ADVANCED MODULE — Sherlock + OSINT Pro

We’ll cover:

1. Adding custom websites to Sherlock
2. Understanding the code internally
3. Automating reports
4. Integrating Sherlock with other OSINT tools
5. Advanced investigation workflow

---

1Add Your Own Websites to Sherlock

Sherlock can be extended by editing its data.json file.

Steps:

1. Open sherlock/resources/data.json
2. Add a new site in JSON format:

"newsite": {
    "url": "https://newsite.com/{username}",
    "errorType": "status_code",
    "errorMsg": 404
}

• {username} → replaced automatically
• errorType: status_code or message

• errorMsg: what indicates the username does not exist

• Save file, then run:

python3 sherlock username

Your new site is now included.

This allows any niche platform to be added, like small forums, gaming sites, or business directories.

---

Understand Sherlock Internally (Python Basics)

Sherlock is written in Python 3. Core parts:

• sherlock/sherlock.py → main program, parses args, calls search.py
• sherlock/search.py → handles searching on all sites
• sherlock/resources/data.json → database of platforms
• requests library → handles HTTP requests
• argparse → handles command-line arguments

Flow:

Input username → Read JSON → For each site:
    → Construct URL
    → Send request
    → Check status / error message
    → Save result → Output

You can modify or add logic, e.g.,:

• Retry on error
• Delay between requests (anti-block)
• Custom output formatting

---

Automate OSINT Reports

Instead of manually checking every search:

1. Run Sherlock → JSON output

python3 sherlock username --json --output report.json

1. Use a Python script to generate a clean report:

import json

with open("report.json") as f:
    data = json.load(f)

for site, info in data.items():
    if info['status'] == "Found":
        print(f"{site}: {info['url']}")

1. Extend script:

2. Convert JSON → HTML

3. Convert JSON → PDF
4. Highlight “most important accounts”

Automation saves hours in large investigations.

---

Combine Sherlock With Other OSINT Tools

Advanced investigators never rely on one tool:

• SpiderFoot → scans domains, emails, usernames, IPs → visualizes relationships
• Maltego → builds graphs of linked accounts, emails, domains, and IPs
• Holehe → check which emails are linked to social accounts
• WhatsMyName → alternate username database

Example workflow:

1. Run Sherlock → find usernames
2. Holehe → check emails linked to usernames
3. Maltego → create a visual graph of all accounts
4. SpiderFoot → automate large-scale OSINT
5. Save report → PDF/HTML

---

Advanced Investigation Workflow

1. Target Identification

2. Collect all known usernames, emails, aliases

3. Sherlock Search

4. Run usernames across all platforms

5. Save JSON output

6. Account Verification

7. Check profile picture, bio, activity

8. Compare timezones and patterns

9. Cross-Platform Correlation

10. Identify same person using multiple accounts

11. Identify fake/impersonated accounts

12. Visualize & Analyze

13. Use Maltego or SpiderFoot to map connections

14. Detect relationships between accounts

15. Report & Monitor

16. Generate automated report

17. Monitor new accounts periodically (weekly/monthly)

---

Advanced Practical Exercise (Do Now)

1. Pick 2–3 usernames (yours or test accounts)
2. Add 1 new niche website to Sherlock (data.json)
3. Run Sherlock with --json --tor

4. Write a Python script to generate a clean report with:

5. Platforms found

6. Links
7. Manual confirmation notes