Skip to content
HackIndex logo

HackIndex

Username Enumeration with Sherlock

3 min read Jul 10, 2026

Overview

Sherlock searches for a username across several hundred platforms simultaneously and returns confirmed account URLs. It works by requesting each platform's expected profile URL and checking the HTTP response for presence or absence indicators. It is the fastest starting point for username-based OSINT and produces a list that feeds directly into cross-platform correlation.

Installation

┌──(kali㉿kali)-[~]
└─$ pipx install sherlock-project

Or clone directly:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt

Basic Enumeration

Run a single username against all supported sites:

┌──(kali㉿kali)-[~]
└─$ sherlock $USERNAME 
[*] Checking username target_handle on:
[+] GitHub: https://github.com/target_handle
[+] Reddit: https://www.reddit.com/user/target_handle
[+] Twitter: https://twitter.com/target_handle
[+] Instagram: https://www.instagram.com/target_handle
[-] Facebook: Not Found!
[+] HackerNews: https://news.ycombinator.com/user?id=target_handle

Each line prefixed with [+] is a confirmed hit. Lines with [-] are absent or returned an error. Review every confirmed URL manually before treating it as the same person. Common usernames will produce false positives on platforms with large userbases.

Saving Output

Write results to a file for later processing:

┌──(kali㉿kali)-[~]
└─$ sherlock $USERNAME --output results.txt

For CSV output, useful when feeding results into a link analysis tool:

┌──(kali㉿kali)-[~]
└─$ sherlock $USERNAME --csv

Multiple Usernames

When you have several candidates from variation generation, pass them all in a single run:

┌──(kali㉿kali)-[~]
└─$ sherlock username1 username2 username3

Or pass a file of candidates:

┌──(kali㉿kali)-[~]
└─$ cat usernames.txt | xargs sherlock

Targeting Specific Sites

If you already know the subject uses certain platforms, limit the search to reduce noise and request volume:

┌──(kali㉿kali)-[~]
└─$ sherlock $USERNAME --site GitHub --site Reddit --site Twitter

Tor Routing

Route requests through Tor to reduce attribution back to your investigation infrastructure:

┌──(kali㉿kali)-[~]
└─$ sherlock $USERNAME --tor --unique-tor

--unique-tor requests a new Tor circuit for each platform, which distributes requests across different exit nodes. This adds time but improves anonymity and reduces the chance of rate limiting hitting the same exit IP repeatedly.

Interpreting Results and False Positives

Sherlock detects accounts by checking whether the platform returns a specific success response for a given username URL. This approach produces false positives when platforms return generic content rather than a 404 for missing accounts. Common offenders include smaller or regional platforms.

For every confirmed hit, open the URL manually and verify:

  • The account content is consistent with your subject's known activity, language, or interests

  • Profile photos, bios, or linked accounts match other confirmed profiles

  • Join date or account age is plausible relative to other confirmed accounts

A hit that does not survive manual review should be discarded. Do not include unverified hits in any intelligence product.

What to Do With Results

Confirmed hits feed directly into cross-platform correlation. Visit each confirmed account and extract any additional identifiers: email addresses, phone numbers, real names, locations, linked accounts, profile photos, and posting history. Each platform will reveal different data depending on what the subject has disclosed there.

References