01 · Product name
sn0int
A small OSINT framework that maps public data into one database.
Published by kpcyrd.
In short
sn0int is a free OSINT framework and package manager by kpcyrd. It collects public information about a target you are allowed to assess, or about yourself, and keeps the rows in one local database. The manual describes jobs such as subdomains from certificate logs and passive DNS, then a check for sites that answer. A row is a lead for a follow-up. It is not a completed report.
Product pricing strategy
02
Free
sn0int is free. You do not buy a seat to use what the project publishes.
Yes. It is an open-source framework. You run it locally. There is no seat price in the manual.
Utility and features
03
The sn0int manual calls it a semi-automatic framework. You run modules. They pull public data, and the results land in one format so the next module can use them. The examples on the documentation home page are the ordinary reconnaissance set: subdomains from certificate transparency, subdomains from passive DNS, which of those names have a public website, email addresses from PGP keyservers, and enrichment of IP addresses.
- Modules and a database. Each module writes structured rows. Later modules read those rows. You are not copying spreadsheets between tools.
- Passive collection. The documented examples use public logs and keyservers. That is not the same as scanning a network you do not own.
- A package registry. The project ships a registry of modules. Read a module before you run it. The name is not a review.
It is closer to Recon-ng than to a website you log into. Modules come from a registry the project documents. SpiderFoot is the alternative when you want a local web UI and a larger module list. theHarvester is the alternative when you only want the email-and-host pass. sn0int is the choice when you want that pass inside a database you can query again.
- 1
Install sn0int from the repository and read the manual on Read the Docs.
- 2
Create a workspace for one target you are allowed to assess.
- 3
Run a passive module, such as certificate-log subdomains, and read the rows.
- 4
Export or query the database when you need to hand the list to someone else.
Caveats
04
sn0int is a free reconnaissance framework with a local database. Modules wrap public sources. They fail quietly when a key is missing or a site changes.
Rows feel durable because they live in a database. They are still leads with a timestamp. Do not point modules at domains outside the authorization. Amass is the comparison for hostnames. A second run that adds nothing may mean the sources had nothing new, or that the module broke. Check which.
Screenshots
05
Potential use cases
06
- You want a first-pass list of names and addresses for a domain you own or are authorized to examine, stored in one database. Run the sn0int modules you selected. The output is rows you can re-query later. Pivot hostnames to Amass or Subfinder if you want a second passive collector. A module that needs an API key returns what that key can see. Write down which modules ran.
- The point of the tool is the database rather than a pile of text files. After the run, query it for the entities you will actually follow. The output of that query is the lead list. Do not export the entire database into a report. Public logs and passive sources are incomplete. Re-run later to see what they added, and diff against the earlier rows.
- You are choosing modules on a domain you control so you can see what a public source says about you. The output is that self-check. It is not an engagement against a customer. Rate limits belong to the upstream sources. This listing does not invent them.
Hard cases
The case where the first result is easy to over-read.
The database outlives the authorization
The engagement ended and the sn0int workspace still has the entities. That is now a retention question, not a recon question. Export what the report needs, delete or archive the workspace under your policy, and do not keep querying it because the data is convenient. A later module run is a new collection. It needs its own permission.
Questions
Is sn0int free?
Yes. It is an open-source framework. You run it locally. There is no seat price in the manual.
Does sn0int scan hosts?
The manual’s examples are passive collection from public sources, then a look at which names have a public website. Do not point it at networks you are not allowed to assess.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
sn0int repository
https://github.com/kpcyrd/sn0intDocumentation
sn0int documentation
https://sn0int.readthedocs.io/en/latest/