NightWolf OSINT (Open Source Intelligence) Framework is a powerful and versatile Python-based tool designed for gathering publicly available information on various targets. It automates the process of querying multiple online resources and presents the findings in a structured, easy-to-read format while saving results to JSON files for further analysis.
This tool is intended for:
- Security researchers
- Penetration testers
- Ethical hackers
- OSINT investigators
- Students learning cybersecurity
NightWolf OSINT includes multiple intelligence-gathering modules:
| Module | Description |
|---|---|
| Email OSINT | Investigate publicly available information related to email addresses |
| Phone OSINT | Gather phone-related public intelligence and carrier details |
| Name OSINT | Search publicly available information using full names |
| Username OSINT | Search usernames across multiple social platforms |
| IP OSINT | Collect geolocation and network information from IP addresses |
| Domain OSINT | Perform WHOIS lookups, DNS checks, and domain intelligence gathering |
Follow these steps to install NightWolf OSINT:
git clone https://github.com/parbatzone/NightWolf-OSINT.git
cd NightWolf-OSINTsssMake sure Python 3 and pip are installed.
pip3 install -r requirements.txt --break-system-packagesFor Debian/Ubuntu/Kali Linux:
sudo apt update
sudo apt install dnsutils whois -ychmod +x nightwolf.pyNightWolf uses argparse for command-line interaction.
./nightwolf.py [MODULE_FLAG] [TARGET]- Flag:
-eor--email
Example:
./nightwolf.py -e target@example.com- Flag:
-por--phone
Example:
./nightwolf.py -p +15551234567- Flag:
-nor--name
Example:
./nightwolf.py -n "John Doe"- Flag:
-uor--username
Example:
./nightwolf.py -u limox_cypher- Flag:
-ior--ip
Example:
./nightwolf.py -i 1.1.1.1- Flag:
-dor--domain
Example:
./nightwolf.py -d google.comAll scan results are automatically saved in JSON format.
Example output filename:
nw_target_2026-05-12_18-00-00.jsonTo display the built-in help menu:
./nightwolf.py --helpor simply:
./nightwolf.pyThis tool is intended strictly for:
- Educational purposes
- Authorized penetration testing
- CTF competitions
- Ethical OSINT investigations
Always obtain proper authorization before investigating targets you do not own.
Some advanced OSINT services may require API keys. Those services are not automatically integrated into the framework.
Be aware that some services may temporarily block or rate-limit excessive requests.
Recent improvements include:
- Migration from
sys.argvtoargparse - Improved dependency handling
- Better network error handling
- Enhanced username detection logic
- Cleaner JSON output formatting
- More readable code structure
- Better warning and error messages
This project is licensed under the MIT License.
See the LICENSE file for more information.
- Original Author: Limox Cypher
The developers are not responsible for any misuse of this software.
Use responsibly and legally.
