OSINT Suite

Setup & API Keys

The tool works without any API keys. Two optional keys will enrich the report with additional data:

# IPQualityScore — fraud score, DNC status, carrier enrichment
# Sign up free at ipqualityscore.com
IPQS_API_KEY: str = ''

# SerpAPI — clearnet mention scan via Google + DuckDuckGo
# Sign up free at serpapi.com (100 searches/month)
SERPAPI_KEY: str = ''

Install

pip install requests phonenumbers serpapi

Usage

python c_phone_osint.py
python c_phone_osint.py --save   # auto-save report to JSON

Usage flow

1. Select US/Canada or International, then enter the number in prompted parts.
2. Main report generates immediately — validation, carrier, region, formats, spam check, geocoordinates, and IPQS enrichment if a key is set.
3. Prompted to run a clearnet mention scan (requires SerpAPI key). Default is no.
4. If the scan returns more than 10 results, prompted to save all to JSON.

How It Works

• phonenumbers library parses validity, country, region, line type, carrier, and timezone.
• SkipCalls (no key) checks spam likelihood and report count.
• Nominatim / OpenStreetMap (no key) geocodes the carrier region to approximate coordinates — city or state level, not exact.
• IPQualityScore (optional key) adds fraud score, DNC registry status, prepaid flag, recent abuse flag, VOIP flag, MCC/MNC, and CNAM lookup.
• SerpAPI (optional key) searches Google and DuckDuckGo for the number in E.164, national, international, and digits-only formats, deduplicates results, and categorises each hit — scam report, data broker, social media, business directory, or general web.

Notes

• Spam likelihood via SkipCalls produces false negatives, making it a signal, not a definitive verdict.
• Carrier detection is unreliable for US numbers specifically. Paid services do better.
• Geocoding is region/city level, not a precise location.
• IPQS can be troublesome to sign up for. It is advised to do so without a VPN and from a standard browser. Their duplicate account detection is aggressive.
• SerpAPI's free tier allows 100 searches per month. The mention scan consumes 2 per run (one per engine).

Usage

python c_url_osint.py
python c_url_osint.py --save   # auto-save report to JSON

Usage flow

1. Enter the target domain (with or without https://) and a max page crawl limit (1–50, default 20).
2. DNS, WHOIS, SSL, HTTP headers, tech fingerprint, CSP quality, HTTP method enumeration, email security (SPF / DMARC / DKIM), and sensitive path probe run automatically.
3. Prompted to run an optional URL threat scan (scrapes IPQS public page).
4. Prompted to run an optional port scan against the resolved IP — ensure you are authorized.
5. Prompted to run an optional page crawl up to your specified limit.
6. Prompted to save the full report to JSON.

How It Works

• Resolves A, PTR, MX, NS, and TXT records via dnspython.
• Fetches WHOIS registration data including registrar, creation and expiry dates, and nameservers.
• Retrieves and parses the SSL/TLS certificate — issuer, expiry, days remaining, Subject Alternative Names.
• Fetches HTTP response headers and checks for the presence or absence of seven key security headers with vulnerability context.
• Probes a list of sensitive paths — .git/HEAD, .env, phpinfo.php, WordPress endpoints, and more — and reports status codes and content hints.
• Evaluates CSP header quality — flags unsafe-inline, unsafe-eval, wildcard sources, and missing directives.
• Fingerprints web technologies from headers and HTML — server, CMS, JS framework, CDN, and hosting provider.
• If WordPress is detected, extracts version from up to four sources and maps it against known CVEs.
• Checks SPF, DMARC, and DKIM selectors via DNS TXT lookups with policy grading.
• Calculates a passive risk score (0–100) from already-collected data — no extra requests.
• Optionally probes 14 ports via direct TCP connect with banner grabbing on text-protocol ports.
• Optionally crawls the domain with a 1-second delay between pages, collecting emails, internal links, and external domain references.

Notes

• The crawl uses a 1-second delay between requests out of politeness. On large sites, the page cap will be reached — raise it carefully.
• Technology fingerprinting is based on headers and static HTML. Client-side-rendered sites may not reveal their full stack this way.
• The URL threat scan scrapes a public page rather than using an API. It may break if the page structure changes.
• WHOIS data availability varies by TLD. Privacy-protected domains return minimal registrant information.
• The risk score is a passive indicator derived from your scan data, not a dedicated threat intelligence feed.
• As of April 2026, the tool can scrape sites behind Cloudflare and similar CDNs for email and link extraction.

