loading
Loading content
loading
Scanners
Crawl pages for broken social links that can be hijacked.
overview
socialhunter crawls the URLs you feed it, collects Twitter, Facebook, Instagram, and TikTok links on those pages, and checks whether each linked account still exists. Deleted or never-registered handles show up as Possible Takeover lines.
Point -f at a text file of URLs, one per line. Set -w for concurrent workers (default 5). No platform API keys are required for the four networks it checks.
Trickest runs socialhunter as a managed Scanners node that writes FILE and FOLDER. Place it after asset discovery so live site URLs get checked for hijackable outbound social links on a schedule.
use cases
Crawl a site for links to deleted or unregistered Twitter, Facebook, Instagram, and TikTok accounts that an attacker could claim and operate under the site's reputation.
Run socialhunter across a list of company URLs to catch broken social links that manual page-by-page review tends to miss.
Feed the 'Possible Takeover' results to the team that owns each property so dead handles get reclaimed or the links get removed before someone else grabs them.
Schedule the crawl behind asset discovery so freshly published pages get checked for hijackable links automatically instead of on a one-off basis.
reference
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | -f | Path of the text file containing target URLs to crawl, one per line. |
| workers | STRING | -w | Number of concurrent workers to run while crawling (default 5). |
Showing key inputs. socialhunter exposes 2 inputs in total.
example
# crawl a list of company URLs with 10 workerssocialhunter -f urls.txt -w 10Total URLs: 6Checking: https://example.com/Possible Takeover: https://twitter.com/example_support at https://example.com/contactChecking: https://blog.example.com/Possible Takeover: https://facebook.com/example.press at https://blog.example.com/aboutPossible Takeover: https://tiktok.com/@example.dev at https://blog.example.com/careersFinished Checking: https://blog.example.com/Remaining URLs: 2Scan Completedguidance
Use socialhunter when you hold live site URLs and need to find outbound social links that point at deleted or unregistered handles. It audits page links, not identities. Prefer sherlock for username presence across networks, and socialscan for email or handle availability.
Maps where a username already exists across networks. socialhunter instead audits social links found on a site for hijackability.
Checks email and username availability directly. Identity lookup, not a site crawl for broken social links.
Finds exposed files on web servers. Another low-effort exposure check on the same properties, not social-link takeover.
faq
related
Reflection triage for parameter URLs during recon.
CMS detection and version fingerprinting.
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Bundled web server checks for dangerous files and outdated software.
Bypass 403/40X restrictions through smart request manipulation.
YAML template scanner for live hosts; scope runs with tags and severity.
A file of site URLs feeds socialhunter, which crawls them for broken social links and writes the hijackable ones as a queryable output.
Facts on this page come from the live Trickest tool library.