ZeroTrace OSINT
Tools overview
How every tool in the ZeroTrace OSINT library works — input, running it, reading results, the network/local/live model, saving to a case, and chaining into the next tool.
Tools overview
The heart of ZeroTrace OSINT is its tool library: around 150 focused lookup, analysis, encoding, and command-building tools, each built to do one job well. Rather than a handful of do-everything screens, you get many small, sharp tools you can reach in a keystroke, run against your own input, and combine into an investigation.
How every tool works
Every tool in the library shares one shape, so once you know how to run one, you know how to run all of them:
- Input — the tool's page shows a form for exactly what it needs: a domain, an IP, a hash, a file path, pasted text, or a small set of structured options for a command builder. Required fields are marked; the rest have sensible defaults.
- Run — starting the tool sends the input to the tool's own logic. A local tool returns almost immediately; a network tool shows that it is working while the request is in flight.
- Results — the answer comes back laid out for its subject, not as raw text: a table for a list of records, a labeled card for a single lookup, a diff view, a generated command line. Long or repeated fields collapse so the result stays scannable.
- Pivot — where the result contains other things worth looking into (an IP inside a WHOIS record, a domain in a certificate, a hash in a scan), the workbench offers next-step chips: one click opens the right follow-up tool with that value already filled in, chained from the result you're looking at.
- Save — send anything useful into an open case, where it's filed with its context and its identifiers are harvested into the dossier automatically.
Local, network, and live
Every tool states its data source before you run it, and the label is more specific than a plain on/off switch:
| Label | What it means |
|---|---|
| Local | Runs entirely on your machine. No request leaves your computer, whatever the input. |
| Network (third party) | Queries an outside service to answer — a public API, a registry, a threat-intel feed. The thing you're investigating is not itself contacted; a service that knows about it is. |
| Live (contacts the target) | Reaches out directly to the target you gave it — fetching a page, opening a TLS handshake, resolving through the target's own infrastructure. The target can see this request arrive. |
| Mixed | Combines local work with one or more network calls; the tool's own page notes whether any of those calls reach the target directly. |
This distinction matters operationally: a WHOIS lookup and a TLS handshake against the same host are very different acts. WHOIS asks a registry about the domain; the domain's own server never sees it. A TLS inspection opens a real connection to the host itself. OSINT labels each tool by which of these it actually does, not just "network vs. local," so you know before you run it whether the subject of your investigation is going to see you.
A few network tools talk to services that expect your own account or API key (rate-limited free tiers, or a paid service like Shodan). Where that is the case, you add the key in Settings, and it stays stored securely on your machine — see Privacy. Every other network tool works out of the box against free or keyless endpoints.
Chaining into the next tool
An investigation is rarely one lookup. A domain resolves to an IP, the IP belongs to an ASN, the certificate on the host names an organization, a subdomain shows up in a breach. The workbench reads the identifiers a result surfaces — IPs, domains, hashes, emails, usernames — and proposes the highest-value follow-up tools for each one, with the value already filled in. Click a chip and the next tool opens ready to run; nothing needs to be retyped. This is how a single lookup grows into a chain of them without you leaving the result to go find the next tool yourself.
Results are shaped for what they represent:
- Single-subject lookups (WHOIS, a user profile, a decoded token) come back as a labeled card of fields.
- List results (DNS records, subdomains, breach entries, platform checks) come back as a table you can scan and copy from.
- Comparisons (a Wayback diff, a text diff, a list comparison) come back as a side-by-side or unified diff.
- Command builders come back as a ready command line you can copy into your own terminal.
Every result also carries a small provenance note: what was queried and, for network tools, roughly when the answer was fetched.
The categories
The library is organized by what you are investigating:
Domains, IP addresses, DNS, routing, certificates, geolocation, and command builders.
Websites, URLs, security posture, vulnerabilities, and known-bad indicators.
Encoding, hashing, tokens, cryptocurrency addresses, and structured identifiers.
Usernames, emails, phone numbers, and social and developer profiles.
Metadata, signatures, and secrets hidden inside files.
Every tool has its own page and a place in the sidebar, but the fastest way to reach one is ⌘K / Ctrl K — the command palette fuzzy-matches across the whole library by name.