Menü
开源情报收集 — 社工、人肉搜索、域名/IP/邮箱情报、社交媒体
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Basierend auf der SOC-Berufsklassifikation
Delegate coding to OpenAI Codex CLI (features, PRs).
Configure, extend, or contribute to Hermes Agent.
Manage multiple remote servers from Hermes via SSH — deploy services, configure firewalls, transfer files, run commands across servers
Clone/create/fork repos; manage remotes, releases.
Parallel data collection from web sources, APIs, and documentation sites
Deploy static sites to GitHub Pages via API — create repo, push, enable Pages, all from CLI
| name | osint |
| description | 开源情报收集 — 社工、人肉搜索、域名/IP/邮箱情报、社交媒体 |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| metadata | {"hermes":{"tags":["osint","social-engineering","reconnaissance","people-search","domain-intel"]}} |
| 工具 | 用途 |
|---|---|
| Maltego | 关系图谱分析 |
| Recon-ng | 信息收集框架 |
| theHarvester | 邮箱/域名/IP收集 |
| Shodan | 设备/服务搜索引擎 |
| Censys | 互联网设备搜索 |
| SpiderFoot | 自动化OSINT |
| Sherlock | 社交媒体用户名搜索 |
| holehe | 邮箱关联账户查询 |
| Photon | 网站爬取 |
| Wayback Machine | 历史网页快照 |
| WHOIS | 域名注册信息 |
| DNSrecon | DNS枚举 |
| Amass | 子域名枚举 |
| Metagoofil | 文档元数据提取 |
| Creepy | 地理位置情报 |
| tinfoleak | Twitter情报 |
whois target.com
whois 192.168.1.1
# 提取关键信息
whois target.com | grep -E 'Registrar|Name Server|Creation Date|Registrant'
# 基本查询
dig target.com ANY
dig target.com A
dig target.com MX
dig target.com TXT
dig target.com NS
dig target.com CNAME
# 反向DNS
dig -x 192.168.1.1
# 区域传送(如果允许)
dig @ns1.target.com target.com AXFR
# 子域名爆破
dnsrecon -d target.com -t brt
dnsrecon -d target.com -t std
# subfinder
subfinder -d target.com -silent
# amass
amass enum -d target.com
amass enum -d target.com -passive
pip install shodan
# 设置API key
export SHODAN_API_KEY="your_key"
# 搜索
shodan search "org:Target port:80"
shodan search "product:apache country:CN"
shodan search "http.title:login"
shodan search "ssl:target.com"
# 主机信息
shodan host 192.168.1.1
# 命令行
shodan init YOUR_API_KEY
shodan scan submit 192.168.1.0/24
shodan stats --facets country,port vuln:ms17-010
pip install censys
# 搜索证书
censys search "parsed.subject.common_name: target.com"
# 搜索主机
censys search "services.port=443 AND location.country=China"
# 查看特定主机
censys view 192.168.1.1
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock && pip install -r requirements.txt
# 搜索用户名
python sherlock.py username123
# 搜索多个用户名
python sherlock.py user1 user2 user3
# 输出到文件
python sherlock.py username123 -o output.txt
# 指定站点
python sherlock.py username123 --site twitter,instagram,github
pip install holehe
holehe email@example.com
# 输出: 该邮箱注册了哪些网站
# theHarvester
theHarvester -d target.com -b google,bing,linkedin
# hunter.io (API)
curl "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=YOUR_KEY"
# 验证邮箱
smtp-verify email@target.com
# 查找泄露密码
# HaveIBeenPwned API
curl "https://haveibeenpwned.com/api/v3/breachedaccount/email@example.com" \
-H "hibp-api-key: YOUR_KEY"
# phonenumbers (Python)
pip install phonenumbers
python3 -c "
import phonenumbers
from phonenumbers import geocoder, carrier, timezone
number = phonenumbers.parse('+8613800138000')
print(geocoder.description_for_number(number, 'zh'))
print(carrier.name_for_number(number, 'zh'))
print(timezone.time_zones_for_number(number))
"
# tinfoleak
pip install tinfoleak
# sn0int (框架)
# 收集推文、关注者、地理位置
# linkedin2username
git clone https://github.com/initstring/linkedin2username.git
python linkedin2username.py -c "Company Name"
# linkedin-scraper
pip install linkedin-scraper
# 搜索泄露的密钥
# GitHub Dorking
"target.com" password
"target.com" api_key
org:target secret
org:target password
# gitleaks
pip install gitleaks
gitleaks detect -s /path/to/repo
git clone https://github.com/laramies/metagoofil.git
python metagoofil.py -d target.com -t pdf,docx -l 100 -o output -f results.html
# 下载目标网站的PDF/DOC文件
wget -r -A pdf,doc,docx https://target.com/
# 提取元数据
exiftool -r /downloaded/documents/
# 关键信息
# - 作者名称
# - 公司名称
# - 软件版本
# - 创建时间
# - 文件路径(可能泄露内部结构)
# Google反向图片搜索
# https://images.google.com → 上传图片
# TinEye
# https://tineye.com
# Yandex图片搜索
# https://yandex.com/images/
# 从图片EXIF提取GPS
exiftool -GPSLatitude -GPSLongitude image.jpg
# 转换为十进制坐标
python3 -c "
lat = 39 + 54/60 + 26.4/3600 # 39°54'26.4"N
lon = 116 + 23/60 + 29.88/3600 # 116°23'29.88"E
print(f'{lat}, {lon}')
"
# Google Maps查看
# https://maps.google.com/?q=39.9073,116.3916
# whatweb
whatweb target.com
# Wappalyzer CLI
npm install -g wappalyzer
wappalyzer https://target.com
# BuiltWith
# https://builtwith.com/target.com
# Wayback Machine
curl "https://archive.org/wayback/available?url=target.com"
# 查看历史快照
# https://web.archive.org/web/*/target.com
# waybackurls
go install github.com/tomnomnom/waybackurls@latest
echo target.com | waybackurls > urls.txt
curl https://target.com/robots.txt
curl https://target.com/sitemap.xml
curl https://target.com/.well-known/security.txt
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot && pip install -r requirements.txt
# Web界面
python sf.py -l 127.0.0.1:5001
# 命令行
python sfcli.py -s target.com -m sfp_dnsresolve,sfp_whois
sudo apt install recon-ng
# 启动
recon-ng
# 创建工作区
workspaces create target
# 安装模块
marketplace install all
# 搜索模块
modules search whois
modules load recon/domains-hosts/hackertarget
# 设置选项
options set SOURCE target.com
run
https://osintframework.com
# 交互式决策树，引导你选择合适的OSINT工具
site:target.com # 限定域名
filetype:pdf # 文件类型
intitle:"index of" # 目录列表
inurl:admin # URL包含admin
intext:password # 内容包含password
cache:target.com # 缓存
link:target.com # 链接到目标
related:target.com # 相似网站
site:target.com filetype:pdf
site:target.com intitle:"index of"
site:target.com inurl:login
site:target.com ext:php inurl:?
site:target.com "api_key" OR "api_secret"
site:pastebin.com "target.com"
site:github.com "target.com" password
"target.com" "password" filetype:txt
intitle:"Dashboard" inurl:"/admin"