Skip to content
Deepak Gupta markRecon Atlas

Recon frameworks

sn0int

Rust OSINT framework and module package manager that runs sandboxed Lua modules and stores entities in a typed database.

Passive and active modesScope a pentestAudit your own exposure

2.6k stars · last push September 20, 2026 · v0.26.1 · GPL-3.0

GitHub repositoryOfficial docs

What it finds

sn0int is a semi-automatic console framework, inspired by recon-ng and Maltego, where all investigation logic lives in modules from a public registry. Modules run in a sandbox and write typed entities (subdomains, IPs, emails, accounts, breaches) that follow-up modules consume. Starter modules query certificate transparency and passive DNS, resolve hosts and check for web services.

  • subdomains
  • IP addresses
  • ASN and GeoIP data
  • URLs
  • emails
  • breached logins
  • social media accounts
  • phone number details
  • local network devices
  • images

Does it touch the target?

Has a passive mode and active modes. The active modes need the owner's permission.

README: "Harvest subdomains from certificate transparency logs and passive dns" and "Mass resolve collected subdomains and scan for http or https services". Docs list a kpcyrd/url-scan module ("Scan subdomains for websites") next to passive ones; activity depends on modules run.

API keys: Docs: modules request credentials from a namespaced keyring, and "a script doesn't automatically get access to requested keyring namespaces"; the quickstart modules shown need no key.

Install

Install with package
pacman -S sn0int

From the project's documentation

Install with package
brew install sn0int

From the project's documentation

Install with docker
docker run --rm --init -it -v "$PWD/.cache:/cache" -v "$PWD/.data:/data" ghcr.io/kpcyrd/sn0int

From the project's documentation

How to run it

Examples use reserved documentation hosts such as example.com. Replace them with a domain you own or are authorised to test.

Install the featured starter modules
pkg quickstart

From the project's documentation

Add a domain to scope
add domain

From the project's documentation

Query certificate transparency logs
use ctlogs

From the project's documentation

Resolve discovered subdomains
use dns-resolve

From the project's documentation

Limits the project documents

  • Docs: "By default, sn0int doesn't have any modules installed." They come from the sn0int registry.
  • Docs (Sandbox): "Network access is available and network namespaces aren't isolated", so modules can reach the local network and localhost.
  • Docs: sandbox failures can occur "especially on architectures that are less popular".

Deepak's take

Analysis, not documentation

Use it when
Use it for investigations across domains, IP addresses and services, where you want modules sandboxed and results kept as typed, linked entities.
Skip it when
Skip it when you want one command that runs a full pipeline; it is semi-automatic, so reconFTW or BBOT suit unattended runs better.
What it will miss
It returns only what installed registry modules collect, so sources with no published module are never queried.

Facts read from the project's README and docs on November 10, 2026. Repository data as of November 11, 2026. Listed under GitHub's reconnaissance topic. Licence: GPL-3.0. sn0int is a trademark or project name of its owners; this library is not affiliated with it.