H4X-Tools packs eighteen OSINT and recon modules into one terminal dispatcher

One entry point over a dozen separate tools

The pitch is a collection rather than a program. The README describes H4X-Tools as a modular, terminal-based toolkit for OSINT, reconnaissance and scraping, built in Python, running on Linux and Windows, and the repository asks for contributors to submit their own tools and improvements. The tree shows how it is assembled, with h4xtools.py at the root acting as the dispatcher, a tools/ directory for the individual modules, helper/ and utils/ for shared code, resources/ for data the tools need such as wordlists, and requirements.txt and the setup scripts alongside. The value proposition is that the alternative is installing a dozen separate projects, each with its own argument parser, its own output format and its own install step. Here they share a dispatch mechanism, a configuration file and a single export convention. The audience is a person doing investigations or reconnaissance from a terminal, and the screenshot in the README of a graphical front end suggests the tool is meant to be browsed rather than scripted blindly.

Installation is a clone and a setup script

Setup requires Python 3.10 or newer and Git, and the README points to the wiki for a step by step guide. On Linux the install is three commands:

git clone https://github.com/vil/h4x-tools.git
cd h4x-tools
sh setup.sh

Windows has the same shape with a batch file:

git clone https://github.com/vil/h4x-tools.git
cd h4x-tools
setup.bat

The setup scripts install all dependencies and create a virtual environment for the project. The README says that if you prefer to set up a virtual environment manually, which it recommends, there are three steps. You verify the interpreter version:

python --version
# or
python3 --version

then create the environment, using the standard library venv module, with python3 -m venv .venv on Unix and python -m venv .venv on Windows under PowerShell or cmd. The third step is activation, source .venv/bin/activate on Unix and the equivalent .venv/Scripts/activate on Windows. Doing it by hand costs three commands and gives you control over the interpreter, which matters on a machine where a system Python is already holding unrelated packages.

The OSINT modules lean on established libraries

Half the catalogue is lookups, and most of them delegate the hard part to a well known project. Web Reconnaissance is a multi-mode search built on the ddgs library, with seven modes including General for free form queries, Person with 12 dorks, Email with 8, Domain with 12 recon dorks, Username with 12 platform dorks, Phone Number with 8, and Custom Dork for writing your own template. Username Search is Maigret integrated directly, so you can configure site count, timeout, parallel connections and retries before scanning thousands of sites. Email Search is holehe, checking an address against more than a hundred websites and services for registrations. Phone Lookup validates a number with the phonenumbers library for country, region, carrier, line type and time zones, then runs ignorant to check social platform registrations. IP Lookup resolves a hostname and queries ipinfo.io for city, region, coordinates, ISP and timezone, with a direct OpenStreetMap link. WhoIs Lookup uses whoisdomain to show registrar, dates, name servers, status and registrant details. Every one of these is a query against data that is already public, and the tool is a convenience layer, not a source.

Leak Search reports on breaches, it does not harvest live credentials

The tool most likely to be misread is number seven, Leak Search, so it is worth being precise about what it does. It takes an email address, a domain or a username and queries the Hudson Rock Cavalier service for stealer log records, returning the date of compromise, the stealer family, infected machine details, masked credential samples and counts of corporate and user services hit. For email targets it cross-references the ProxyNova COMB dataset, described as holding more than 3.2 billion leaked credential lines, to give a total hit count, with a configurable inline entry limit. This is a breach notification lookup of the kind a security team runs against its own domain, not a mechanism for capturing credentials from a target. The distinction matters for how you use it: the answers describe what was already exposed elsewhere, and the tool is only as ethical as the target you point it at. Results export to scraped_data/ as TXT, CSV or JSON like the other modules.

The active side scans hosts and crawls sites

Three modules reach out and touch a target, and they need more care. The Port Scanner concurrently scans a user-defined TCP port range from 1 to N on any IP or hostname using a 50 thread pool, reporting open ports in real time. The Dir Buster asynchronously bruteforces directory and file paths on a target website using a built-in wordlist and prints every URL that returns HTTP 200. The Web Scrape module asynchronously harvests all hyperlinks from a target URL, including phone numbers and emails, and can optionally crawl every discovered page recursively. These are reconnaissance and enumeration functions, which is a legitimate category of security work, but they are also the fastest way to generate noise in someone else's logs, and the port scanner will happily be pointed at a network that is not yours. There is also an Ig Scrape module with two tracks. Guest mode, with no login, uses the ensta Guest API for public profile data and recent posts, while authenticated mode queries Instagram's private mobile API with a sessionid cookie for richer data including business flags, contact details, stories, highlights and reels, with optional recovery lookups and per-post comment fetching.

Several modules inspect the machine you are sitting at

A different group of tools looks inward rather than outward, and their portability varies by platform. The Wi-Fi Finder scans for nearby networks, using netsh on Windows and nmcli on Linux, reporting SSID, signal strength and security type, with the currently connected network highlighted. The Wi-Fi Vault dumps saved Wi-Fi passwords stored on the local machine through the same two tools. Local Users enumerates local accounts, and the README is explicit about the difference in what each platform gives back, with username, UID, GID, full name, home directory, shell and group on Linux, and username, terminal, host, session start time, PID, SID and domain on Windows. The Bluetooth Scanner reports device names and MAC addresses for nearby devices via bluetoothctl, and it is marked as Linux only with Windows support coming soon. The Fake Info Generator produces a complete fictional identity with Faker, covering name, job, company, email, phone, address, credit card, IBAN and location, which is a test data tool rather than anything else. The Git Scrape module analyses a repository or a GitHub account for leaked commit identities, secrets in diff history, sensitive tracked files and suspicious commit messages, with other platforms marked as coming soon.

Config file, exports and a proxy layer for every module

The plumbing is consistent across modules, which is the real argument for the collection. Outputs from most of the search and scrape modules land in a scraped_data/ directory as TXT, CSV or JSON, with Maigret results under scraped_data/maigret/. The Proxy Manager configures HTTP and SOCKS proxies to route the toolkit's network traffic, with optional round-robin rotation to avoid rate limiting, and those proxies are persisted in $HOME/.config/h4x-tools/config.json and picked up automatically by all compatible tools. The same config file is where the Instagram module can store a session ID if you choose to save one, and the CLI flags --session-id, --skip-obf and --comments-limit N exist for non-interactive runs so you can script the tool rather than answer prompts. The dependency list in requirements.txt shows the shape of the whole thing: colorama and requests for output and HTTP, ddgs for search, phonenumbers, whoisdomain, beautifulsoup4, httpx and aiohttp for the async work, faker, psutil, PySocks for proxying, and the four external OSINT projects maigret, holehe, ignorant and ensta, the last installed directly from its Git repository.

Editorial conclusion

H4X-Tools suits a security researcher, journalist or sysadmin who wants a single command line entry point over an OSINT stack that is otherwise a dozen separate installations, and who is working on infrastructure they are authorised to examine. It is a poor fit as a library, since it is a script collection with a shared config file rather than a supported API, and it is a poor fit for any use that touches third party accounts without permission, given that several modules query private endpoints or scan hosts. Verify first that you have written authorisation for the port scanner and the directory buster, check which modules are missing on your platform, since Bluetooth scanning is Linux only and the Git scraper is GitHub focused, and review the session cookie handling in the Instagram module before pointing it at an account.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. Project website
4. README
5. vil/H4X-Tools on GitHub