OSINT-Toolkit

A lightweight OSINT (Open Source Intelligence) toolkit for domain reconnaissance, email intelligence, social-media username discovery, and data-breach monitoring.

Disclaimer: These tools are provided for authorized security assessments and educational purposes only. Misuse against targets without explicit permission may violate applicable laws.

---

Tools

Tool	File	Description
Domain Recon	domain_recon.py	Subdomain brute-force + crt.sh certificate transparency lookup
Email OSINT	email_osint.py	SMTP verification, HIBP breach lookup, social-discovery stubs
Social Search	social_search.py	Username search across dozens of online platforms
Data Breach	data_breach.py	k-anonymity password check & paste monitoring (HIBP)

---

Installation

# Clone the repository
git clone https://github.com/ridhinva/OSINT-Toolkit.git
cd OSINT-Toolkit

# (Optional) Create a virtual environment
python3 -m venv venv
source venv/bin/activate

# No external dependencies required — all tools use the Python standard library
# and urllib / socket (built-in).

---

Usage

1. Domain Recon (domain_recon.py)

Brute-forces a list of common subdomains using DNS resolution and queries crt.sh for certificate transparency logs.

# Basic subdomain brute-force
python domain_recon.py --subs example.com

# Query crt.sh for certificate logs
python domain_recon.py --crtsh example.com

# Combine both
python domain_recon.py --subs example.com --crtsh example.com

# JSON output
python domain_recon.py --subs example.com --crtsh example.com --json

How It Works:

• Subdomain brute-force: For each word in the built-in wordlist (www, mail, admin, …), the tool constructs <word>.<domain> and calls socket.getaddrinfo(<fqdn>, 80). If the call succeeds, the subdomain is considered resolved (it exists). A ThreadPoolExecutor with 30 workers parallelizes the queries for speed.
• crt.sh lookup: Sends an HTTP GET to https://crt.sh/?q=%25.<domain>&output=json. The JSON response is parsed, deduplicated by certificate common name / name value, and printed. This reveals subdomains and hosts with public TLS certificates.

---

2. Email OSINT (email_osint.py)

Framework for email address intelligence gathering. Currently provides a CLI skeleton and detailed docstring; the core verification logic can be extended.

# Show help and full usage documentation
python email_osint.py --help

# With arguments (placeholder — will print the docstring + received args)
python email_osint.py --verify user@example.com
python email_osint.py --hibp user@example.com --api-key YOUR_KEY
python email_osint.py --social user@example.com

How It Works:

• SMTP Verification: Connects to the domain's MX server and issues SMTP VRFY or RCPT TO commands, observing the response code. A 250 response usually indicates the mailbox exists.
• HIBP Breach Lookup: Sends the email address (SHA-1 hashed) to the Have I Been Pwned API v3 to fetch a list of known breaches the address appears in.
• Social Discovery: Queries public-facing APIs and profile-page patterns (Gravatar, GitHub events, etc.) to surface accounts linked to the email.

---

3. Social Search (social_search.py)

Looks up a username across popular social-media and online-service platforms.

# Search for a username
python social_search.py --username johndoe

# JSON output
python social_search.py --username johndoe --output json

# List supported platforms
python social_search.py --list-platforms

How It Works:

The tool maintains an internal mapping of platform → profile-URL pattern (e.g. https://github.com/<username>). For each platform it issues an HTTP HEAD/GET request. A 200 OK response (that is not a soft-404) signals the account exists. Results are deduplicated and presented in a table or JSON.

---

4. Data Breach (data_breach.py)

Privately checks passwords against known breaches (k-anonymity) and monitors pastes for email addresses.

# Check a password (fully private — no plaintext or full hash leaves your machine)
python data_breach.py --check-password "MyP@ssw0rd!"

# Monitor pastes for an email (requires HIBP API key)
python data_breach.py --monitor-pastes user@example.com --api-key YOUR_KEY

# Combined
python data_breach.py --check-password P@ss123 --monitor-pastes user@ex.com --api-key KEY

How It Works:

• k-Anonymity Password Check: The password is SHA-1 hashed locally. Only the first 5 hex characters of the hash are sent to the HIBP Pwned Passwords API (https://api.pwnedpasswords.com/range/<prefix>). The API returns a list of hash suffixes and their occurrence counts. The tool compares the local full hash against the returned suffixes — the full hash never leaves your machine.
• Paste Monitoring: Queries the HIBP paste API (https://haveibeenpwned.com/api/v3/pasteaccount/<email>) with the provided API key. Returns metadata (source, title, date) for any pastes that include the target email.

---

Project Structure

OSINT-Toolkit/
├── domain_recon.py     # Domain recon (subdomain brute + crt.sh)
├── email_osint.py      # Email OSINT skeleton
├── social_search.py    # Username search skeleton
├── data_breach.py      # Data breach monitoring skeleton
└── README.md           # This file

---

License

MIT