Sherlock: Complete Guide to Username Enumeration Across Social Media Using Kali Linux

sherlock is a Python-based OSINT tool that hunts down social media and web-service accounts registered under a given username across several hundred platforms — including Twitter/X, Instagram, GitHub, Reddit, TikTok, Twitch, and many niche forums. It works by sending HTTP requests to each platform’s profile URL pattern (e.g., https://github.com/USERNAME) and analyzing the response (status code, page content) to determine whether an account with that username exists. It is a staple tool for username-based OSINT investigations, digital footprint assessments, and social engineering reconnaissance.

Installation

# Kali/Debian (pre-installed, or reinstall)
sudo apt update && sudo apt install sherlock -y

# From source (recommended for latest site-list updates)
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
python3 -m pip install -r requirements.txt --break-system-packages

# Via pip
pip3 install sherlock-project --break-system-packages

Verify installation:

sherlock --version

Syntax

sherlock [OPTIONS] USERNAMES

Command-Line Options

Flag	Description
USERNAMES	One or more usernames to search for, space separated
--version	Display version and exit
--verbose, -v	Display extra debugging/verbose output
--folderoutput, -fo DIR	Directory to save results into (when checking multiple usernames)
--output, -o FILE	Save results for a single username to a specific file
--tor, -t	Route requests through the Tor network for anonymity
--unique-tor, -u	Use a new Tor circuit for each request
--csv	Save results in CSV format
--xlsx	Save results in Excel XLSX format
--site SITE	Limit the search to one or more specific sites only
--proxy, -p PROXY	Route requests through an HTTP/SOCKS proxy
--json, -j FILE	Load a custom/alternate site data JSON file
--timeout SEC	Timeout for each site request
--print-all	Print results for all sites, including sites where the username was not found
--print-found	Print only sites where the username was found (default behavior)
--no-color	Disable colored terminal output
--browse, -b	Automatically open found profiles in the default web browser
--local	Force use of the local data.json site list instead of fetching the latest online
--nsfw	Include sites flagged as NSFW in the search

Basic Usage

sherlock johnsmith123

Expected output:

[*] Checking username johnsmith123 on:

[+] GitHub: https://github.com/johnsmith123
[+] Twitter: https://twitter.com/johnsmith123
[+] Instagram: https://instagram.com/johnsmith123
[-] Reddit: Not Found!

[*] Search completed with 3 results

Practical Examples

Example 1 — Basic single-username search

sherlock johnsmith123

[+] GitHub: https://github.com/johnsmith123
[+] Twitch: https://twitch.tv/johnsmith123
[*] Search completed with 2 results

Example 2 — Searching multiple usernames at once

sherlock johnsmith123 jane_doe99

[*] Checking username johnsmith123...
[+] GitHub: https://github.com/johnsmith123

[*] Checking username jane_doe99...
[+] Instagram: https://instagram.com/jane_doe99

Example 3 — Saving results to a specific output file

sherlock johnsmith123 --output johnsmith_results.txt
cat johnsmith_results.txt

https://github.com/johnsmith123
https://twitch.tv/johnsmith123

Example 4 — Saving results for multiple usernames into a folder

sherlock johnsmith123 jane_doe99 --folderoutput ./osint_results
ls ./osint_results

johnsmith123.txt
jane_doe99.txt

Example 5 — Restricting the search to specific sites

sherlock johnsmith123 --site GitHub --site Twitter

[+] GitHub: https://github.com/johnsmith123
[-] Twitter: Not Found!

Example 6 — Routing requests through Tor for anonymity

sherlock johnsmith123 --tor --unique-tor

[*] Using Tor network with new circuit per request
[+] GitHub: https://github.com/johnsmith123

Example 7 — Exporting results to CSV

sherlock johnsmith123 --csv
cat johnsmith123.csv

username,name,url_main,url_user,exists,http_status,response_time_s
johnsmith123,GitHub,https://github.com/,https://github.com/johnsmith123,Claimed,200,0.45

Example 8 — Printing all results, including “Not Found”

sherlock johnsmith123 --print-all

[+] GitHub: https://github.com/johnsmith123
[-] Reddit: Not Found!
[-] Pinterest: Not Found!
[+] Twitch: https://twitch.tv/johnsmith123

Example 9 — Automatically opening found profiles in a browser

sherlock johnsmith123 --browse

[+] GitHub: https://github.com/johnsmith123 (opened in browser)

Common Use Cases

• Building a digital footprint profile of an individual for authorized social engineering assessments (e.g., prior to an approved phishing campaign).
• Cross-referencing a suspicious username found in a data breach or forum post across dozens of platforms simultaneously.
• Investigative journalism and threat intelligence research to link a pseudonym to a broader online presence.
• Verifying whether an employee’s known username is reused (a common, risky practice) across personal and professional accounts, as part of an attack-surface/OPSEC assessment.

Automation with Bash

Batch-check a list of usernames and consolidate all found profiles:

#!/bin/bash
# sherlock_batch.sh
while IFS= read -r user; do
    echo "[*] Checking $user"
    sherlock "$user" --folderoutput ./sherlock_results --print-found
done < usernames.txt

echo "[+] All results saved in ./sherlock_results/"

Extract and combine only the “found” URLs across every result file for a report:

#!/bin/bash
grep -h "http" ./sherlock_results/*.txt | sort -u > all_found_profiles.txt
echo "[+] Consolidated found profiles saved to all_found_profiles.txt"

Tips and Best Practices

• Always update your local Sherlock clone (git pull) before an engagement — the site list (data.json) changes frequently as platforms launch, rebrand, or shut down.
• Use --tor when performing OSINT that requires operational anonymity (e.g., threat intel investigations), but be aware Tor exit nodes are sometimes blocked by target platforms, causing false negatives.
• Cross-check a handful of “Not Found” results manually — false negatives can occur due to platform-specific anti-bot protections (Cloudflare challenges) misinterpreted as “account doesn’t exist.”
• Use --site to speed up repeated checks when you only care about a specific handful of platforms (e.g., just professional networks).
• Respect platform terms of service and rate limits; running Sherlock at very high frequency against the same username can trigger IP-based blocking.

Troubleshooting

Problem	Cause	Fix
Many false “Not Found” results	Anti-bot/CAPTCHA protections (e.g., Cloudflare) blocking Sherlock’s requests	Manually verify a sample of results in a browser; consider --timeout increase or proxy rotation
ConnectionError / SSL errors on some sites	Site-specific certificate or connectivity issue	Update Sherlock to latest version; site definitions are frequently patched for such issues
Extremely slow scan	Checking against the full site list (400+) sequentially without proxy/threading tuning	Use --site to limit scope, or ensure you’re on a stable, fast connection
Tor mode fails to connect	Tor service not running locally	Start the Tor service: sudo systemctl start tor, then retry with --tor
Outdated site list flags real accounts as not found	Local data.json is stale	Pull the latest repository version or manually update data.json from upstream

References

• Official GitHub repository: https://github.com/sherlock-project/sherlock
• Kali Linux tool page: https://www.kali.org/tools/sherlock/
• Project documentation and site list: https://sherlockproject.xyz/