World Monitor: A Live Global Intelligence Dashboard (GitHub, Scanned)
A live dashboard of world news, conflict, markets and infrastructure on a 3D globe or flat map.
Scanned 7 min read
Loading…
/** @github-tools */
Best OSINT & Recon Tools on GitHub
20 repos, each cloned and scanned
// all 20 in OSINT & Recon
Web Check: See Everything a Website Exposes, in One Report (GitHub, Scanned)
Run around 50 checks on a website at once: DNS, TLS, headers, ports, trackers and more.
Scanned 5 min read
Awesome OSINT: The Big Map of Open-Source Research Tools (GitHub, Scanned)
A curated index of about 1,400 open-source intelligence tools and resources in 75 sections.
Scanned 4 min read
ArchiveBox: Your Own Self-Hosted Wayback Machine (GitHub, Scanned)
Save web pages, videos and feeds to your own archive as HTML, PDF, screenshots and WARC files.
Scanned 4 min read
katana: Crawl a Web App for Every Endpoint (GitHub, Scanned)
ProjectDiscovery's web crawler, with a headless browser mode that finds endpoints JavaScript hides.
Scanned 5 min read
OWASP Amass: Map an Organisation's Attack Surface (GitHub, Scanned)
OWASP's framework for mapping the domains, networks and certificates an organisation exposes online.
Scanned 4 min read
subfinder: Find a Domain's Subdomains Passively (GitHub, Scanned)
ProjectDiscovery's fast passive subdomain finder, querying more than 50 public and keyed sources at once.
Scanned 4 min read
httpx: See Which Hosts Run a Website, and What (GitHub, Scanned)
ProjectDiscovery's HTTP prober: feed it hostnames and get status, title, tech stack and TLS details.
Scanned 4 min read
OpenCTI: Organise Threat Intelligence as a Knowledge Graph (GitHub, Scanned)
A self-hosted platform that stores threat intel as linked STIX 2 data: actors, malware, reports, indicators.
Scanned 6 min read
Maltrail: Spot Malware Traffic on Your Own Network (GitHub, Scanned)
A network sensor that flags traffic to known malicious domains, IPs and URLs, using public threat feeds.
Scanned 6 min read
MISP: Share Threat Indicators With Trusted Partners (GitHub, Scanned)
The open threat intelligence sharing platform: store, correlate and sync indicators across organisations.
Scanned 5 min read
capa: See What a Suspicious Executable Can Do, Without Running It (GitHub, Scanned)
Point it at a suspicious program and get a plain list of what it can do, mapped to ATT&CK.
Scanned 5 min read
ExifTool: Read, Edit and Strip Metadata in Almost Any File (GitHub, Scanned)
The standard tool for reading, writing and removing metadata in photos, videos, PDFs and more.
Scanned 4 min read
gau: Pull Every Archived URL for a Domain (GitHub, Scanned)
Lists every URL the Wayback Machine, Common Crawl, OTX and URLScan have seen for a domain.
Scanned 5 min read
gowitness: Screenshot Every Website on a List (GitHub, Scanned)
Feed it URLs, IP ranges or Nmap results and get a screenshot gallery of every web page that answers.
Scanned 5 min read
Sherloq: Check a Photo for Edits and Hidden Metadata (GitHub, Scanned)
A desktop toolkit of image forensics methods: error level analysis, noise maps, clone detection, EXIF.
Scanned 4 min read
uncover: Find Your Internet-Exposed Hosts Across Shodan, Censys and More (GitHub, Scanned)
One command that asks Shodan, Censys, FOFA and a dozen other scan indexes what they see.
Scanned 5 min read
DNSRecon: Audit a Domain's DNS Records (GitHub, Scanned)
A Python tool that lists a domain's DNS records and checks for zone transfer and wildcard misconfigurations.
