Writing

Tool Release: OSINTive

By Brandon Eckert

From the archive: originally published in December 2019. The project status, services, and release plans below describe that period.

It has been a while since I last wrote an article. In my previous OSINT article, also published on LinkedIn, I mentioned a tool I was developing to gather open source intelligence on individuals.

When researching a threat actor with poor operational security (OPSEC), I often start with only partial information. I wanted a tool that could search using those known details, then give me flexibility in how I displayed and exported the results.

That project is now about 95% complete, and I have named it OSINTive: a mashup of OSINT and detective.

OSINTive Description

OSINTive terminal main menu with search and configuration options

OSINTive Main Menu

OSINTive lets you research a subject using any of these known details:

  • Phone number
  • Name, city, state, and country
  • Username
  • Email address

OSINTive terminal prompting for details in a name lookup

OSINTive Name Lookup

Once you choose a search type, OSINTive walks you through entering the information and displays the results in your terminal. You can export results as CSV, JSON, or plain text.

You can also set a minimum match probability and additional requirements, such as showing only matches that include a valid phone number, an email address, or both. Command-line arguments support automated searching, display, and export. For bulk research, the tool can read a CSV file containing subjects and their known details.

Data Aggregation

Redacted OSINTive terminal results with matched profile information

OSINTive Results

During the first few weeks of development, I experimented with custom “spiders” that searched for potential matches, then crawled those pages for information. The proof of concept worked, but it was slow. Search engines also flagged the advanced queries and rapid requests as suspicious, blocking them until I completed a CAPTCHA.

I then explored free and paid data aggregators. The free services I tested sometimes returned incorrect information or became unavailable. After considerable testing and research, I chose Pipl, a paid aggregator whose data met the project’s needs at the time.

The redacted screenshot above shows the range of information OSINTive could return. The people in these tests gave their express permission because they wanted to see what information was publicly associated with them. Depending on the configured probability and match requirements, OSINTive can also display potential matches.

Open Source

At the time of this post, I planned to release OSINTive on GitHub under the GNU General Public License v3.0, a copyleft license that requires covered derivative works to retain its license terms when distributed.

OSINTive Web

I was also developing OSINTive Web, a companion web application with additional functionality:

  • User management with granular permissions.
  • Case files that link individual subjects to a case number.
  • Follow-up searches using information from earlier results. A newly discovered email address, for example, could lead to another associated identity or reveal an OPSEC failure.
  • The ability to merge case files.

The plan was to carry features from OSINTive’s core into the web application, which was still in an early beta at the time of writing.

← All writing