nuclide-research/osint-handbook

# osint-handbook Feed it a target. It runs local recon, routes to relevant handbook categories, and returns a full investigation report with executed findings and a prioritized tool roadmap. No API keys. No accounts. Runs entirely offline after a one-time extraction step. ## Install git clone https://github.com/nuclide-research/osint-handbook cd osint-handbook pip install -r requirements.txt python extractor.py # one-time: parses the PDF → knowledge/ ## Usage python main.py [options] **Target types** (auto-detected): | Input | Detected as | |-------|------------| | `1.2.3.4` | ip | | `example.com` | domain | | `user@example.com` | email | | `@handle` | username | | `1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf` | crypto | | `John Smith` / `Acme Corp` | entity | **Options:** --type Override auto-detection: ip, domain, email, username, entity, crypto, person --depth quick (top 3 categories) | full (all relevant, default) --output terminal (default, rich) | markdown | json --no-execute Skip local tool execution, return handbook recommendations only --categories Force specific categories: "Web Intelligence,People Investigations" **Examples:** python main.py shodan.io python main.py 8.8.8.8 --depth quick python main.py john@company.com --no-execute --output markdown python main.py "Acme Corp" --type entity --output json python main.py 1A1zP1eP5QGefi2DMPTfTL5SLmv7Divf ## What it does 1. **Detects** target type from the input string 2. **Routes** to relevant handbook categories using keyword matching 3. **Executes** local tools in parallel: `whois`, `dig` (A/MX/NS), `crt.sh`, `ip-api.com`, HTTP probe 4. **Returns** a structured report: execution findings + per-category tool tables + next steps ## Requirements - Python 3.11+ - `whois` and `dig` installed (`apt install whois dnsutils` on Debian/Ubuntu) - Internet access for live lookups (crt.sh, ip-api.com, HTTP probes) ## How the handbook was extracted `extractor.py` uses `pdfplumber` to parse the PDF by font size — section headers at ~17.6pt, subcategory headers at ~15.1pt, tool entries at ~11pt. No OCR, no API calls. Runs in under 60 seconds and produces `knowledge/handbook.json` (7,442 tools) and `knowledge/handbook_categories.json` (45 categories used for routing). ## Source Handbook by [i-intelligence GmbH](https://i-intelligence.eu), Aleksandra Bielska et al., 2020. CC BY-NC.