Identity Social Network Intelligence Scripts

Identity, Social & Network Intelligence Scripts

This section details the specialized scripts within the claude-sleuth toolkit designed for identity attribution, social footprinting, and network infrastructure analysis. These tools are primarily utilized during Phase 3 (Collation & Entity Resolution) and Phase 4 (Chronological & Relational Processing) to transform raw identifiers (usernames, domains, coordinates) into actionable intelligence.

1. Username Enumeration & Social Footprinting

The toolkit integrates with industry-standard username enumeration tools to map a subject's digital footprint across thousands of platforms. While the primary logic resides in external tools like Sherlock and Maigret, claude-sleuth provides the programmatic glue to ingest these results into the investigation workflow.

Implementation Details

The system leverages Maigret for its advanced profile-page parsing and metadata extraction capabilities. It also references Holehe for email-based registration checks via password-reset probing.

Tool	Scope	Key Capability
Sherlock	400+ sites	Rapid URL existence checks
Maigret	3,000+ sites	Metadata extraction and recursive search
Holehe	120+ sites	Email registration and recovery info

---

2. Domain & Network Intelligence (domain_intel.py)

The DomainIntel class in scripts/domain_intel.py provides a unified pipeline for infrastructure investigation. It is designed to be "zero-auth" and "zero-cost," relying on public DNS, RDAP, and Certificate Transparency logs.

Core Components

• DNSCollector: Enumerates standard records including A, AAAA, MX, NS, TXT, and CNAME.
• CrtSh: Queries Certificate Transparency logs to discover subdomains and historical SSL/TLS certificates.
• RDAP: Performs Registration Data Access Protocol lookups for domain ownership and registrar events.
• ShodanInternetDB: Enriches resolved IP addresses with open port and vulnerability data without requiring an API key.

Domain Investigation Data Flow

The following diagram illustrates how DomainIntel.investigate() orchestrates multiple sub-collectors to build a comprehensive report.

Domain Intelligence Orchestration

graph TD
    "Input_Domain" --> "DomainIntel.investigate()"
    "DomainIntel.investigate()" --> "DNSCollector.query_all()"
    "DomainIntel.investigate()" --> "RDAP.lookup()"
    "DomainIntel.investigate()" --> "CrtSh.search()"
    "DomainIntel.investigate()" --> "ShodanInternetDB.lookup()"
    
    subgraph "External_Services"
        "DNSCollector.query_all()" -- "Port_53" --> "Public_DNS"
        "RDAP.lookup()" -- "HTTPS" --> "rdap.org"
        "CrtSh.search()" -- "HTTPS" --> "crt.sh"
        "ShodanInternetDB.lookup()" -- "HTTPS" --> "internetdb.shodan.io"
    end

    "DNSCollector.query_all()" --> "Final_Report"
    "RDAP.lookup()" --> "Final_Report"
    "CrtSh.search()" --> "Final_Report"
    "ShodanInternetDB.lookup()" --> "Final_Report"

Loading

---

3. Geolocation & Imagery Analysis (geolocation.py)

The GeoToolkit class in scripts/geolocation.py provides technical support for image-based geolocation (IMINT) and chronolocation.

Key Functions

• extract_exif(): Extracts GPS coordinates, camera make/model, and original timestamps from image files using exifread.
• sun_position(): Uses pysolar to calculate the sun's altitude and azimuth for a specific coordinate and time, enabling shadow-based verification.
• historical_weather(): Queries the Open-Meteo API to verify if weather conditions in an image (e.g., cloud cover, rain) match the reported time and place.
• reverse_geocode(): Converts decimal coordinates into human-readable addresses using geopy and the Nominatim service.

Coordinate & Metadata Extraction Flow

This diagram maps the transition from a physical image file to structured geolocation data entities used by the GeoToolkit.

Imagery Intelligence Processing

graph LR
    "Image_File" --> "GeoToolkit.extract_exif()"
    "GeoToolkit.extract_exif()" --> "dms_to_decimal()"
    "dms_to_decimal()" --> "GPS_Coordinates"
    
    subgraph "Verification_Engines"
        "GPS_Coordinates" --> "GeoToolkit.sun_position()"
        "GPS_Coordinates" --> "GeoToolkit.historical_weather()"
        "GPS_Coordinates" --> "GeoToolkit.reverse_geocode()"
    end
    
    "GeoToolkit.sun_position()" --> "Shadow_Analysis"
    "GeoToolkit.historical_weather()" --> "Atmospheric_Verification"
    "GeoToolkit.reverse_geocode()" --> "Address_Entity"

Loading

---

4. API Requirements & Setup

Most tools in this category are designed for "zero-auth" operation, but some require specific environment configurations or optional dependencies managed via setup.py.

Dependency Groups

To use these scripts, the following module groups should be installed via sleuth-setup:

• identity: Required for username enumeration.
• network: Required for domain_intel.py (includes dnspython, tldextract).
• geo: Required for geolocation.py (includes exifread, pysolar, geopy).

Usage Examples

Domain Intelligence

from scripts.domain_intel import DomainIntel
di = DomainIntel()
report = di.investigate("example.com")
# Access DNS records
print(report["sections"]["dns"])

Geolocation & Sun Analysis

from scripts.geolocation import GeoToolkit
gt = GeoToolkit()
# Extract EXIF
exif = gt.extract_exif("evidence/photo_001.jpg")
# Verify sun position for a timestamp
sun = gt.sun_position(lat=51.5074, lon=-0.1278, dt_iso="2025-06-15T14:30:00Z")
print(f"Sun Altitude: {sun['sun_altitude_deg']}°")

---