Reference · Third-party tools

OSINT Rig

Three OSINT tools, installed and put through their paces. Notes on what each one actually does.

PythonuvTorCLImacOS

What this is

Not my software. These are three open-source tools by other people, found via a reel that named none of them and gated the links behind a comment-for-DM prompt. I identified them from the terminal frames, installed all three, and ran them. This page is the reference I wanted and didn't get: real repo links, install commands that work, and an honest account of which claims survive contact.

Everything lives in ~/tools/osint/, each in its own uv venv pinned to Python 3.12. Python 3.14 breaks several dependencies.

Authorised use only
These tools query live third-party services and aggregate personal data. Run them against your own accounts and infrastructure, or under an engagement that explicitly permits it. Every result below came from testing against my own email and a public onion service.

MailAccess

Works · recommended
github.com/KatrielMoses/MailAccess
Python · 64 modules · 2500+ platforms · no API keys needed for the core run

One email address in, a structured identity report out. It fans out across breach corpora, social platforms, DNS, git commit metadata and the open web, then clusters the hits into candidate identities with an explicit confidence band on each.

Install

# greenlet is a missing dependency in 0.14.3 - install it explicitly
pip install mailaccess greenlet

mailaccess investigate you@example.com
mailaccess investigate you@example.com -o report.pdf

What testing found

TorBot

Works as advertised
github.com/DedSecInside/TorBot
Python · OWASP project · needs a local Tor SOCKS5 proxy

Start at one onion address and crawl outward. Returns a searchable tree of every linked site with page titles, HTTP status, a rough category, and any emails or phone numbers scraped along the way. The point is that you read a file afterwards instead of clicking through anything yourself.

Install and run

git clone --depth 1 https://github.com/DedSecInside/TorBot.git
cd TorBot && uv venv .venv --python 3.12
uv pip install --python .venv/bin/python -r requirements.txt
uv pip install --python .venv/bin/python -e .

# Tor must be listening on 9050 first
brew install tor
/opt/homebrew/opt/tor/bin/tor --SocksPort 9050 --DataDirectory ~/tools/osint/tor-data

.venv/bin/python main.py -u <onion-url> --depth 1 --visualize table
.venv/bin/python main.py -u <onion-url> --depth 2 --save json

What testing found

horus

Mostly menu text
github.com/6abd/horus
Python · GPL-3.0 · every OSINT module is API-key-gated

Sold as twenty investigation lookups in one terminal program: phone numbers, Wi-Fi geolocation, crypto wallet tracing, Sherlock. The program runs. Almost none of that is reachable without paying for it first, and some of it does not exist at all.

Install

git clone --depth 1 https://github.com/6abd/horus.git
cd horus && uv venv .venv --python 3.12
uv pip install --python .venv/bin/python -r requirements.txt

# must be run from the horus dir - it reads api_config.json by relative path
.venv/bin/python horus.py -numlook

What testing found

If you want what horus claims to do
MailAccess already covers the username pivot natively across Maigret, Sherlock, Nexfil, Blackbird and WhatsMyName, without keys. That is the same ground, actually implemented.

The short version

01
MailAccess - install it
Genuinely good, genuinely keyless, one missing dependency away from working out of the box. Add greenlet and read the confidence bands rather than the platform count.
02
TorBot - install it if you need onion crawling
Does exactly what it says. Budget your setup time for the Tor daemon, not the tool.
03
horus - skip it
Every advertised feature is either behind a paid API key or not wired up at all. The headline Sherlock integration is a line of help text.

All three were presented as equivalent. One is a solid tool with a packaging bug, one does what it says, and one is a menu.