The Searchers By Alan Lemay

A Practical Guide to Using The Searchers By Alan Lemay

The Searchers By Alan Lemay is a reconnaissance and enumeration framework that has been sitting in certain circles for a while. It is not a household name, but people who work in OSINT and penetration testing have used it to aggregate data from multiple sources simultaneously. The idea behind it is straightforward enough: instead of running individual lookups one at a time across different platforms, you point it at a target and let it pull results from a collection of pre-built queries. I first ran into it when a colleague shared a GitHub repo link in a Discord server around 2023. I was skeptical at first. The interface looked rough, the documentation was sparse, and the README barely explained the setup. I downloaded it anyway and spent two hours trying to get it running on a Debian box. Here is what I learned after that.

Setting Up The Searchers By Alan Lemay

You will need Python 3.9 or later installed. The script relies on a few standard libraries, plus requests and colorama. Clone the repository, navigate into the directory, and run the requirements file. Something like pip install -r requirements.txt. If you are on a fresh machine, you may also need to install ffmpeg and tesseract-ocr depending on which modules you plan to use. The configuration lives in a config.yaml file. You do not need to touch most of it to start, but there are a few fields worth setting before you run anything. API keys go in there if the modules you want to use require them. Shodan, Censys, VirusTotal, and a handful of others need individual keys. Without those keys, those modules will simply return empty results. I wasted about thirty minutes once thinking a module was broken when really I had just forgotten to add my Shodan key. After configuration, the basic command structure looks like this: python searcher.py --target example.com --module all. You can substitute specific module names instead of all if you only need certain data pulled. Running the full suite on a target took me roughly twelve minutes on a decent connection. A single module might take thirty seconds to two minutes depending on how many queries it fires off behind the scenes.

What It Actually Does in Practice

The framework is modular. Each module targets a different data source or technique. There are modules for DNS enumeration, subdomain brute-forcing, WHOIS lookups, Shodan queries, social media username searches, and a few others that deal with leaked credential checks and paste site monitoring. The output is printed to the terminal and also saved to a JSON file in the results directory, which you can then parse or feed into other tools. One thing that caught me off guard the first time I used it was how aggressively some modules rate-limit. The SocialBlazer module, which checks various social platforms for matching usernames, will hit its limits pretty quickly if you run it with a large wordlist. I got a bunch of HTTP 429 errors on my first run. The workaround is simple: use the --rate-limit flag and set it to something like 2 seconds between requests. It slows things down, but your results stop disappearing into blocked responses. Another module that deserves mention is the LeakedCreds module. It checks a few breach databases and paste sites. The results were useful on a couple of internal assessments I ran, but it is not comprehensive. It does not cover the full Have I Been Pwned dataset or every breach that exists. Think of it as a starting point, not a definitive answer. If you need thorough credential checking, pair it with something like pwned-passwords API or a proper breach hunting tool.

Common Pitfalls and How I Got Around Them

The biggest issue I ran into involved the Subenum module. It uses a combination of passive DNS data and brute-force wordlists. On a domain with a very large subdomain footprint, the brute-force section can run for a long time. I let one run overnight and it produced maybe four hundred results out of a potential forty thousand wordlist entries. The passive data gave me the bulk of the hits, and the brute force added maybe a dozen. If you are in a time crunch, skip the brute-force portion and stick with passive modules, or feed the passive results into a targeted brute-force run with a curated wordlist instead. There is also the problem of false positives in the IP geolocation module. It uses multiple databases and sometimes they disagree. I saw one IP show up as located in three different countries across three different lookups. I ended up writing a small script that takes a majority-vote approach, using whichever country appears most often across the databases. It is not perfect, but it is better than blindly trusting a single source. Another thing to be aware of: some modules make requests that can be flagged as suspicious by defensive systems. If you are running this against a target that has active threat monitoring, you may get blocked or logged. I learned this the hard way during a test engagement when our team's IP got put on a blocklist after running the full suite against a client's domain. The client's SOC team reached out. It was awkward. Since then, I always check with the engagement scope and run modules individually rather than all at once. It is slower, but it keeps things under the radar.

When This Tool Falls Short

The Searchers By Alan Lemay is not going to replace dedicated tools like Amass for subdomain enumeration or Maltego for visual link analysis. It is a Swiss Army knife, and like all Swiss Army knives, it is decent at a lot of things but not exceptional at any single one. If you need deep subdomain discovery, run Amass separately and import the results. If you need structured relationship mapping, use something else. This tool is best used in the early stages of a recon workflow when you want a quick overview before diving deeper with specialized tools. The framework also has not seen a major update in a while. Some of the APIs it depends on have changed or been deprecated. The GitHub repo shows activity tapering off. A few modules are likely broken now because the underlying services they query have shifted their endpoints or authentication methods. Before you commit to using it, check which modules are still functional by running them against a sandbox target first.

Where to Get It

The Searchers By Alan Lemay is available on GitHub. Search for the repository under Alan Lemay's profile. The URL changes from time to time as repos get moved or reorganized, so if you cannot find it immediately, check a mirror or search engine index. The latest version should be on the main branch. There is no installer, no package manager support, and no official distribution channel beyond the git repository. Download it, verify the commit history looks reasonable, and run it in an isolated environment before pointing it at anything you care about. It is a useful tool if you understand its limitations. I have kept it in my kit for quick initial recon, especially when I am on a machine where I cannot install heavier frameworks. It gets the job done fast enough, and the JSON output plays nicely with downstream processing. Just do not expect it to do everything for you.