offensive-tools/osint/sherlock/SKILL.md
Auth/lab ref: Hunt username presence across 400+ social networks and output found profile URLs.
npx skillsauth add aeondave/malskill sherlockInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Username hunter across 400+ social platforms.
pip install sherlock-project
# Search single username
sherlock username
# Search multiple usernames
sherlock user1 user2 user3
# Output to file
sherlock username --output results.txt
# JSON output
sherlock username --json
| Flag | Purpose |
|------|---------|
| --timeout N | Per-site timeout (default: 60s) |
| --print-found | Only show found accounts |
| --print-all | Show all (including not found) |
| --output FILE | Save results |
| --json | JSON format |
| --site NAME | Search specific site only |
| --csv | CSV output |
| -x XLSX | Excel output |
Hunt username from breach data:
sherlock johndoe_83 --print-found --output johndoe_found.txt
Multiple username variants:
sherlock "john.doe" johndoe john_doe jdoe --print-found
Targeted site lookup:
sherlock johndoe --site twitter --site github --site linkedin
From breach data — test common variations at once:
sherlock john.doe johndoe john_doe j.doe jdoe83 --print-found --timeout 10
Given a real name "John Doe" or email [email protected]:
johndoe, john.doe, john_doe, jdoe, j.doe, johndoe83, jdoe83
firstname+lastname, firstnamelastname, last.first
Add: year of birth, numbers 1/2/_, common suffixes (_real, _official)
| | sherlock | maigret | |--|---------|---------| | Sites | ~400 | 2800+ | | Output | URL list | Full dossier (scraped data) | | Speed | Fast | Slower | | Best for | Quick platform sweep | Deep profile building |
Use sherlock for fast sweep, maigret for deep investigation.
| File | When to load |
|------|--------------|
| references/username-techniques.md | Username generation, variation tools, pivot strategies, platform-specific tips |
development
White-box auditing methodology for AI-generated ('vibe-coded') applications. Focuses on modern stack misconfigurations (Supabase, Next.js, Vercel).
development
Hybrid AI/Deterministic SAST methodology for discovering zero-day vulnerabilities in source code. Orchestrates structural search with AI-driven data flow and sink validation.
development
Auth assessment: hardware/embedded methodology; UART/JTAG/SWD/SPI/I2C, firmware extraction, boot/debug paths, embedded OS evidence.
devops
Container methodology: Identifying containerization limits, Docker/K8s misconfigurations, and executing escapes to the host node.