Sherlock: Complete Guide to Username Enumeration Across Social Media Using Kali Linux

sherlock is a Python-based OSINT tool that hunts down social media and web-service accounts registered under a given username across several hundred platforms — including Twitter/X, Instagram, GitHub, Reddit, TikTok, Twitch, and many niche forums. It works by sending HTTP requests to each platform’s profile URL pattern (e.g., https://github.com/USERNAME) and analyzing the response (status code, page content) to determine whether an account with that username exists. It is a staple tool for username-based OSINT investigations, digital footprint assessments, and social engineering reconnaissance.

Installation

# Kali/Debian (pre-installed, or reinstall)
sudo apt update && sudo apt install sherlock -y

# From source (recommended for latest site-list updates)
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
python3 -m pip install -r requirements.txt --break-system-packages

# Via pip
pip3 install sherlock-project --break-system-packages

Verify installation:

sherlock --version

Syntax

sherlock [OPTIONS] USERNAMES

Command-Line Options

Basic Usage

sherlock johnsmith123

Expected output:

[*] Checking username johnsmith123 on:

[+] GitHub: https://github.com/johnsmith123
[+] Twitter: https://twitter.com/johnsmith123
[+] Instagram: https://instagram.com/johnsmith123
[-] Reddit: Not Found!

[*] Search completed with 3 results

Practical Examples

Example 1 — Basic single-username search

sherlock johnsmith123

[+] GitHub: https://github.com/johnsmith123
[+] Twitch: https://twitch.tv/johnsmith123
[*] Search completed with 2 results

Example 2 — Searching multiple usernames at once

sherlock johnsmith123 jane_doe99

[*] Checking username johnsmith123...
[+] GitHub: https://github.com/johnsmith123

[*] Checking username jane_doe99...
[+] Instagram: https://instagram.com/jane_doe99

Example 3 — Saving results to a specific output file

sherlock johnsmith123 --output johnsmith_results.txt
cat johnsmith_results.txt

https://github.com/johnsmith123
https://twitch.tv/johnsmith123

Example 4 — Saving results for multiple usernames into a folder

sherlock johnsmith123 jane_doe99 --folderoutput ./osint_results
ls ./osint_results

johnsmith123.txt
jane_doe99.txt

Example 5 — Restricting the search to specific sites

sherlock johnsmith123 --site GitHub --site Twitter

[+] GitHub: https://github.com/johnsmith123
[-] Twitter: Not Found!

Example 6 — Routing requests through Tor for anonymity

sherlock johnsmith123 --tor --unique-tor

[*] Using Tor network with new circuit per request
[+] GitHub: https://github.com/johnsmith123

Example 7 — Exporting results to CSV

sherlock johnsmith123 --csv
cat johnsmith123.csv

username,name,url_main,url_user,exists,http_status,response_time_s
johnsmith123,GitHub,https://github.com/,https://github.com/johnsmith123,Claimed,200,0.45

Example 8 — Printing all results, including “Not Found”

sherlock johnsmith123 --print-all

[+] GitHub: https://github.com/johnsmith123
[-] Reddit: Not Found!
[-] Pinterest: Not Found!
[+] Twitch: https://twitch.tv/johnsmith123

Example 9 — Automatically opening found profiles in a browser

sherlock johnsmith123 --browse

[+] GitHub: https://github.com/johnsmith123 (opened in browser)

Common Use Cases

• Building a digital footprint profile of an individual for authorized social engineering assessments (e.g., prior to an approved phishing campaign).
• Cross-referencing a suspicious username found in a data breach or forum post across dozens of platforms simultaneously.
• Investigative journalism and threat intelligence research to link a pseudonym to a broader online presence.
• Verifying whether an employee’s known username is reused (a common, risky practice) across personal and professional accounts, as part of an attack-surface/OPSEC assessment.

Automation with Bash

Batch-check a list of usernames and consolidate all found profiles:

#!/bin/bash
# sherlock_batch.sh
while IFS= read -r user; do
    echo "[*] Checking $user"
    sherlock "$user" --folderoutput ./sherlock_results --print-found
done < usernames.txt

echo "[+] All results saved in ./sherlock_results/"

Extract and combine only the “found” URLs across every result file for a report:

#!/bin/bash
grep -h "http" ./sherlock_results/*.txt | sort -u > all_found_profiles.txt
echo "[+] Consolidated found profiles saved to all_found_profiles.txt"

Tips and Best Practices

• Always update your local Sherlock clone (git pull) before an engagement — the site list (data.json) changes frequently as platforms launch, rebrand, or shut down.
• Use --tor when performing OSINT that requires operational anonymity (e.g., threat intel investigations), but be aware Tor exit nodes are sometimes blocked by target platforms, causing false negatives.
• Cross-check a handful of “Not Found” results manually — false negatives can occur due to platform-specific anti-bot protections (Cloudflare challenges) misinterpreted as “account doesn’t exist.”
• Use --site to speed up repeated checks when you only care about a specific handful of platforms (e.g., just professional networks).
• Respect platform terms of service and rate limits; running Sherlock at very high frequency against the same username can trigger IP-based blocking.

Troubleshooting

References

• Official GitHub repository: https://github.com/sherlock-project/sherlock
• Kali Linux tool page: https://www.kali.org/tools/sherlock/
• Project documentation and site list: https://sherlockproject.xyz/