🔍 OSINT Recon — Open Source Intelligence Toolkit

Legitimate OSINT reconnaissance using only public data sources. Inspired by professional OSINT frameworks, built for Council operations.

⚠️ SAFETY RULES (NON-NEGOTIABLE)

┌─────────────────────────────────────────────────────────┐
│  🚫 NO breach/credential/leaked data lookups            │
│  🚫 NO phishing tools or social engineering scripts     │
│  🚫 NO dark web / .onion access                         │
│  🚫 NO password cracking or brute force                 │
│  🚫 NEVER store passwords, tokens, or leaked data       │
│  ✅ ALL searches use PUBLIC, openly accessible data      │
│  ✅ Respect robots.txt and rate limits                   │
│  ✅ Results are informational — verify before acting     │
└─────────────────────────────────────────────────────────┘

🎯 Agent Assignments

📦 Prerequisites

Required (standard on most Linux/macOS):

• curl — HTTP requests
• jq — JSON processing
• dig — DNS lookups (from dnsutils / bind-utils)
• openssl — SSL certificate inspection

Optional (enhanced functionality):

• exiftool — Full EXIF extraction (apt install libimage-exiftool-perl)
• whois — Domain WHOIS lookups (apt install whois)
• python3 + Pillow — Fallback EXIF extraction (pip3 install Pillow)

📋 Scripts

1. Username Enumeration — scripts/username-search.sh

Search for a username across 10 platforms: GitHub, Twitter/X, Instagram, LinkedIn, Facebook, TikTok, Telegram, Reddit, YouTube, Pinterest.

# Basic usage
bash scripts/username-search.sh johndoe

# Pipe to file
bash scripts/username-search.sh competitor_ceo > results.json

# Filter found only
bash scripts/username-search.sh johndoe | jq '.results[] | select(.status == "found")'

Output format:

{
  "username": "johndoe",
  "timestamp": "2026-04-05T01:00:00Z",
  "summary": {
    "total_checked": 10,
    "found": 4,
    "not_found": 5,
    "errors": 1
  },
  "results": [
    {
      "platform": "GitHub",
      "url": "https://github.com/johndoe",
      "status": "found",
      "http_code": 200
    }
  ]
}

Detection methods:

• Standard HTTP status code (200=found, 404=not found)
• Content-based detection for Telegram (always returns 200)
• Handles LinkedIn bot detection (999 status)
• Follows redirects with -L

2. EXIF Metadata Extraction — scripts/exif-extract.sh

Extract GPS coordinates, camera info, timestamps, and software from images.

# Extract metadata from an image
bash scripts/exif-extract.sh photo.jpg

# Check for GPS data specifically
bash scripts/exif-extract.sh photo.jpg | jq '.gps'

# Get camera model
bash scripts/exif-extract.sh photo.jpg | jq '.camera.model'

# Check if image was edited (software field)
bash scripts/exif-extract.sh photo.jpg | jq '.software'

Output includes:

• file — name, size, MIME type
• camera — make, model, lens, serial
• image — dimensions, orientation, color space
• gps — latitude, longitude, altitude, Google Maps URL
• datetime — original, created, modified, digitized
• software — editing software, creator tool
• settings — exposure, f-number, ISO, focal length, flash

Tool priority: exiftool → Python3/Pillow → error with install instructions

3. Domain Intelligence Scan — scripts/domain-scan.sh

Comprehensive domain analysis: DNS, SSL, security headers, technology detection, WHOIS.

# Full domain scan
bash scripts/domain-scan.sh example.com

# Check security headers only
bash scripts/domain-scan.sh example.com | jq '.http.security'

# List detected technologies
bash scripts/domain-scan.sh example.com | jq '.technologies'

# SSL certificate details
bash scripts/domain-scan.sh example.com | jq '.ssl'

# DNS records
bash scripts/domain-scan.sh example.com | jq '.dns'

Scans include:

1. DNS — A, AAAA, MX, TXT, NS, CNAME, SOA records
2. SSL — subject, issuer, validity dates, SAN domains, serial
3. Security headers — HSTS, CSP, X-Frame-Options, X-Content-Type-Options, XSS-Protection, Referrer-Policy, Permissions-Policy (with score)
4. Technology — detects 18+ technologies: WordPress, React, Next.js, Vue, Angular, Svelte, Shopify, Cloudflare, Vercel, Tailwind, Bootstrap, jQuery, Google Analytics, and more
5. WHOIS — registrar, creation/expiry dates, organization, name servers

4. Digital Footprint — scripts/footprint.sh

Map an email address to public profiles and online presence.

# Search for profiles linked to an email
bash scripts/footprint.sh user@example.com

# Get only confirmed matches
bash scripts/footprint.sh user@example.com | jq '.results[] | select(.status == "found")'

# Get probable matches (username correlation)
bash scripts/footprint.sh user@example.com | jq '.results[] | select(.status == "probable")'

Checks performed:

1. Gravatar — MD5 hash lookup, profile data extraction
2. GitHub — email-based search via API + username match
3. Twitter/X — username part correlation
4. Reddit — username part correlation
5. Keybase — public key directory lookup
6. Email domain — custom vs. free provider detection, website check, MX record analysis

Status values:

• found — confirmed match (email-linked or direct hit)
• probable — username matches email prefix (may not be same person)
• not_found — no match found
• detected — metadata discovered (e.g., email provider)

🔗 Integration with Existing Skills

domain-intel skill

The existing domain-intel skill provides Python-based domain reconnaissance. This toolkit complements it:

Recommendation: Use domain-intel for bulk/programmatic analysis and subdomain discovery. Use osint-recon/domain-scan.sh for quick single-domain deep dives with technology detection and security header audits.

🛠️ Troubleshooting

Rate limited on Instagram/LinkedIn? These platforms aggressively block automated requests. Results may show error or blocked. This is expected — don't retry aggressively.

exiftool not found? The EXIF script falls back to Python3 + Pillow automatically. Install exiftool for best results: apt install libimage-exiftool-perl

DNS queries failing? Ensure dig is installed: apt install dnsutils (Debian/Ubuntu) or yum install bind-utils (RHEL/CentOS).

jq not found? All scripts require jq: apt install jq

📜 Legal & Ethical Notice

This toolkit accesses only publicly available information. It does not:

• Access any private, restricted, or authenticated data
• Perform any unauthorized testing or scanning
• Store or process credentials, passwords, or breach data
• Circumvent any access controls or security measures

Users are responsible for ensuring their use complies with applicable laws, terms of service, and ethical guidelines. Results should be verified through official channels before taking action.