Scanned 4 min read
dnsx: Fast Bulk DNS Lookups for Your Own Domains (GitHub, Scanned)
Resolve thousands of hostnames at once, pull every record type, and filter out wildcard DNS.
Scanned 4 min read
Mitaka: Look Up Any IP, Domain or Hash from a Right-Click (GitHub, Scanned)
A browser extension that sends any selected IP, domain, URL or hash to 65+ threat-intel services.
Scanned 5 min read
// How we scan
Before a repository gets a post here we clone it and run the same checks on every one. The scanner is a script in this site's own repository, its findings are written out with file and line, and a person reads every hit before writing the verdict in the post. The last full run was on Oct 28, 2026.
- Pinned commit
- A fresh clone of the default branch. The commit and date are on every report, so the findings are about one snapshot, not the repository in general.
- Secrets
- Credential patterns with a known shape: cloud access keys, API tokens for OpenAI, Anthropic, Slack, GitHub, Google and Stripe, chat webhooks, private key blocks.
- Suspicious code
- Code that decodes a string and then executes it, pipes a download straight into a shell, opens a raw socket to a shell, reaches a known exfiltration service, mines cryptocurrency, or looks packed.
- Install-time code
- npm lifecycle scripts, setup.py command classes, Cargo build scripts, and installer shell scripts: whether they use sudo, edit your shell profile, or fetch and run remote code.
- Committed binaries
- Executables and compiled objects identified by their bytes, not their file extension, so a renamed binary still shows up.
- CI workflows
- GitHub Actions that run on pull_request_target and check out the pull request head (a classic way to leak secrets), write-all permissions, and third-party actions pinned to a tag instead of a commit.
- Network hosts
- Every host the source code talks to, so an unexpected one stands out.
- Known vulnerabilities
- Every pinned dependency in the repository's lockfiles looked up in OSV.dev, counted by severity. Includes development dependencies, which is why the counts are not zero for a large web app.
- Project hygiene
- A security policy, automated dependency updates, CodeQL, a licence, contributing guidelines.
- OpenSSF Scorecard
- The Open Source Security Foundation's independent score, where the project has one.
Safe means no credential patterns, no decode-and-execute code, no exfiltration hosts, no undocumented install-time behaviour, no risky workflow, and nothing in the findings a reviewer could not explain. Anything you should know before installing (an installer that pipes to a shell, a tool that reads a credential you already have, a licence with conditions, or a lockfile with unpatched advisories) is the note beside the badge.
Not covered: we do not run the software, audit its logic, or review commits made after the scan. The date and commit are on every report. Check them, and read the code yourself before you trust it with anything that matters.
// Questions
- Are these GitHub AI tools free to use?
- All of them are free to download, run and modify. The licences differ: most are MIT or Apache 2.0, ComfyUI is GPL-3.0, and Open WebUI and Dify ship their own licences with conditions on rebranding and multi-tenant hosting. Each post says which licence applies and what it asks of you.
- What does it mean that a repository was scanned?
- We cloned it at a specific commit and ran the checks listed under How we scan: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. Every hit was read by a person before the verdict was written, and the findings are in each post.
- Why do known vulnerabilities show up in a scan marked safe?
- Because a lockfile pins development dependencies too. A large web app carries thousands of packages and OSV knows of advisories in some of them; most affect build tooling and never reach a user. Each post shows the counts per lockfile and the worst entries so you can see where they sit, and the notes say whether any of it ships to you.
- How current is a scan?
- The date and commit are printed in every post. Active projects merge dozens of commits a week, so treat a report as a snapshot of that commit, not a standing guarantee, and re-check the repository before installing anything on a machine you care about.
- Which of these should I start with?
- To run a model on your own computer, install Ollama and add Open WebUI for a chat interface. For images and video, ComfyUI. To build an app or agent without much code, Dify. To let an agent write code or use a browser, OpenHands, Codex or browser-use. If you already use Claude Code or Codex, cost-xray shows what each session actually costs.