v0.5.0 — Brazilian context module (CNPJ, CEP, BR dork pack)

osint-recon v0.5.0

Passive OSINT reconnaissance framework in Rust — for authorized security assessments only.

Highlights

Modules (10)

Command	What it does	ATT&CK
subdomain	Passive subdomain enum (crt.sh + hackertarget fallback)	T1590
dns	DNS records via DoH (A, AAAA, MX, NS, TXT)	T1590
asn	IP → ASN / AS name / prefix (Team Cymru over DoH, keyless)	T1590.001
ct	Certificate transparency history, CA stats, expiring certs (crt.sh)	T1596.003
ghdork	GitHub exposure dorks — repos/users keyless, code-search with token	T1593.003
br cnpj	🇧🇷 Brazilian company lookup (BrasilAPI + ReceitaWS fallback)	T1591
br cep	🇧🇷 Brazilian postal code → address (+ coordinates)	T1591
br dorks	🇧🇷 Brazilian dork pack — ready-to-open Google/Shodan URLs	T1593
tech	Technology fingerprint (headers + HTML signatures)	T1592
email	Email harvesting from public pages	T1589.002
metadata	PDF metadata extraction (author, creator tool, dates)	T1593
full	All domain modules combined, JSON + CSV export	—

New in v0.5.0 — Brazilian context module (br)

• br cnpj — company lookup via keyless BrasilAPI with ReceitaWS fallback (3 req/min respected with per-source throttling). Validates the classic numeric format with mod-11 check digits and the new alphanumeric CNPJ format valid since July 2026.
• br cep — address resolution via BrasilAPI v2 (coordinates when available) with ViaCEP fallback.
• br dorks — Brazilian OSINT dork pack (exposed SQL/backups on .br/.com.br, gov.br/mil.br docs, PowerBI, WhatsApp/Telegram indexation, Shodan country:"BR"). No scraping — generates ready-to-open URLs for manual use.
• LGPD by design (Lei 13.709/2018): public business/address data only — the module never handles personal data (CPF).

Quality

• 37/37 tests passing · clippy -D warnings clean · cargo fmt enforced
• CI: fmt → clippy → test → build on every push/PR
• Polite by default: 1 req/s rate limiting, per-source throttles, timeouts, retries, graceful degradation

Changelog

• v0.5.0 — Brazilian context module: CNPJ, CEP, BR dork pack
• v0.4.0 — demo GIF, --stdout/JSONL mode, stdin batch targets, release matrix CI
• v0.3.0 — GitHub dorking module (keyless tier + optional token tier with 5 code-search dorks)
• v0.2.0 — ASN & netblock enumeration, certificate transparency history, CI workflow
• v0.1.0 — initial release: 5 modules, CLI, JSON/CSV export

v0.4.0 — JSONL composability, stdin targets, prebuilt binaries

osint-recon v0.4.0

Passive OSINT reconnaissance framework in Rust — for authorized security assessments only.

Highlights

Modules (9)

Command	What it does	ATT&CK
subdomain	Passive subdomain enum (crt.sh + hackertarget fallback)	T1590
dns	DNS records via DoH (A, AAAA, MX, NS, TXT)	T1590
asn	IP → ASN / AS name / prefix (Team Cymru over DoH, keyless)	T1590.001
ct	Certificate transparency history, CA stats, expiring certs (crt.sh)	T1596.003
ghdork	GitHub exposure dorks — repos/users keyless, code-search with token	T1593.003
tech	Technology fingerprint (headers + HTML signatures)	T1592
email	Email harvesting from public pages	T1589.002
metadata	PDF metadata extraction (author, creator tool, dates)	T1593
full	All modules combined, JSON + CSV export	—

New in v0.4.0

• JSONL composability — --stdout emits one JSON object per result on stdout (banner/logs move to stderr): osint-recon dns example.com --stdout | jq .
• stdin batch targets — pass - as the target: cat domains.txt | osint-recon asn - --stdout
• Demo GIF in the README, rendered from real tool output
• Prebuilt binaries — Windows (x86_64 zip), Linux (x86_64 tar.gz), macOS (aarch64 tar.gz) + checksums-sha256.txt, built by the new release-matrix workflow

Quality

• 23/23 tests passing · clippy -D warnings clean · cargo fmt enforced
• CI: fmt → clippy → test → build on every push/PR
• Polite by default: 1 req/s rate limiting, timeouts, retries, graceful degradation

Changelog

• v0.4.0 — demo GIF, --stdout/JSONL mode, stdin batch targets, release matrix CI
• v0.3.0 — GitHub dorking module (keyless tier + optional token tier with 5 code-search dorks)
• v0.2.0 — ASN & netblock enumeration, certificate transparency history, CI workflow
• v0.1.0 — initial release: 5 modules, CLI, JSON/CSV export

v0.3.0 — GitHub dorking + 8 modules

osint-recon v0.3.0

Passive OSINT reconnaissance framework in Rust — for authorized security assessments only.

Highlights

Modules (8)

Command	What it does	ATT&CK
subdomain	Passive subdomain enum (crt.sh + hackertarget fallback)	T1590
dns	DNS records via DoH (A, AAAA, MX, NS, TXT)	T1590
asn	IP → ASN / AS name / prefix (Team Cymru over DoH, keyless)	T1590.001
ct	Certificate transparency history, CA stats, expiring certs (crt.sh)	T1596.003
ghdork	GitHub exposure dorks — repos/users keyless, code-search with token	T1593.003
tech	Technology fingerprint (headers + HTML signatures)	T1592
email	Email harvesting from public pages	T1589.002
metadata	PDF metadata extraction (author, creator tool, dates)	T1593
full	All modules combined, JSON + CSV export	—

Quality

• 18/18 tests passing · clippy -D warnings clean · cargo fmt enforced
• CI: fmt → clippy → test → build on every push/PR
• Polite by default: 1 req/s rate limiting, timeouts, retries, graceful degradation

Changelog

• v0.3.0 — GitHub dorking module (keyless tier + optional token tier with 5 code-search dorks)
• v0.2.0 — ASN enumeration and CT history modules, CI workflow
• v0.1.0 — Initial release: 5 core modules, CLI, JSON/CSV export

Install

From source (Rust 1.95+):

cargo install --git https://github.com/JMarchiori13/osint-recon

Prebuilt binary: osint-recon-v0.3.0-windows-x86_64.zip below (Windows x64).

Usage

osint-recon full example.com --json report.json
osint-recon ct example.com
osint-recon ghdork example.com            # keyless
OSINT_RECON_GITHUB_TOKEN=ghp_... osint-recon ghdork example.com

⚠️ For authorized security assessments and research only. See the disclaimer.

SHA-256 osint-recon-v0.3.0-windows-x86_64.zip:

ad6f91141cc5fb738f07ba64689aae55290d3acb33be0dd8285fdeb79b7031a2