Social Mapper OSINT Tool for Social Media Mapping

Social Mapper is an open-source social media enumeration tool developed by Jacob Wilkin of SpiderLabs. It uses facial recognition and automated profile searches to identify potential matches across social networking platforms. The tool was designed for Open Source Intelligence (OSINT) investigations, helping security professionals organize publicly available profile information for further review.

Instead of manually searching each platform, Social Mapper automates parts of the discovery process. It accepts names and images as input, searches supported social networks, and generates an HTML report containing potential profile matches. Human verification remains important because facial recognition can produce both false positives and missed matches.

Key Features of Social Mapper

1. Facial Recognition and Profile Correlation

Social Mapper uses facial recognition to compare input photographs with profile images discovered during searches. This helps investigators identify accounts that may belong to the same person across different platforms. Match thresholds can be adjusted to favor broader discovery or more conservative results, although no threshold guarantees an accurate identification.

2. Multiple Input Formats

The original tool supports several ways to provide investigation data:

• Organization name: Uses an organization name as a starting point for discovering publicly associated profiles.
• Image folder: Processes a collection of named photographs.
• CSV file: Accepts structured records containing names and image URLs.
• Previous report: Supports resuming work from an earlier Social Mapper HTML report.

3. Social Media Platform Coverage

The original release was designed to search several popular social networking services:

• LinkedIn
• Facebook
• Twitter
• Google+
• Instagram
• VKontakte
• Weibo
• Douban

Platform support reflects the tool’s original development period. Google+ has been discontinued, Twitter has become X, and other platforms have changed their interfaces and access requirements. Consequently, the historical platform list should not be interpreted as a guarantee that these integrations still work.

4. Automated HTML Reporting

Social Mapper organizes its findings into an HTML report that investigators can review. The report format helps compare possible matches and track discovered profiles without manually consolidating every search result. Analysts should independently verify profile ownership before recording an identification as confirmed.

How Security Professionals Can Use Social Mapper

Social Mapper was originally developed for penetration testers, red teams, and OSINT researchers conducting authorized assessments. Its profile-correlation capabilities can help organizations understand how much employee information is publicly exposed across social platforms.

Potential defensive applications include:

• Exposure assessments: Identify publicly visible employee profiles during an authorized privacy review.
• Security awareness: Demonstrate how publicly available profile information can increase social engineering risks.
• Privacy investigations: Review whether organizational photographs or profile details are unnecessarily exposed.
• OSINT research: Organize publicly available information for investigations conducted with appropriate authorization.

Profile enumeration can also be misused for impersonation, targeted phishing, and unwanted surveillance. Social Mapper should not be used to create deceptive accounts, collect credentials, distribute malware, or profile individuals without a legitimate basis and appropriate consent.

Requirements and Project Setup

The original Social Mapper implementation was written for Python 2.7 and relied on browser automation through Mozilla Firefox, Selenium, and GeckoDriver. Its setup also required platform-specific dependencies and social media authentication credentials.

These requirements make the original release difficult to use in modern environments. Python 2.7 has reached end of life, while browser interfaces, authentication systems, and platform restrictions have changed considerably. Installing the historical dependencies does not guarantee that profile searches will work today.

Before examining the source code, review the project’s dependencies and browser automation components. Avoid entering personal or organizational social media credentials into an unmaintained tool, and use an isolated test environment when evaluating legacy software.

Command-Line Options in the Original Release

The original command-line interface offered parameters for selecting input formats, search modes, platforms, and facial recognition thresholds. The main options included:

The original release also included individual platform-selection switches. Their availability and functionality depend on the historical version and whether the corresponding platform integrations remain compatible.

Limitations and Privacy Considerations

• Legacy dependencies: Python 2.7 and older browser automation components create compatibility and maintenance concerns.
• Changing platforms: Social networking services frequently modify their interfaces, authentication flows, and access restrictions.
• Recognition errors: Similar-looking faces, low-quality photographs, and outdated profile images can lead to incorrect matches.
• Credential exposure: Supplying account credentials to old automation software introduces security risks.
• Privacy concerns: Large-scale identity correlation can affect individuals who have not consented to an investigation.

Social Mapper Source Code

Social Mapper was released by SpiderLabs as an open-source project. Security researchers can review its historical implementation, dependencies, and documentation in the Social Mapper GitHub repository.

For more OSINT research resources, explore our collection of open-source OSINT tools, which covers utilities for gathering and analyzing publicly available information.