Sherlock

Sherlock

Purpose

• Use this skill to search for username presence across many public social platforms and web services.
• Sherlock is useful for OSINT, account enumeration, alias correlation, and open-source reconnaissance.
• It is a reconnaissance utility, not a guarantee of identity resolution.

Install

bashCopy code
pip install sherlock-project

Alternative source install:

bashCopy code
git clone https://github.com/sherlock-project/sherlock
cd sherlock
python -m pip install -r requirements.txt
python sherlock.py username

Basic Search

bashCopy code
sherlock username

• This searches a broad set of supported sites for a single username.
• Output normally shows which sites likely contain a matching profile.
• Results are only a starting point and should be verified manually.

Multiple Usernames

bashCopy code
sherlock user1 user2 user3

• Use this when comparing handles across several candidate aliases.
• Batch searching is useful when the target uses variations of the same naming pattern.
• Keep the candidate list short enough to review carefully.

Output to a File

bashCopy code
sherlock username --output results.txt

• Save results when you need an audit trail or want to compare scans over time.
• Text output is convenient for quick archival, case notes, and manual review.

CSV Output

bashCopy code
sherlock username --csv

• CSV output is useful for spreadsheet triage and bulk analysis.
• This is the better option when integrating results into reporting or other tooling.

Restrict Search to Specific Sites

bashCopy code
sherlock username --site twitter github

• Site filtering is useful when you only care about a narrow platform set.
• Restricting sites speeds up focused investigations and reduces noise.
• Use it for targeted checks like developer handles, gaming handles, or creator profiles.

Timeout Control

bashCopy code
sherlock username --timeout 10

• Increase the timeout on slow or unstable networks.
• Decrease it when you want faster but less patient scans.
• Timeouts affect coverage and speed, so tune them to the environment.

Tor Support

bashCopy code
sherlock username --tor

• This requires Tor to be installed and available.
• Use Tor only when your environment and policy allow it.
• Expect slower requests and occasional site behavior differences.

Print All Results

bashCopy code
sherlock username --print-all

• This includes not-found results in addition to matches.
• It is useful when you want a full per-site record rather than only positive hits.
• Full output is better for documentation and reproducible analysis.

Practical Workflow

1. Start with a single username search.
2. Save results to a file or CSV.
3. Filter to high-value platforms for deeper review.
4. Manually verify candidate profiles.
5. Correlate bios, avatars, links, timestamps, and naming patterns.

Verification Guidance

• A found username is not proof that the account belongs to the same person.
• Check profile metadata such as avatar reuse, linked websites, self-descriptions, and posting patterns.
• Compare account creation dates, geographic references, and cross-links.
• Treat weak matches as leads, not conclusions.

Good Use Cases

• Brand protection checks
• Public alias discovery
• Security research on exposed usernames
• Reconnaissance for incident response
• Confirming whether a handle is broadly reused

Limitations

• Site behavior changes can break detection.
• Some platforms throttle or block automated requests.
• False positives and false negatives both happen.
• Private or suspended accounts may not appear reliably.

Output Handling

• Keep raw outputs with timestamps when the result matters.
• Store CSV when the data will be joined with other OSINT sources.
• Re-run focused scans rather than assuming old results are still valid.

Ethical Use

• Use Sherlock only for authorized research, defensive security work, or lawful OSINT.
• Do not use it to harass, dox, stalk, or profile individuals without authorization.
• Respect the legal and policy boundaries of your organization and jurisdiction.

Summary

• Install with pip install sherlock-project or from the upstream GitHub repo.
• Search one handle with sherlock username.
• Search several with sherlock user1 user2 user3.
• Save results with --output results.txt or --csv.
• Restrict sites with --site twitter github.
• Tune network behavior with --timeout 10 and optionally --tor.
• Use --print-all when a complete site-by-site record is needed.