h-osint (h-osint)

A local-first, keyboard-driven OSINT workbench for the terminal — Neovim-style keybinds, Lua config, 12 themes, and a local SQLite case store. No account, no cloud backend, no telemetry.

kitty ~ » h-osint

Repository: h-osint · Binary: h-osint · Website: https://t-beckett.gitlab.io/h-osint/

h-osint runs entirely on your machine. Case notes, sock-puppet tracking, and every lookup's findings live in one local SQLite file — there is no server component, no sync, and nothing this tool does uploads your case data anywhere. Every module that talks to a third-party service (HaveIBeenPwned, Shodan, WiGLE, Nominatim, RDAP, crt.sh, NVD, Team Cymru, ip-api.com) does so with your own API key where one is required, and only because you ran that specific lookup.

Why another OSINT tool?

Because the good OSINT technique references (TCM Security's OSINT Fundamentals, the TCM OSINT resource list) don't ship any software, and the software that exists is either a pile of single-purpose CLI scripts (Sherlock, theHarvester, ...) or a heavyweight GUI (Maltego). h-osint borrows the parts of the terminal-app ecosystem that already feel premium and puts one coherent workbench around the well-known techniques instead:

Who it's for

• Security researchers and threat-intel analysts doing authorized recon
• Journalists and open-source investigators doing verification/geolocation work (Bellingcat-style methodology, not automation of it)
• Trust & safety teams checking their own brand for impersonation/typosquats
• OSINT students (e.g. following TCM Security's course) who want one place to practice the whole workflow instead of twelve browser tabs
• Anyone who wants their case notes, API keys, and findings to stay on their own disk

It is not built for, and deliberately omits, anything whose only realistic use is stalking, harassment, unauthorized intrusion, or working with stolen credential dumps — see docs/ETHICS.md for exactly where those lines are drawn and why.

Quickstart

git clone https://gitlab.com/t-beckett/h-osint.git
cd h-osint

# Build prerequisites: a C compiler + linker (for the bundled SQLite and
# vendored Lua) and pkg-config. On Debian/Ubuntu:
sudo apt install build-essential pkg-config

cargo build --release
./target/release/h-osint          # launches the TUI
./target/release/h-osint --help   # see the scriptable subcommands

Optional external tools that unlock more of the Tools screen: whois (RDAP-unsupported TLD fallback), dig (DNS records + AXFR check), exiftool, nmap, openssl, curl. The app runs fine without them — it tells you what's missing rather than failing silently.

Config

On first run, h-osint writes a fully-commented default config to ~/.config/h-osint/init.lua for you (if nothing's there yet) — there's nothing to copy by hand. Open that file to set your theme, API keys, custom themes, and keymap overrides. Nothing in it is required; every field has a sane default and every module that needs a key tells you so instead of failing silently. (The shipped config/init.lua in this repo is the exact template used — read it here if you'd rather not launch the app first.)

Features

All 22 originally-scoped OSINT capabilities plus 6 extended tools — full status/module mapping in docs/FEATURES.md:

Notes & case files · sock puppet / persona manager · search-engine dork builder · reverse image search handoff · EXIF viewer with Kitty-protocol inline preview · physical-location & geolocation tools · email OSINT (format/MX/Gravatar) · breached-data OSINT (HaveIBeenPwned breaches + pastes) · people OSINT · phone number OSINT · Sherlock-style username OSINT · website OSINT (DNS, RDAP, crt.sh, Wayback, SPF/DMARC/DKIM, robots.txt/sitemap) · social media OSINT · wireless network OSINT (WiGLE) · IP OSINT (geolocation, reverse DNS, ASN/BGP via Team Cymru, RDAP) · MAC OSINT · external-tool orchestration · automation pipelines · Markdown report writing · low-level security OSINT (TLS certs, security headers) · plus Shodan host intelligence, a hash identifier, a URL redirect expander, a CVE/NVD lookup, a typosquat/look-alike-domain scanner, and a DNS zone-transfer (AXFR) misconfiguration check.

