OSINT Bible is a maintained index, not a toolbox

A compilation with a taxonomy

The repository describes itself as a compilation of procedures, tools and ethics for open source research, and the project description puts a number on it, 450 plus tools, AI intelligence, methodologies and ethics across 35 sections for investigation and threat intelligence. The index in the README is longer than that description implies, running through numbered sections up to 47 plus appendices, and the difference is not important except as a reminder that a guide like this grows a section at a time. What matters is the shape of the index, because it is grouped into six families. Foundations covers the fundamentals, the methodology, the tools mind map, legal considerations and professional methodologies. Investigation Techniques covers search, social networks, geolocation and imagery, domain, IP and DNS, email and phone investigation, blockchain, transport, wardriving, content verification, username enumeration, web scraping, metadata extraction, network scanning, advanced Google dorks, people investigations and company research. Then there are sources and data, frameworks and automation, specialised topics, and a final group of 2026 additions.

The four step methodology is the spine

Section 2 of the guide is a four step methodology, and it is short enough to quote. Step one is to define the question, what do I want to know. Step two is to identify sources, using the table that follows. Step three is to collect, manually and with automations. Step four is to validate and document, with screenshots, a hash, a date, a URL and an archive.org copy. That last step is the one that distinguishes an investigation from an opinion, and the mention of hashing and archiving is a professional habit rather than a formality. Section 1 sets the vocabulary the rest of the guide assumes, defining OSINT as intelligence obtained from public sources without violating logical or physical access, OPSEC as minimising footprint, and the intelligence cycle as direction, collection, processing, analysis and dissemination. It also separates primary sources, the original tweet or official PDF or photo with EXIF, from secondary sources that cite them, which is a distinction the validation step depends on.

The tool table is the fastest way in

The methodology step two, identify sources, points at a table that maps a data type to where it usually lives and to one recommended tool. A name is usually found on LinkedIn or Facebook, and the tool is Maigret. An email address is usually found in data breaches or newsletters, and the tool is Have I Been Pwned. A phone number turns up on WhatsApp Business or TrueCaller, and the tool is Infobel. A username is found on forums, gaming services or GitHub, and the tool is Snoop. A photo is geolocated and its EXIF read with ExifTool. A domain comes from WHOIS and certificates with Amass. An IP address comes from scanning or Shodan, and a crypto wallet from blockchain explorers with BlockCypher. The mind map in section 3 draws the same structure visually, branching from OSINT into search, social networks, geo, domain and IP, deep and dark web, and automation, and then into the specific tools under each, with Recon-ng and SpiderFoot under automation.

graph TD
    A[OSINT] --> B(Search)
    A --> C(Social Networks)
    A --> D(Geo)
    A --> E(Domain/IP)
    A --> F(DeepDark)
    A --> G(Automate)
    B --> B1(Google Dorks)
    B --> B2(Useful Dorks)
    C --> C1(Twint-fork)
    C --> C2(Maigret)
    C --> C3(Instaloader)

Search techniques and alternative engines

The internet search section opens with twenty essential Google dorks, given as a table of objective, dork and example. Government PDFs are found with a site restricted pdf search, exposure material with an index of search for passwords files, IP camera interfaces with a viewer path in the URL, addresses on a company's domain through a LinkedIn site search, and subdomains with a wildcard site query. The alternative engines section then lists what each is good at, with DuckDuckGo bangs, Yandex for the CIS, Baidu for Asia, Startpage for no logs, Shodan for IoT, ICS and SCADA, Censys for certificates and banners, FOFA for China with a free API, and BinaryEdge. That last list is the most useful part of the section for anyone outside the anglophone internet, because the reason to use a non-Google index is usually that the content you want is not indexed well by the default engine.

Link health is the maintained artefact

The most telling detail in the repository is the link health badge, which reports 543 out of 729 links as ok, and the badge points at a file called audit/latest.md. A guide that lists hundreds of external tools dies the day those links rot, so the project treats link checking as a build step rather than an occasional favour. The repository top level shows the machinery: an audit/ directory for the link report, a lychee.toml configuration for the link checker, a scripts/ directory with a README describing command-line utilities, a requirements-dev.txt, a schema/ directory, a data/ directory, a docs/ directory and a countries/ directory. The link checker configuration and the audit report together are what make the guide maintainable, and the ratio on the badge is the honest state of the reference, which is exactly the information a reader needs to decide whether to follow a given link.

The ethics framing is part of the content

The guide opens with an ethical disclaimer, and it is not a formality line. It states that the repository is dedicated to the responsible and ethical practice of OSINT, that the information, tools and methodologies are intended solely for educational, research and lawful investigative purposes, and that users are strongly encouraged to adhere to ethical guidelines, respect privacy rights, comply with applicable laws and obtain necessary permissions before conducting any investigations. It adds that misuse for illegal activities, harassment or violation of privacy is strictly prohibited and may result in legal consequences, and that accessing the repository is an agreement to use the content responsibly. That framing is echoed in the structure, with a legal considerations section in the foundations group, an investigator OPSEC and sock puppets section, and a counter-OSINT self-audit section, which is the practice of applying the same collection techniques to your own footprint.

Companion projects and the shape of the ecosystem

The guide points to three companion projects by the same author, and they suggest where the reference is heading. osint-agent-skills is offered to operationalise the methodologies, Abster-Intelligence to investigate privately, and agentic-harness to automate auditable workflows. Each of those is a tool rather than a document, so the guide is the front door of a set of projects rather than a standalone artefact. The 2026 expansion sections show the same drift, with financial OSINT, investigator OPSEC, cloud storage and mobile app OSINT, decentralised social platforms, satellite imagery, deepfake detection, professional deliverables and regional techniques. The release history is empty, with no GitHub releases published, so the artefact to follow is the repository itself, which is not archived and was last pushed on 2026-10-16. The licence is GPL-3.0, and for a document that people copy sections out of, that licence is a reasonable choice.

Editorial conclusion

OSINT Bible fits a researcher or analyst who knows the vocabulary and needs a map of the tooling rather than a tutorial, since the sections are organised by data type and by technique, and the methodology section and the tool tables are the parts worth reading first. It does not fit someone who needs a step by step manual for a specific technique, since the reference is an index rather than a course, and it does not fit a workflow that depends on a specific tool, because the links are audited for reachability rather than for behaviour. Before you rely on it, read the ethics disclaimer and the legal considerations section, because the project states plainly that the content is for lawful research and that misuse may carry legal consequences, and check the link audit report before you follow a reference, since the badge shows a substantial share of links are not working.

Frequently asked questions

Official sources

1. frangelbarrera/OSINT-BIBLE on GitHub
2. Issues
3. License: GPL-3.0
4. README