Sherlock

What is Sherlock?

Sherlock is an open-source OSINT tool, written in Python, that searches for a username across hundreds of social networks and websites to find where an account with that name exists. You give it a username and within seconds it returns a list of profile URLs it found: GitHub, Reddit, Instagram, forums, gaming platforms and many more. It is one of the most popular tools for the people-reconnaissance phase, because people tend to reuse the same handle everywhere.

What Sherlock is used for

• OSINT investigations: mapping the digital footprint of a handle as part of an authorised investigation.
• Authorised pentesting and social engineering: identifying public profiles of employees of an organisation that commissioned the assessment.
• Auditing your own exposure: checking which old accounts using your handle are still active and closing them.
• Threat intelligence: tracking malicious actors' handles across forums and networks.
• OSINT CTF challenges, where you have to find a clue starting from a username.

Use it ethically: only investigate with authorisation or yourself, and respect your country's data protection laws.

How to install Sherlock

The currently recommended way is pipx, which installs it in an isolated environment:

pipx install sherlock-project

On Kali Linux it is also available in the repositories:

sudo apt install sherlock

And if you would rather not install anything on your system, you can use Docker:

docker run -it --rm sherlock/sherlock user123

Check that it works with sherlock --help.

How to use Sherlock: practical examples

Basic search

sherlock user123

It goes through every site in its database and marks found profiles with [+]. When finished it saves the results to a text file named after the user.

Several users at once

sherlock user123 user_123 user.123

Very handy for testing variants of a handle. With --folderoutput you save each user's results into a folder:

sherlock user123 user_123 --folderoutput results

Limit to specific sites

sherlock user123 --site GitHub --site Reddit

Export and tune timeouts

sherlock user123 --csv
sherlock user123 --timeout 10

--csv produces a CSV that is easy to import into a spreadsheet or your analysis tool, and --timeout stops a slow site from stalling the search. Check sherlock --help for every option in your version (for example, opening results in the browser or including NSFW sites).

Pro tips

• Always verify manually. Sherlock detects whether an account with that name exists, not whether it belongs to the same person. Matching photos, bios, cross-links or dates are what confirm identity.
• Watch out for false positives: some sites change how they respond and produce wrong results. Keep the tool updated.
• Generate handle variants (dashes, dots, years, numbers) and run them together.
• Pivot with other tools: take found profiles into Maltego to visualise relationships between accounts, emails and domains.
• Opsec: your requests come from your IP. For sensitive investigations, work through a VPN such as Surfshark or a dedicated machine.

Pros and cons

Pros	Cons
Free and open source	False positives and negatives depending on the site
Hundreds of supported sites	Only searches by username
Very fast and easy to automate	Does not confirm accounts belong to the same person

Sherlock alternatives

• Maltego: relationship analysis and visual OSINT, more complete for large investigations.
• Maigret: a Sherlock fork that supports more sites and tries to extract profile information.
• WhatsMyName: a project with a large site list, usable from the web.
• For a grounding in social engineering, the book Social Engineering by Christopher Hadnagy.

Frequently asked questions

Is Sherlock free?

Yes, it is an open-source project available on GitHub and in the Kali Linux repositories.

Is it legal to use Sherlock?

The tool only queries public information, but what you do with the data can have legal implications (harassment, data protection). Use it for authorised investigations, on yourself or in CTF challenges.

How do I use Sherlock on Windows?

Install Python and pipx, run pipx install sherlock-project and launch it from the terminal with sherlock username. You can also use the Docker image.

Why does Sherlock find accounts that do not exist?

Some sites return the same response for existing and non-existing profiles, or change their website. Update the tool and always check the link by hand.

If you are into reconnaissance and want to practise it with guided challenges, visit the Hackers en Acción Academy.