Skip to content

Identity Social Network Intelligence Scripts

Jump to bottom
elb-pr edited this page Apr 7, 2026 · 2 revisions

Identity, Social & Network Intelligence Scripts

The following files were used as context for generating this wiki page:

This section details the specialized scripts within the claude-sleuth toolkit designed for identity attribution, social footprinting, and network infrastructure analysis. These tools are primarily utilized during Phase 3 (Collation & Entity Resolution) and Phase 4 (Chronological & Relational Processing) to transform raw identifiers (usernames, domains, coordinates) into actionable intelligence.

1. Username Enumeration & Social Footprinting

The toolkit integrates with industry-standard username enumeration tools to map a subject's digital footprint across thousands of platforms. While the primary logic resides in external tools like Sherlock and Maigret, claude-sleuth provides the programmatic glue to ingest these results into the investigation workflow.

Implementation Details

The system leverages Maigret for its advanced profile-page parsing and metadata extraction capabilities skills/claude-sleuth/references/tooling.md:18-19. It also references Holehe for email-based registration checks via password-reset probing skills/claude-sleuth/references/tooling.md:27-28.

Tool Scope Key Capability
Sherlock 400+ sites Rapid URL existence checks skills/claude-sleuth/references/tooling.md:18-18
Maigret 3,000+ sites Metadata extraction and recursive search skills/claude-sleuth/references/tooling.md:18-18
Holehe 120+ sites Email registration and recovery info skills/claude-sleuth/references/tooling.md:27-27

Sources: skills/claude-sleuth/references/tooling.md:11-31

2. Domain & Network Intelligence (domain_intel.py)

The DomainIntel class in scripts/domain_intel.py provides a unified pipeline for infrastructure investigation. It is designed to be "zero-auth" and "zero-cost," relying on public DNS, RDAP, and Certificate Transparency logs skills/claude-sleuth/scripts/domain_intel.py:4-7.

Core Components

Domain Investigation Data Flow

The following diagram illustrates how DomainIntel.investigate() orchestrates multiple sub-collectors to build a comprehensive report.

Domain Intelligence Orchestration

graph TD
    "Input_Domain" --> "DomainIntel.investigate()"
    "DomainIntel.investigate()" --> "DNSCollector.query_all()"
    "DomainIntel.investigate()" --> "RDAP.lookup()"
    "DomainIntel.investigate()" --> "CrtSh.search()"
    "DomainIntel.investigate()" --> "ShodanInternetDB.lookup()"
    
    subgraph "External_Services"
        "DNSCollector.query_all()" -- "Port_53" --> "Public_DNS"
        "RDAP.lookup()" -- "HTTPS" --> "rdap.org"
        "CrtSh.search()" -- "HTTPS" --> "crt.sh"
        "ShodanInternetDB.lookup()" -- "HTTPS" --> "internetdb.shodan.io"
    end

    "DNSCollector.query_all()" --> "Final_Report"
    "RDAP.lookup()" --> "Final_Report"
    "CrtSh.search()" --> "Final_Report"
    "ShodanInternetDB.lookup()" --> "Final_Report"
Loading

Sources: skills/claude-sleuth/scripts/domain_intel.py:156-215

3. Geolocation & Imagery Analysis (geolocation.py)

The GeoToolkit class in scripts/geolocation.py provides technical support for image-based geolocation (IMINT) and chronolocation skills/claude-sleuth/scripts/geolocation.py:3-6.

Key Functions

Coordinate & Metadata Extraction Flow

This diagram maps the transition from a physical image file to structured geolocation data entities used by the GeoToolkit.

Imagery Intelligence Processing

graph LR
    "Image_File" --> "GeoToolkit.extract_exif()"
    "GeoToolkit.extract_exif()" --> "dms_to_decimal()"
    "dms_to_decimal()" --> "GPS_Coordinates"
    
    subgraph "Verification_Engines"
        "GPS_Coordinates" --> "GeoToolkit.sun_position()"
        "GPS_Coordinates" --> "GeoToolkit.historical_weather()"
        "GPS_Coordinates" --> "GeoToolkit.reverse_geocode()"
    end
    
    "GeoToolkit.sun_position()" --> "Shadow_Analysis"
    "GeoToolkit.historical_weather()" --> "Atmospheric_Verification"
    "GeoToolkit.reverse_geocode()" --> "Address_Entity"
Loading

Sources: skills/claude-sleuth/scripts/geolocation.py:48-205

4. API Requirements & Setup

Most tools in this category are designed for "zero-auth" operation, but some require specific environment configurations or optional dependencies managed via setup.py.

Dependency Groups

To use these scripts, the following module groups should be installed via sleuth-setup:

  • identity: Required for username enumeration.
  • network: Required for domain_intel.py (includes dnspython, tldextract).
  • geo: Required for geolocation.py (includes exifread, pysolar, geopy).

Usage Examples

Domain Intelligence

from scripts.domain_intel import DomainIntel
di = DomainIntel()
report = di.investigate("example.com")
# Access DNS records
print(report["sections"]["dns"])

skills/claude-sleuth/scripts/domain_intel.py:10-13

Geolocation & Sun Analysis

from scripts.geolocation import GeoToolkit
gt = GeoToolkit()
# Extract EXIF
exif = gt.extract_exif("evidence/photo_001.jpg")
# Verify sun position for a timestamp
sun = gt.sun_position(lat=51.5074, lon=-0.1278, dt_iso="2025-06-15T14:30:00Z")
print(f"Sun Altitude: {sun['sun_altitude_deg']}°")

skills/claude-sleuth/scripts/geolocation.py:10-15

Sources: skills/claude-sleuth/scripts/domain_intel.py:1-13, skills/claude-sleuth/scripts/geolocation.py:1-15

Overview

Investigation Phases

CLI Tools

Scripts

Templates

CSDb

Project

Clone this wiki locally