Keybinds

Three modes, Neovim-flavored — full table in KEYBINDINGS.md:

All of the above are overridable from init.lua. Press ? any time for the in-app cheat sheet.

Themes

:theme <name> or set theme in init.lua — full palette table and the custom-theme format in THEMES.md:

ocean-depths · forest-canopy · modern-minimalist · arctic-frost · botanical-garden · midnight-galaxy · nord · catppuccin-frappe · everforest · gruvbox · onedark · tokyonight (default)

Every theme maps the same 12 semantic roles (bg/fg/accent/danger/...) — no screen ever special-cases a theme by name — and you can define your own entirely in init.lua without touching Rust code.

CLI (automation / scripting)

Every module's core logic is reachable headlessly, so you can pipe it into other tools or run it from cron:

h-osint username johndoe
h-osint domain example.com
h-osint ip 8.8.8.8
h-osint asn 8.8.8.8
h-osint email [email protected]
h-osint mac AA:BB:CC:DD:EE:FF
h-osint phone "+1 555 0100"
h-osint dork --site example.com --filetype pdf "quarterly report"
h-osint breach [email protected] --api-key YOUR_HIBP_KEY
h-osint shodan 1.2.3.4 --api-key YOUR_SHODAN_KEY
h-osint hash 5f4dcc3b5aa765d61d8327deb882cf99
h-osint expand https://bit.ly/example
h-osint cve CVE-2024-3094
h-osint typosquat example.com
h-osint security example.com
h-osint axfr example.com ns1.example.com
h-osint pipeline example.com --steps domain,ip --case 1
h-osint report 1 --out case-1.md

Project layout

src/
  main.rs, cli.rs        entry point + headless CLI
  app.rs                 tab/mode state machine, :command execution
  config.rs, keymap.rs   Lua config loading, modal keybind resolution
  themes/mod.rs           12 built-in themes + custom-theme support
  db.rs                  SQLite case/notes/findings/personas storage
  ui/                    tab bar, status bar (mode pill), help popup
  modules/
    notes.rs, sockpuppet.rs        full modules (state + DB + UI)
    dork.rs, exif.rs, username.rs  full modules (logic + UI)
    domain.rs, network.rs,         pure OSINT logic (no UI — see
    identity.rs, geo.rs            lookup.rs for the shared screen)
    lookup.rs                      generic single-input screen used by
                                    Domain/IP/MAC/Email/Phone/Breach/Geo/
                                    Wireless/People/Social/Shodan/Hash/
                                    UrlExpand/Cve/Typosquat/Security/Axfr/
                                    ReverseImage
    tools.rs, automation.rs, report.rs   full modules
docs/
  ARCHITECTURE.md   how it's wired together + where to extend it
  FEATURES.md       every requested + extended feature -> module mapping
  ETHICS.md         responsible-use scope and why some modules are limited
THEMES.md           full palette table + how to define a custom theme
KEYBINDINGS.md      the complete keybind + command reference
CONTRIBUTING.md     dev setup, how to add a module, commit style
SECURITY.md         responsible-disclosure policy for this tool itself
CODE_OF_CONDUCT.md
CHANGELOG.md
config/init.lua     example config
site/               source for the project website (published via GitLab Pages)
.gitlab-ci.yml       build/lint/test + Pages deploy

Website & CI

site/ holds the static project homepage; .gitlab-ci.yml builds and lints on every push and publishes site/ to GitLab Pages on the default branch, at https://t-beckett.gitlab.io/h-osint/.

Honest caveat

This project was originally scaffolded in an environment without network access to cargo build against crates.io. Every line was hand-reviewed for correctness (types, borrow-checker shape, API signatures against the documented crate versions), but treat a fresh clone's first cargo build as the real verification step — the CI pipeline runs it, cargo clippy, and cargo test on every push, so a green pipeline on main is the actual guarantee. See docs/ARCHITECTURE.md's "Known gaps" section for the specific spots most worth a second look (MAC OUI table coverage, phone parsing precision, ASN response parsing).

License

MIT — see LICENSE. © T. Beckett.