Setup & API Keys

The tool works without any API keys. Two optional keys unlock additional data:

# AbuseIPDB — abuse confidence score, report count, usage type
# Free tier available at abuseipdb.com
ABUSEIPDB_API_KEY: str = ''

# Shodan — open ports, service banners, hostnames, OS, tags
# Requires paid membership for /shodan/host/{ip} endpoint
SHODAN_API_KEY: str = ''

Install

pip install requests

Usage

python c_ip_osint.py
python c_ip_osint.py --save   # auto-save report to JSON

Usage flow

1. Enter a target IPv4 or IPv6 address.
2. Private or loopback IPs trigger a local interface scan and exit.
3. For public IPs, geolocation, ASN, routing, passive DNS, DNS chain, domain discovery, Tor check, and host classification run automatically. AbuseIPDB and Shodan enrichment run if keys are set.
4. Prompted to run an optional ICMP ping (10 packets).
5. Prompted to run an optional common port probe (24 ports, direct TCP connect).
6. Prompted to save the full report to JSON.

Test target

The Nmap project maintains a publicly scannable host at 45.33.32.156 (scanme.nmap.org) you can use to test the tool.

How It Works

• Classifies the IP (public/private/loopback, IPv4/IPv6) and performs a reverse DNS lookup.
• Fetches geolocation, timezone, and ASN data from ipapi.co — 1000 requests/day free, no key required.
• Queries RIPEstat for BGP prefix, announcement status, RIR allocation, ASN holder, abuse contacts, and routing peers.
• Fetches passive DNS records from RIPEstat showing domain names historically resolved to the target IP.
• Resolves a recursive DNS chain from the reverse DNS hostname.
• Performs reverse IP domain discovery by querying HackerTarget, extracting TLS certificate SANs, cross-referencing Shodan and passive DNS, then HTTP-probing each discovered domain with a Host header to confirm live services.
• Checks the IP against the Tor Project's bulk exit node list.
• Classifies the host as datacenter/cloud, residential ISP, or mobile carrier based on ASN name, org string, and BGP prefix size.
• Optionally sends ICMP ping via the system ping binary and parses RTT and packet loss statistics.
• Optionally probes 24 common ports concurrently via direct TCP connect, with banner grabbing on text-protocol ports.

Notes

• HackerTarget reverse IP lookup has a limit of approximately 100 requests per day per IP. The geocoding via ipapi.co allows 1000 per day.
• Geolocation precision varies significantly by IP and provider. ISP-owned blocks may only resolve to country or region level.
• Passive DNS coverage depends on what RIPEstat has observed. Many IPs return no records.
• The port probe uses short TCP connect timeouts. Firewalls that drop rather than reject will cause ports to time out silently — false negatives are possible.
• Shodan's free API tier does not include access to the /shodan/host/{ip} endpoint. A paid membership is required. The tool works fine without it.
• An AbuseIPDB score of 0 does not guarantee an IP is clean. A score of 100 does not confirm it is malicious.

Usage

python exif_tool.py                         # interactive mode
python exif_tool.py photo.jpg               # single file
python exif_tool.py photo1.jpg photo2.jpg   # multiple files

Usage flow (per file)

1. All EXIF fields are printed — tag name alongside decoded value.
2. Prompted to strip EXIF. y strips with a .backup copy. b strips without backup. Enter skips.
3. Prompted to add or edit EXIF fields. Choose Merge (keeps existing, overwrites selected fields) or Wipe (clears all fields first then writes).
4. Select which fields to set from a numbered menu, enter values, then d to apply.

Writable fields

How It Works

• Opens images with Pillow and reads raw EXIF via _getexif(). Tag IDs are resolved using PIL.ExifTags.TAGS and GPSTAGS.
• GPS IFD entries are decoded from rational tuples to decimal degrees. A Google Maps link is constructed from the coordinates.
• Stripping works by writing an empty piexif block, or — for formats piexif doesn't support — by copying pixel data into a new image with no EXIF.
• Writing uses piexif to load the existing EXIF dict (or start fresh on wipe), apply updates per field, and save back to the original path.
• A .backup copy is made before any destructive operation when requested.