Skip to content
OPS // KITitspentest.sh

R-SHE

Sherlock

Hunts for a username across hundreds of social media and web platforms for OSINT.

Official siteBack to catalog

OVERVIEW

Sherlock takes a single username and checks it against a maintained list of hundreds of sites — social networks, forums, gaming platforms, developer communities — reporting back everywhere an account with that exact handle exists. It's a common step once a username surfaces from an email breach, a company's naming convention, or another OSINT tool.

Because it only checks whether a profile URL resolves (and applies site-specific logic to avoid false positives from generic "not found" pages), it's fast and produces a link list an analyst can then manually verify and pivot from.

USE CASES

Practical use cases

  • 01

    Pivoting from a leaked or guessed username to every social platform where it's registered.

  • 02

    Building a profile of an employee's public online presence for a social-engineering assessment.

  • 03

    Confirming whether a suspicious handle seen in a phishing campaign has a real public footprint.

  • 04

    Cross-checking usernames found via theHarvester, breach data, or GitHub against social platforms.

QUICK START

During people-focused OSINT, once you have a candidate username, to see everywhere else that identity is (or was) registered.

  1. Install Sherlock and its Python dependencies.
  2. Run it against the candidate username to check it across all supported sites.
  3. Manually open the returned links to confirm they belong to the actual target, not a namesake.
  4. Note confirmed profiles for the OSINT/social-engineering section of the report.
sherlock target_username --timeout 10

BEFORE YOU RUN IT

What to check before running it

Site layouts change constantly, so both false positives and false negatives happen — always manually confirm a hit before citing it.

A shared or common username can return accounts belonging to a different person entirely; corroborate with other identifying details.

Running it generates real requests to dozens of third-party sites from your IP — be mindful of that if OPSEC on the lookup itself matters.

KEEP EXPLORING

View the whole phase →