Scanners
Find claimable broken social links on a site
Crawl pages for broken social links that can be hijacked.
overview
What socialhunter does
socialhunter crawls the URLs you feed it, collects Twitter, Facebook, Instagram, and TikTok links on those pages, and checks whether each linked account still exists. Deleted or never-registered handles show up as Possible Takeover lines.
Point -f at a text file of URLs, one per line. Set -w for concurrent workers (default 5). No platform API keys are required for the four networks it checks.
Trickest runs socialhunter as a managed Scanners node that writes FILE and FOLDER. Place it after asset discovery so live site URLs get checked for hijackable outbound social links on a schedule.
use cases
Where socialhunter fits
Find hijackable social handles
Crawl a site for links to deleted or unregistered Twitter, Facebook, Instagram, and TikTok accounts that an attacker could claim and operate under the site's reputation.
Audit an organization's web properties
Run socialhunter across a list of company URLs to catch broken social links that manual page-by-page review tends to miss.
Reclaim before an attacker registers
Feed the 'Possible Takeover' results to the team that owns each property so dead handles get reclaimed or the links get removed before someone else grabs them.
Monitor new pages continuously
Schedule the crawl behind asset discovery so freshly published pages get checked for hijackable links automatically instead of on a one-off basis.
reference
socialhunter inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| urls | FILE | -f | Path of the text file containing target URLs to crawl, one per line. |
| workers | STRING | -w | Number of concurrent workers to run while crawling (default 5). |
Showing key inputs. socialhunter exposes 2 inputs in total.
example
Run socialhunter
# crawl a list of company URLs with 10 workerssocialhunter -f urls.txt -w 10Total URLs: 6Checking: https://example.com/Possible Takeover: https://twitter.com/example_support at https://example.com/contactChecking: https://blog.example.com/Possible Takeover: https://facebook.com/example.press at https://blog.example.com/aboutPossible Takeover: https://tiktok.com/@example.dev at https://blog.example.com/careersFinished Checking: https://blog.example.com/Remaining URLs: 2Scan Completedguidance
Choosing socialhunter
Use socialhunter when you hold live site URLs and need to find outbound social links that point at deleted or unregistered handles. It audits page links, not identities. Prefer sherlock for username presence across networks, and socialscan for email or handle availability.
sherlock
Maps where a username already exists across networks. socialhunter instead audits social links found on a site for hijackability.
socialscan
Checks email and username availability directly. Identity lookup, not a site crawl for broken social links.
snallygaster
Finds exposed files on web servers. Another low-effort exposure check on the same properties, not social-link takeover.
faq
socialhunter questions
related
More Scanners tools
ac-scanner
BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.
airixss
Reflection triage for parameter URLs during recon.
bedrock-keys-security
Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.
cmseek
CMS detection and version fingerprinting.
jaeles
Signature-driven web application scanner.
joomscan
OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.
Run socialhunter yourself
A file of site URLs feeds socialhunter, which crawls them for broken social links and writes the hijackable ones as a queryable output.
Facts on this page come from the live Trickest tool library.