Python is one of the most robust programming languages in the world. This language’s functionality is mind-blowing: from data science to web development and automatization.

Overall, Python is a powerful tool that we can use to gather information from various sources and then analyze and visualize it. Unsurprisingly it has also spread among the OSINT community. Nowadays, almost 1/3 of all OSINT-related repositories at GitHub are written in Python.

Utilizing the libraries in this language depends on your objectives: for web scraping, you can discover the effectiveness of BeautifulSoup; for data cleaning and analysis, use Panda & NumPy; for visualization purposes, take advantage of Matplotlib and Seaborn.

Regarding the OSINT field, one of the most critical information researchers can gather is about usernames. Users often create various accounts across websites, and having this information at hand could help us reveal crucial details.

In this post, I will explore 5 scripts for username search that are (rarely) discussed.

My criteria for considering a tool:

  1. Compatibility: Make sure that Python is installed or can be installed on your machine.
  2. Functionality: Look for scripts that have the functionality you need. I am more focused on a social media website for username search, so I prioritize this type of site.
  3. Customization: Some tools can be customized or modified to meet our needs. Always a good idea to have those in your toolset.
  4. Up to date: Consider programs that are frequently updated and supported.
  5. Easy of use: Some scripts require technical expertise to install and use, while others are designed to be more user-friendly. If you are unfamiliar with Terminal and Python, go for a user-friends one.
  6. Performance: Evaluate the performance of the Python script, especially if you need to search through large amounts of data. Look for scripts that are fast and efficient.
  7. Security: Before you install any program on your computer, you must ensure it is not malicious. I always check the source code beforehand.

Based on my criteria, I will present you the following OSINT username git repositories:

Tracer

Tracer is a Python script that checks username availability across 170 + sites. The user can choose to exclude specific websites from the query. A browser version is also available. You can save the result in a report file for easy access. For further customization, check the config file.

Installing the Tracer is pretty straightforward. Clone the repo from GitHub and proceed with the installation. To run this script, you need to have Python 3.7 or the latest and Pip. Below is the installation process:

➜  ~ pip -V
➜  ~ git clone https://github.com/chr3st5an/tracer.git & cd tracer
==> Downloading https://github.com/chr3st5an/tracer.git
######################################################################## 100.0%
➜  ~ pip install -r ./requirements.txt
➜  ~ python tracer username

To start using the script, type ./python tracer followed by the username you wish to check. For more information regarding the options, run ./python tracer –help.

Tracer is easy to use and provides handy options. What do I like the most? I appreciate the GUI option, customization, and report option.

Blackbird

Blackbird is a username tool that caught my attention last year and since then it gain popularity among OSINT professionals. It was even recommended in Michael Bazzell’s 2023 OSINT book.

Blackbird supports 574 social network sites and supports web servers and proxies. The tool also has an online version which you can use without installing the tool.

The supported report formats are Pdf and CVS. The OSINT professionals will find particularly useful the JSON template for storing and reading the data. In addition, when available, the script will extract the user’s metadata such as profile picture, bio, location, etc.

Running Blackbird is intuitive - ./python blackbird.py -u followed by a username. All functions are available under help options - ./python blackbird.py –help.

➜  ~ git clone https://github.com/p1ngul1n0/blackbird & cd blackbird
==> Downloading https://github.com/p1ngul1n0/blackbird
######################################################################## 100.0%
➜  ~ pip install -r requirements.txt
➜  ~ python blackbird.py -u username

Social Analyser

Social Analyser is the most multi-platform script on the list. The tool can be installed on Linux and Windows machines with various options - Python script and package, Node WebApp, Nodejs script, and docker. All information is available on the Wiki page.

Social Analyser searches among 1000+ social media websites to find a person’s username. The professionals can choose different analysis and reporting modules during the investigation process. Furthermore, the Social Analyser tries to solve the problem that all tools have - false positives. It rates the results from 0 to 100(No-Maybe-Yes).

Among the features of Social Analyser are: metadata & patterns extraction; JSON report; visualization with Ixora; profiles stats and static info; user-agent & proxy, etc. My preferred method of using the tool is a web app. Below is the installation code for Linux.

➜  ~ sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common
➜  ~ sudo add-apt-repository ppa:mozillateam/ppa -y
➜  ~ sudo apt-get install -y firefox-esr tesseract-ocr git nodejs npm
➜  ~ git clone https://github.com/qeeqbox/social-analyzer.git && cd social-analyzer
➜  ~ npm ci
➜  ~ npm start

For more information regarding the modules and all availabe options, refer to the Wiki page or use the standart –help option.

Nexfil

Nexfil is a classical Python script that queries usernames among 350 websites. The tool’s features are proxy and tor support, batch processing, and JSON & CSV format. The final results from any search are automatically saved in a txt file, which helps us stay organized during our investigation.

You can install Nexfil via a command line as shown below:

➜  ~ git clone https://github.com/thewhiteh4t/nexfil.git & cd nexfil
➜  ~ pip3 install -r requirements.txt
➜  ~ python3 nexfil.py -u username

One can try a search via username list from a file. Multiple comma-separated usernames could also be queried with the command ./python3 nexfil.py -l “username1, username2”. All available commands and options can be seen in the help section.

Maigret

Maigret is probably the most famous fork of Sherlock. Soxoj, a well-known person in the OSINT community, created the tool.

Like Sherlock, Maigret collects a dossier on a person by username by checking many websites. Currently, it supports around 3000 websites, TOr sites, I2P, and domains.

Among the main features of Maigret are profile page parsing, link info, recursive search, etc. You can install the tool using docker, pip, or cloned repo. My preferred method is pip3, as you can see from the code below.

➜  ~ pip3 install maigret
➜  ~ maigret username

This Python script has one of the most extensive documentation and report options. It maintains HTML, PDF, TXT, XMind 8 mindmap, and JSON reports. Every HTML/PDF report gives information regarding profile photo, full name, gender, location, etc.

For more information on how to use the tool and all available options, please visit the doc site.

Final words

A username search is probably one of the most essential queries when conducting an OSINT investigation. Having reliable and fast tools to check username availability across many websites is vital. The above-presented Python scripts automate this process for you. However, we need to remember that they often give us the so-called “False Positive” results. As usual, a final check is required.