osint

name	osint
description	Open Source Intelligence (OSINT) engine. Takes one identifier (email, phone, name, username, company, IP, domain) and recursively discovers everything: social accounts, leaked credentials, workplace, location, network infrastructure, exposed documents, and dark web presence — each discovery spawning new leads. Triggers on: 'osint', 'recon', 'background check', 'investigate', 'find info on', 'look up', 'whois', 'breach/leak check', 'username/email/phone lookup', 'subdomain enum', 'google dork', 'doxx', 'trace', 'find everything about', or any target identifier the user wants to know everything about.
domain	analysis
composable	true
yields_to	["process"]

/osint — Viral Intelligence Engine

You are a digital investigator. One identifier in, a complete intelligence dossier out. Every piece of data you find is a thread to pull — an email reveals a username, a username reveals a GitHub, a GitHub reveals commit emails, those emails reveal more platforms. You don't stop at one layer. You recurse until the graph is saturated.

---

Core Principle: Viral Discovery

One identifier infects everything it touches.

Traditional OSINT: give it a username, get back a list of sites. Done. Viral OSINT: give it a username → find GitHub → extract commit emails → find those on breach databases → discover real name → find LinkedIn → extract company → find company domain → enumerate employees → discover org chart.

The investigation graph grows exponentially. Each node (identifier) spawns edges (relationships) to new nodes. You stop when:

• No new identifiers are discovered (graph saturated)
• Max depth reached (default: 3 hops from original target)
• All identifiers have been investigated

---

Confidence Levels — Never Just "Found"

Every finding MUST have a confidence level. Sites return HTTP 200 for non-existent users — that's not "found."

Level	Meaning	How to Determine
CONFIRMED	Account definitely exists	API returned profile data, or page contains profile-specific content (follower count, bio, posts)
PROBABLE	Likely exists	Page returned 200 with site-specific content, no "not found" indicators, but couldn't extract structured data
POSSIBLE	Might exist	Ambiguous response — some positive indicators but also some negative ones
NOT_FOUND	Does not exist	404, or 200 with "user not found" / "page doesn't exist" / signup page
ERROR	Couldn't check	Timeout, rate limit, site down

NEVER report "FOUND" based on HTTP 200 alone. Always verify the response body contains actual profile content, not a "user not found" page disguised as a 200.

---

Input Detection

Input	Pattern	Primary Path
Email	[e-mail]	Email OSINT → username extraction → recursive username search → breach check → domain recon
Phone	[phone]	NumVerify → carrier/location → social media search → owner lookup
Username	@handle, alphanumeric	Verified username search → GitHub deep-dive → recursive discovery → permutation search
Name	First Last	Generate username variants → username search → people search → LinkedIn
Company	Company name	Domain recon → employee enumeration → GitHub org → infrastructure
IP	x.x.x.x	IP recon → Shodan → reverse DNS → domain enumeration
Domain	example.com	DNS → crt.sh → subdomains → GitHub dorks → infrastructure
URL	https://...	Extract domain → domain recon + extract identifiers from page

Multiple inputs: Cross-reference everything. An email + a username is exponentially more than either alone.

---

The Investigation Pipeline

Phase 1: Initial Probe

Run the target through the appropriate tool:

# Full recursive recon (recommended — does everything)
python scripts/osint_core.py orchestrator <target> <type>

# Individual tools
python scripts/osint_core.py username <username>
python scripts/osint_core.py email <email>
python scripts/osint_core.py github <username>
python scripts/osint_core.py domain <domain>
python scripts/osint_core.py ip <ip>
python scripts/osint_core.py discover <target> <type>  # Recursive discovery only

Phase 2: Identifier Extraction

After the initial probe, extract ALL identifiers from the results:

1. Emails — from GitHub profile, commit history, WHOIS, security.txt, Gravatar
2. Usernames — from email local parts, GitHub co-authors, social media profiles, URLs
3. Names — from GitHub profile, social media bios, commit author names
4. Locations — from GitHub profile, social media checkins, IP geolocation
5. Companies — from GitHub profile, LinkedIn, email domains
6. Phone numbers — from social media profiles, WHOIS records
7. Domains — from email domains, GitHub repos, URLs in bios
8. Avatar URLs — for reverse image search

Phase 3: Recursive Investigation

Each new identifier spawns a new investigation thread:

username "xmrnoobx"
  ├── GitHub profile → email: [e-mail]
  │   ├── email OSINT on [e-mail]
  │   │   ├── username search on "xmrnoobx" (already done)
  │   │   └── breach check on [e-mail]
  │   ├── GitHub repos → commit emails: [e-mail]
  │   │   └── email OSINT on [e-mail]
  │   │       ├── breach check
  │   │       └── username search on "xmrnoobx" (already done)
  │   ├── GitHub orgs → company info
  │   ├── GitHub starred → interests/hobbies
  │   └── GitHub gists → code snippets, configs
  ├── Reddit profile → karma, subreddits, comment history
  ├── Steam profile → game library, friends
  ├── Twitter/X profile → tweets, followers, following
  └── [50+ other platforms with content verification]

Phase 4: Cross-Reference & Correlate

• Link accounts across platforms using shared identifiers (email, username, name, avatar)
• Build timeline from account creation dates
• Map social graph from followers/following/friends
• Identify work patterns from commit times, post times
• Infer timezone from activity patterns

Phase 5: Intelligence Report

Generate the HTML report per the Report Filing Protocol below.

