Website OSINT

All in one - Tool

OSINT.SHsecgron

down

Digital Certs

We can use these to reverse search a certificate to find related websites/ Subdomains

crt.sh | Certificate Search

Entrust Certificate Search - Entrust, Inc.

SSL Server Test (Powered by Qualys SSL Labs)

Local Certificates downloading and analysing tools

GitHub - g0ldencybersec/CloudReconGitHub

sni-ip-ranges • Directory Listerkaeferjaeger.gay

Certs at cloud IPs downloaded weekly

Internet Search Engines

Gives information about websites without scanning

Censys SearchCensys

ShodanShodan

Shodan Based Tools

GitHub - s0md3v/Smap: a drop-in replacement for Nmap powered by shodan.ioGitHub

passive Nmap like scanner built with shodan.io

GitHub - Dheerajmadhukar/karma_v2: ⡷⠂𝚔𝚊𝚛𝚖𝚊 𝚟𝟸⠐⢾ is a Passive Open Source Intelligence (OSINT) Automated Reconnaissance (framework)GitHub

Uses Inbuilt Shodan querries to find information about a domain

Finding Web Technology

Find out what websites are built with - Wappalyzer

https://builtwith.com/builtwith.com

https://osint.sh/stack/osint.sh

whatweb | Kali Linux ToolsKali Linux

Finding Load Balancer

lbd | Kali Linux ToolsKali Linux

WHOIS /ASN Information Checker

Whois Lookup, Domain Availability & IP Search - DomainTools

WHOIS Search, Domain Name, Website, and IP Tools - Who.is

Whois.com - Free Whois Lookup

whois | Kali Linux ToolsKali Linux

Reverse Whois

https://viewdns.info/reversewhois/viewdns.info

https://whoisfreaks.com/tools/user/whois/reverse/searchwhoisfreaks.com

Reverse Whois Lookup - Domain search based on email or name

Reverse Whoissecgron

Historical Whois

https://whoisfreaks.com/tools/user/whois/history/lookupwhoisfreaks.com

WHOIS History API | Domain WHOIS History | Free WHOIS Historywww.whoxy.com

https://research.domaintools.com/research/whois-history/research.domaintools.com

WHOIS History | Check domain history ownership | WhoisXML API

Find Similar domain with keyword to check whois

https://osint.sh/domain/osint.sh

Domain Name Search - Find Available Domains InstantlyInstant Domain Search

Domain Name Search | Check Domain Availability OnlineDNS Checker

https://search.dnslytics.com/search.dnslytics.com

Security Headers

Analyse your HTTP response headerssecurityheaders

Malware/ Security Check

VirusTotalVirusTotal

URL and website scanner - urlscan.io

BrowserLeaks - Web Browser Fingerprinting - Browsing PrivacyBrowserLeaks

Find ASN Numbers

https://bgp.he.net/bgp.he.net

Can be helpful to locate more Websites

AS18053 Special Communication Organization details - IPinfo.ioipinfo

Website Information Aggregators

All in one tools for Website OSINT

Web Check

Domain Dossier - Investigate domains and IP addresses, get owner and registrar information, see whois and DNS recordscentralops.net

What's that site running?What's that site running? | Netcraft

https://viewdns.info/viewdns.info

Kali Tools

spiderfoot | Kali Linux ToolsKali Linux