Menú
开源情报收集 — 社工、人肉搜索、域名/IP/邮箱情报、社交媒体
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Basado en la clasificación ocupacional SOC
Delegate coding to OpenAI Codex CLI (features, PRs).
Configure, extend, or contribute to Hermes Agent.
Manage multiple remote servers from Hermes via SSH — deploy services, configure firewalls, transfer files, run commands across servers
Clone/create/fork repos; manage remotes, releases.
Parallel data collection from web sources, APIs, and documentation sites
Deploy static sites to GitHub Pages via API — create repo, push, enable Pages, all from CLI
| name | osint |
| description | 开源情报收集 — 社工、人肉搜索、域名/IP/邮箱情报、社交媒体 |
| version | 1.0.0 |
| author | Hermes Agent |
| license | MIT |
| metadata | {"hermes":{"tags":["osint","social-engineering","reconnaissance","people-search","domain-intel"]}} |
| 工具 | 用途 |
|---|---|
| Maltego | 关系图谱分析 |
| Recon-ng | 信息收集框架 |
| theHarvester | 邮箱/域名/IP收集 |
| Shodan | 设备/服务搜索引擎 |
| Censys | 互联网设备搜索 |
| SpiderFoot | 自动化OSINT |
| Sherlock | 社交媒体用户名搜索 |
| holehe | 邮箱关联账户查询 |
| Photon | 网站爬取 |
| Wayback Machine | 历史网页快照 |
| WHOIS | 域名注册信息 |
| DNSrecon | DNS枚举 |
| Amass | 子域名枚举 |
| Metagoofil | 文档元数据提取 |
| Creepy | 地理位置情报 |
| tinfoleak | Twitter情报 |
whois target.com
whois 192.168.1.1
# 提取关键信息
whois target.com | grep -E 'Registrar|Name Server|Creation Date|Registrant'
# 基本查询
dig target.com ANY
dig target.com A
dig target.com MX
dig target.com TXT
dig target.com NS
dig target.com CNAME
# 反向DNS
dig -x 192.168.1.1
# 区域传送(如果允许)
dig @ns1.target.com target.com AXFR
# 子域名爆破
dnsrecon -d target.com -t brt
dnsrecon -d target.com -t std
# subfinder
subfinder -d target.com -silent
# amass
amass enum -d target.com
amass enum -d target.com -passive
pip install shodan
# 设置API key
export SHODAN_API_KEY="your_key"
# 搜索
shodan search "org:Target port:80"
shodan search "product:apache country:CN"
shodan search "http.title:login"
shodan search "ssl:target.com"
# 主机信息
shodan host 192.168.1.1
# 命令行
shodan init YOUR_API_KEY
shodan scan submit 192.168.1.0/24
shodan stats --facets country,port vuln:ms17-010
pip install censys
# 搜索证书
censys search "parsed.subject.common_name: target.com"
# 搜索主机
censys search "services.port=443 AND location.country=China"
# 查看特定主机
censys view 192.168.1.1
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock && pip install -r requirements.txt
# 搜索用户名
python sherlock.py username123
# 搜索多个用户名
python sherlock.py user1 user2 user3
# 输出到文件
python sherlock.py username123 -o output.txt
# 指定站点
python sherlock.py username123 --site twitter,instagram,github
pip install holehe
holehe email@example.com
# 输出: 该邮箱注册了哪些网站
# theHarvester
theHarvester -d target.com -b google,bing,linkedin
# hunter.io (API)
curl "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=YOUR_KEY"
# 验证邮箱
smtp-verify email@target.com
# 查找泄露密码
# HaveIBeenPwned API
curl "https://haveibeenpwned.com/api/v3/breachedaccount/email@example.com" \
-H "hibp-api-key: YOUR_KEY"
# phonenumbers (Python)
pip install phonenumbers
python3 -c "
import phonenumbers
from phonenumbers import geocoder, carrier, timezone
number = phonenumbers.parse('+8613800138000')
print(geocoder.description_for_number(number, 'zh'))
print(carrier.name_for_number(number, 'zh'))
print(timezone.time_zones_for_number(number))
"
# tinfoleak
pip install tinfoleak
# sn0int (框架)
# 收集推文、关注者、地理位置
# linkedin2username
git clone https://github.com/initstring/linkedin2username.git
python linkedin2username.py -c "Company Name"
# linkedin-scraper
pip install linkedin-scraper
# 搜索泄露的密钥
# GitHub Dorking
"target.com" password
"target.com" api_key
org:target secret
org:target password
# gitleaks
pip install gitleaks
gitleaks detect -s /path/to/repo
git clone https://github.com/laramies/metagoofil.git
python metagoofil.py -d target.com -t pdf,docx -l 100 -o output -f results.html
# 下载目标网站的PDF/DOC文件
wget -r -A pdf,doc,docx https://target.com/
# 提取元数据
exiftool -r /downloaded/documents/
# 关键信息
# - 作者名称
# - 公司名称
# - 软件版本
# - 创建时间
# - 文件路径(可能泄露内部结构)
# Google反向图片搜索
# https://images.google.com → 上传图片
# TinEye
# https://tineye.com
# Yandex图片搜索
# https://yandex.com/images/
# 从图片EXIF提取GPS
exiftool -GPSLatitude -GPSLongitude image.jpg
# 转换为十进制坐标
python3 -c "
lat = 39 + 54/60 + 26.4/3600 # 39°54'26.4"N
lon = 116 + 23/60 + 29.88/3600 # 116°23'29.88"E
print(f'{lat}, {lon}')
"
# Google Maps查看
# https://maps.google.com/?q=39.9073,116.3916
# whatweb
whatweb target.com
# Wappalyzer CLI
npm install -g wappalyzer
wappalyzer https://target.com
# BuiltWith
# https://builtwith.com/target.com
# Wayback Machine
curl "https://archive.org/wayback/available?url=target.com"
# 查看历史快照
# https://web.archive.org/web/*/target.com
# waybackurls
go install github.com/tomnomnom/waybackurls@latest
echo target.com | waybackurls > urls.txt
curl https://target.com/robots.txt
curl https://target.com/sitemap.xml
curl https://target.com/.well-known/security.txt
git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot && pip install -r requirements.txt
# Web界面
python sf.py -l 127.0.0.1:5001
# 命令行
python sfcli.py -s target.com -m sfp_dnsresolve,sfp_whois
sudo apt install recon-ng
# 启动
recon-ng
# 创建工作区
workspaces create target
# 安装模块
marketplace install all
# 搜索模块
modules search whois
modules load recon/domains-hosts/hackertarget
# 设置选项
options set SOURCE target.com
run
https://osintframework.com
# 交互式决策树，引导你选择合适的OSINT工具
site:target.com # 限定域名
filetype:pdf # 文件类型
intitle:"index of" # 目录列表
inurl:admin # URL包含admin
intext:password # 内容包含password
cache:target.com # 缓存
link:target.com # 链接到目标
related:target.com # 相似网站
site:target.com filetype:pdf
site:target.com intitle:"index of"
site:target.com inurl:login
site:target.com ext:php inurl:?
site:target.com "api_key" OR "api_secret"
site:pastebin.com "target.com"
site:github.com "target.com" password
"target.com" "password" filetype:txt
intitle:"Dashboard" inurl:"/admin"