Skip to content
Switch branches/tags


Gather Open-Source Intelligence using PowerShell.


Save the parent project directory, pOSINT, to C:\Users\$env:username\Documents\WindowsPowerShell\Modules\.

List available modules:

Get-Module -ListAvailable

Import the module:

Import-Module pOSINT

Or, just import the manifest file manually:

Import-Module pOSINT.psd1

View module details:

Get-Module pOSINT

Review module help page:

Get-Help Search-<OSINT_SOURCE>

Show Cmdlet examples:

Get-Help Search-<OSINT_SOURCE> -Examples

Check the following sources' help page to see special mappings:

  • AlienVault
  • Censys
  • Hybrid-Analysis
  • ThreatMiner

Remove the module:

Remove-Module pOSINT


Search-AlienVault -Endpoint IPv4 -Section general -Query | Format-List
Search-Censys -Uid <UID> -Secret <SECRET> -Endpoint search -Index certificates -Query | Format-List
Search-Crtsh -Query -Wildcard | Format-List
Search-Cymon -Endpoint ip -Query | Format-List
Search-EmailRep -Query | Format-List
Search-GreyNoise -Endpoint list | Format-List
Search-GreyNoise -Endpoint tag -Query ADB_WORM | Format-List
Search-GreyNoise -Endpoint ip -Query | Format-List
Search-HybridAnalysis -ApiKey <APIKEY> -Secret <SECRET> -Endpoint hash -Name hash -Query 116858001ed50d8dd02b353473a139b98820dcf620c9e70e8a51c49f62cc6581 | Format-List
Search-Malshare -ApiKey <APIKEY> -Query 4cc96f0003b6c0429f29013a8d9e3e3c | Format-List
Search-PhishingKitTracker | Format-List
Search-PulseDive -Endpoint threat -Query Zeus | Format-List
Search-PulseDive -Endpoint indicator -Query | Format-List
Search-PulseDive -Endpoint feed_list | Format-List
Search-PulseDive -Endpoint feed -Query "Zeus Bad Domains" -organization | Format-List
Search-ThreatCrowd -Endpoint ip -Query | Format-List
Search-ThreatMiner -Endpoint host -Query -QueryType report_tagging | Format-List
Search-Urlhaus -Endpoint payload -Query 4ef1c08fe44a8d1e1c8ef214e7ed63a318663e926860702076bc6234fd3b1d11 | Format-List
Search-Urlscan -Query 4ef1c08fe44a8d1e1c8ef214e7ed63a318663e926860702076bc6234fd3b1d11 | Format-List
Search-VirusTotal -ApiKey <APIKEY> -Endpoint ip-address -Query | Format-List


Things to Know

  • Do not use Format-List when accessing properties

Please fork, create merge requests, and help make this better.