, social media, etc.) and rendered as an interactive tree at osintframework.com. Each entry in the underlying arf.json is tagged with metadata like whether it requires local install (T), a Google dork (D), registration (R), or manual URL editing (M), plus richer fields such as input/output type, pricing, and opsec notes. It's a long-standing community reference for recon and investigation tradecraft across infosec and other fields.

TL;DR A categorized, community-maintained map of free OSINT tools and resources for recon and investigations.
Open original ↗
Document

What it is

OSINT Framework (lockfale/OSINT-Framework) is a repository whose data file, arf.json, feeds the tree at osintframework.com. The page is mostly a contribution guide. It says what a new entry must look like and what the maintainer accepts.

What to do

To add a tool, edit arf.json and put the entry in the matching category folder. Only name, type and url are required. The page strongly encourages the metadata fields. The entry format it gives:

{
  "name": "Example Name (T)",
  "type": "url",
  "url": "https://example.com",
  "description": "Brief description of what the tool does and its key capabilities.",
  "status": "live",
  "pricing": "free",
  "bestFor": "Primary use case in one sentence",
  "input": "What the tool accepts (e.g., Username, Domain, IP address)",
  "output": "What the tool returns (e.g., Profile matches, DNS records)",
  "opsec": "passive",
  "opsecNote": "Any operational security considerations for using this tool.",
  "localInstall": true,
  "googleDork": false,
  "registration": false,
  "editUrl": false,
  "api": false,
  "invitationOnly": false,
  "deprecated": false
}

Append the matching marker to the name when it applies: (T) for local install, (D) for Google dork, (R) for registration, (M) for a URL you must edit by hand. Set the corresponding boolean to true as well. Then submit a pull request. The page also accepts issues and suggestions through the maintainer's Twitter account.

Preconditions

A new resource must be available for public and free use. Sites that need registration or sell extra data for money are acceptable if at least part of the data is free. The maintainer wrote the framework from an infosec viewpoint and asks for resources from other fields too.

Caveats

The page gives only one example value for opsec ("passive"). It does not list other allowed values, or allowed values for status and pricing. It also does not describe review criteria beyond "public and free".

Technologies named here

Related in OSINT