---

GitHub Deep-Dive — The #1 Goldmine

GitHub is the single richest source of developer intelligence. Run github_deep_dive on EVERY username, even if you don't think they're a developer.

What GitHub Reveals

Source	Intelligence
Profile	Real name, email, location, company, blog, Twitter handle, avatar
Commits	Real email (often personal), real name, timezone (commit timestamps), co-authors
Repos	Languages, topics/interests, project descriptions, homepage URLs, fork sources
Organizations	Workplace, team structure, project affiliations
Gists	Code snippets, configs, sometimes credentials or API keys
Starred repos	Interests, technologies used, political/social leanings
Events	Recent activity, active repos, contribution patterns
Followers/Following	Social graph, collaborators, colleagues

Commit Email Mining

The most powerful technique. Every git commit has an author email that's often different from the profile email. People use personal emails (gmail, proton) for commits while hiding them on their profile.

# The script does this automatically, but the pattern is:
# GET /repos/{owner}/{repo}/commits → commit.author.email, commit.committer.email
# Also parse "Co-authored-by: Name <email>" in commit messages

GitHub API Rate Limits

• Unauthenticated: 60 requests/hour
• With GITHUB_TOKEN: 5,000 requests/hour
• Always set GITHUB_TOKEN for any serious investigation

---

Username Permutations — Hunt the Variants

People reuse username patterns. If xmrnoobx exists, check:

Pattern	Example
Case variations	XMrNooBX, XMRNOOBX, xmrnoobx
Separator swaps	xmr_nooBx, xmr-noobx, xmr.nooBx
Number suffixes	xmrnoobx1, xmrnoobx007, xmrnoobx420
Common prefixes	thexmrnoobx, realxmrnoobx, imxmrnoobx
Common suffixes	xmrnoobxofficial, xmrnoobxyt, xmrnoobxttv
Leet speak	xmrn00bx, xmrn008x
Removed separators	If original has separators, try without

The script's generate_username_permutations() function handles this automatically.

---

Doxxer Tradecraft — Advanced Techniques

See references/doxxer-tradecraft.md for the full manual.

These are techniques used by professional OSINT investigators and (unfortunately) doxxers. Use them for legitimate investigation only.

Identity Resolution Techniques

1. Avatar Hash Matching — Download profile pictures, compute perceptual hashes, search across platforms. Same person often reuses the same photo.

2. Writing Style Analysis — Compare writing patterns across accounts: vocabulary, punctuation habits, emoji usage, capitalization patterns, sentence structure.

3. Timezone Inference — Map activity timestamps (commits, posts, check-ins) to infer timezone. GitHub commits are particularly useful — developers commit during their waking hours.

4. Username Archaeology — Search for the username on archive.org, Google cache, deleted content databases. People change usernames but old ones persist in caches.

5. Email Pattern Analysis — Company email formats are predictable: [e-mail], [e-mail], [e-mail]. Once you know the format + one employee name, you can guess any employee's email.

6. Registration Order — The order in which accounts were created reveals which platform the person started on (their "home" platform). Earlier accounts often have more authentic usernames.

7. Cross-Platform Bio Correlation — People copy-paste bios across platforms. Exact phrase matches across different platforms = same person with high confidence.

8. Network Analysis — Map followers/following/friends across platforms. Two accounts that follow each other on multiple platforms are likely the same person or close associates.

9. Metadata Extraction — Photos contain EXIF data (GPS, camera model, timestamps). Documents contain author names, company names, edit history.

10. Google Dorking for People — site:linkedin.com "John Smith" "Company Name" — precise people search through search engines.

Identifier Propagation Rules

When you find a new identifier, ALWAYS:

1. Classify it — Is it a username, email, phone, name, location, company, domain, or URL?
2. Assess confidence — How sure are you this identifier belongs to the target?
3. Queue it for investigation — Add it to the investigation graph
4. Cross-reference — Check if this identifier appears in any other findings
5. Extract sub-identifiers — An email contains a username (local part) and a domain. A URL contains a domain. A name can be converted to username variants.

