sn0int (pronounced /snoɪnt/) is a semi-automatic OSINT framework and package manager written in Rust that helps IT security professionals, bug bounty hunters, law enforcement agencies, and security awareness trainers gather intelligence about a given target or about themselves.

What it is

sn0int lives in the Rust ecosystem as a crate published to crates.io, and in the reconnaissance and OSINT tooling space alongside recon-ng and maltego, which the README names as its inspiration while describing sn0int as more flexible and fully open source. It enumerates attack surface by semi-automatically processing public information and mapping the results into a unified format for follow-up investigations. It is two things at once: an investigation framework and a package manager for the modules that framework runs.

The concrete problem it solves is where investigation logic lives. None of the investigations sn0int performs are hardcoded in the source; instead they are provided by modules that execute inside a sandbox, which means the tool replaces the model of monolithic reconnaissance software whose checks are baked into the binary and updated only by the core maintainers. A user extends sn0int by writing modules and shares them by publishing to the sn0int registry, and module authors can ship updates for their own modules instead of pull-requesting them into the sn0int codebase.

Key capabilities

• Harvests subdomains from certificate transparency logs and passive DNS.
• Mass-resolves collected subdomains and scans for HTTP or HTTPS services.
• Enriches IP addresses with ASN and GeoIP information.
• Harvests email addresses from PGP keyservers and WHOIS.
• Discovers compromised logins in breaches, finds a person's profiles across the internet, and gathers information about phone numbers.
• Harvests activity and images from social media profiles and performs basic image processing.
• Enumerates local networks with techniques such as passive ARP.
• Runs investigations as sandboxed modules rather than hardcoded logic, and distributes them through the sn0int registry hosted at sn0int.com.

Who uses it and how

• Bug bounty hunters and pentesters use it for reconnaissance, pulling subdomains out of certificate transparency logs, resolving them in bulk, and probing for HTTP or HTTPS services.
• IT security professionals use it to enumerate attack surface and map results into a unified format for follow-up investigation.
• Law enforcement agencies use it to gather intelligence about a given target.
• Security awareness trainings use the same workflows to gather intelligence about the participant's own exposure.
• Module authors and teams publish their own modules to the sn0int registry so they can ship module updates independently of the sn0int release cycle.

Getting started

Install via crates.io, or through packaged builds for Archlinux (pacman -S sn0int), Mac OSX (brew install sn0int), Alpine, OpenBSD, NixOS, Gentoo (net-analyzer/sn0int), or the signed Debian, Ubuntu, and Kali repository at apt.vulns.sexy. Docker users can run the image ghcr.io/kpcyrd/sn0int, mounting volumes for /cache and /data.

How it compares

No list of paid products replaced by sn0int is given in these facts. The README instead places it against recon-ng and maltego, which inspired it, and states that sn0int remains more flexible and is fully open source under GPL-3.0. The distinguishing design choice is that investigations arrive as sandboxed modules from the registry rather than being hardcoded into the tool.

When to use it — and when not to

A self-hoster must run and update the module sandbox, manage the registry-published modules the investigations depend on, and track their individual release cadences, since almost all investigation logic comes from modules rather than the core binary. It is a poor fit for anyone expecting fully automatic results with no module selection, because the project describes itself as semi-automatic, and the README itself is mostly an installation guide, with the substantive documentation living on Read the Docs. The GPL-3.0 licence is also worth checking before embedding it in a proprietary product.

pacman -S sn0int

brew install sn0int

sudo apt install curl sq
curl -sSf https://apt.vulns.sexy/kpcyrd.pgp | sq dearmor | sudo tee /etc/apt/trusted.gpg.d/apt-vulns-sexy.gpg > /dev/null
echo deb http://apt.vulns.sexy stable main | sudo tee /etc/apt/sources.list.d/apt-vulns-sexy.list
sudo apt update

docker run --rm --init -it -v "$PWD/.cache:/cache" -v "$PWD/.data:/data" ghcr.io/kpcyrd/sn0int

apk add sn0int

pkg_add sn0int

layman -a pentoo
emerge --ask net-analyzer/sn0int

nix-env -i sn0int