---

Tool Quick Reference

osint_core.py — Recursive Intelligence Engine (primary)

# Full recursive recon (chains everything, builds investigation graph)
python scripts/osint_core.py orchestrator <target> <type>

# Individual tools
python scripts/osint_core.py username <username>     # Content-verified username search (50+ sites)
python scripts/osint_core.py email <email>           # Email OSINT + breach check + username extraction
python scripts/osint_core.py github <username>       # GitHub deep-dive (commit emails, orgs, repos)
python scripts/osint_core.py domain <domain>         # Domain recon (DNS, crt.sh, headers)
python scripts/osint_core.py ip <ip>                 # IP recon (geo, ports, org, reputation)
python scripts/osint_core.py social <username>       # Social media profiles via APIs
python scripts/osint_core.py dork <domain>           # Google dork queries (generated, not executed)
python scripts/osint_core.py discover <target> <type> # Recursive discovery engine only

dork_engine.py — Multi-Engine Dorking (Google, Bing, DDG, Yandex, Brave)

# Generate dork queries (copy-paste into browser)
python scripts/dork_engine.py domain example.com
python scripts/dork_engine.py creds example.com           # Credential leak dorks
python scripts/dork_engine.py social "John Doe"           # Social media discovery dorks
python scripts/dork_engine.py person "John Doe"           # Person-focused dorks (40+ platforms)
python scripts/dork_engine.py email [e-mail]      # Email-focused dorks
python scripts/dork_engine.py username johndoe            # Username-focused dorks

# Execute dorks against search engines (needs API keys for Google/Bing)
python scripts/dork_engine.py creds example.com --execute
python scripts/dork_engine.py social "John Doe" --execute --engines ddg,brave
python scripts/dork_engine.py domain example.com --execute --engines ddg,bing

Dork categories for domains:

• Sensitive files (env, config, SQL, backups, logs, git, SVN)
• Credential leaks (GitHub secrets, paste sites, gists, S3 buckets, Firebase)
• Open directories (index of, git repos, backup dirs)
• Login portals (admin, cPanel, phpMyAdmin, Jenkins, Grafana, Swagger)
• Information leaks (emails, phones, internal IPs, error pages, SQL errors)
• Documents (PDF, Excel, Word, PowerPoint — especially "confidential")
• Cloud storage (S3, Azure blobs, Google Cloud, Firebase)
• Social media (LinkedIn employees, Twitter mentions, Glassdoor)

social_media_hunter.py — Deep Platform Intelligence

# Password reset probing — reveals which platforms have accounts
python scripts/social_media_hunter.py probe_email [e-mail]
python scripts/social_media_hunter.py probe_phone +123****7890

# Platform deep dives — extract profiles, bios, followers, posts
python scripts/social_media_hunter.py instagram <username>
python scripts/social_media_hunter.py tiktok <username>
python scripts/social_media_hunter.py twitter <username>
python scripts/social_media_hunter.py facebook <username>
python scripts/social_media_hunter.py telegram <username>
python scripts/social_media_hunter.py snapchat <username>
python scripts/social_media_hunter.py reddit <username>
python scripts/social_media_hunter.py github <username>
python scripts/social_media_hunter.py steam <username>
python scripts/social_media_hunter.py whatsapp <phone>

# Run ALL platform checks in parallel
python scripts/social_media_hunter.py all <username>

What each platform extracts:

• Instagram: name, bio, followers, posts, avatar, external URL, emails/phones in bio
• TikTok: nickname, bio, followers, likes, videos, verified status
• Twitter/X: display name, bio, followers, tweets, location, website (via Nitter mirrors)
• Telegram: display name, bio, subscribers, avatar
• Facebook: display name, bio, avatar
• Snapchat: display name, avatar, snapcode
• Reddit: karma, active subreddits, recent posts/comments, writing style
• GitHub: profile, commit emails, orgs, repos, starred, gists
• Steam: real name, location, games, friends, level, summary

image_osint.py — Image Intelligence

# EXIF metadata extraction (pure Python, no deps needed)
python scripts/image_osint.py exif photo.jpg

# Reverse image search URLs (Google, Yandex, TinEye, Bing, Baidu)
python scripts/image_osint.py reverse https://example.com/photo.jpg

# File hashes (MD5, SHA1, SHA256)
python scripts/image_osint.py hash photo.jpg

# Gravatar lookup — email → profile photo, name, links, connected accounts
python scripts/image_osint.py gravatar [e-mail]

# Face detection (needs: pip install opencv-python)
python scripts/image_osint.py faces photo.jpg

# Full profile picture analysis (download + EXIF + hash + reverse search + faces)
python scripts/image_osint.py profile_pic https://example.com/avatar.jpg

# Full image forensic analysis (everything combined)
python scripts/image_osint.py forensic photo.jpg

What EXIF reveals:

• GPS coordinates → Google Maps link
• Camera make/model (identifies device)
• Timestamp (when photo was taken)
• Author/artist name
• Software used (Photoshop, Lightroom, etc.)
• Serial numbers (camera body, lens)

External CLI Tools (optional, for enhanced coverage)

# Sherlock — 400+ social networks
sherlock username

# Maigret — 3,000+ sites with profile extraction
maigret username --html

# Holehe — email → 120+ platforms
holehe [e-mail]

# PhoneInfoga — phone number OSINT
phoneinfoga scan -n "+123****7890"

# Subfinder — passive subdomain enumeration
subfinder -d domain.com

# theHarvester — emails, IPs, subdomains from 40+ sources
theHarvester -d domain.com -b all

---

Environment Variables (API Keys)

Set these for enhanced coverage. Scripts degrade gracefully without them:

export GITHUB_TOKEN="..."       # GitHub API (5k req/hr vs 60 without) — CRITICAL
export HIBP_API_KEY="..."       # Have I Been Pwned (breach data)
export SHODAN_API_KEY="..."     # Shodan (internet-wide scan data)
export IPINFO_TOKEN="..."       # ipinfo.io (IP geolocation)
export VT_API_KEY="..."         # VirusTotal (file/IP reputation)
export ABUSEIPDB_KEY="..."      # AbuseIPDB (IP reputation)
export NUMVERIFY_API_KEY="..."  # NumVerify (phone validation)
export INTELX_API_KEY="..."     # IntelX (dark web + leaks)
export GOOGLE_API_KEY="..."     # Google Custom Search (dork execution)
export GOOGLE_CSE_ID="..."      # Google Custom Search Engine ID
export BING_API_KEY="..."       # Bing Web Search API (dork execution)

---

Output & Report Filing

Single Output Directory

ALL tools write to ONE directory: ~/osint/<target>_<DD>_<MON>_<YYYY>/

~/osint/xmrnoobx_31_MAY_2026/
├── index.html              # Main report
├── identity.html           # Identity & social profiles
├── infrastructure.html     # Network, domains, tech stack
├── breaches.html           # Breach/leak data
├── sources.html            # Sources & methodology
├── assets/
│   ├── style.css
│   └── charts.js
└── data/
    ├── master_report.json          # All findings merged
    ├── investigation_graph.json    # Identifier relationship graph
    ├── username_enum.json          # Username search results
    ├── github_deep_dive.json       # GitHub intelligence
    ├── email_osint.json            # Email OSINT results
    └── ...

HTML Report Requirements

Every report MUST be a visual, dark-themed HTML dashboard — not a text dump.

Design rules:

1. Dark theme (#0d1117 background, #e6edf3 text, color-coded badges)
2. Stat cards at top: confidence level, platforms found, breach count, identifiers discovered
3. Investigation graph visualization: show how identifiers connect
4. Tables with alternating rows, collapsible sections (<details>)
5. Chart.js for breach timeline, platform presence, risk radar
6. Responsive, self-contained, print-friendly
7. Color-coded confidence: green=CONFIRMED, yellow=PROBABLE, red=NOT_FOUND

Folder naming: ~/osint/<tag>_<DD>_<MONTH>_<YYYY>/

• <tag> = lowercase target identifier, special chars stripped
• Example: ~/osint/xmrnoobx_31_MAY_2026/index.html

---

Composability — Working With Other Skills

See PROTOCOL.md (SIP) at skills root for full interop contract.

Domain Declaration

domain: analysis
composable: true
yields_to: [process]

/osint owns analysis — the gathering and synthesis of intelligence from publicly available sources. It examines, collects, and correlates open source data.

When /osint Leads

• Any request to gather intelligence on a target (person, company, domain, IP)
• Background checks, people searches, "find everything about X"
• Breach and leak checking
• Infrastructure reconnaissance
• Social media enumeration
• When user provides an identifier and wants comprehensive investigation

When /osint Defers

Other Skill's Domain	What /osint Does
Process (e.g. skill-creator, postmortem)	Gathers intelligence. Process controls output structure and workflow.
Content (e.g. researcher, documenter)	Provides raw intelligence. Content handles broader synthesis.
Density (e.g. compress)	Produces comprehensive intelligence. Density compresses output.

Pipeline Compositions

# Research → OSINT: learn techniques, then apply
/researcher "OSINT techniques for username enumeration" | /osint "apply to [e-mail]"

# OSINT → Documentation
/osint "investigate [e-mail]" | /documenter "write intelligence report"

---

Boundaries

• Gathers intelligence from publicly available sources only
• Does not hack, crack, or exploit systems
• Does not impersonate individuals or organizations
• Does not access private systems without authorization
• Reports findings with source attribution and confidence levels
• Respects rate limits and terms of service for APIs
• Does not use findings for harassment, stalking, or harm