A curated, LGPD-aware catalog of 510 Brazilian public information sources, osint-brazuca gives authorized investigators and threat analysts a structured starting point for open-source research.
| Tool | osintbrazuca/osint-brazuca — curated catalog of Brazilian public/legal OSINT sources with a generated JSON dataset |
| Category | OSINT resource catalog / structured dataset |
| Primary Use | Finding legitimate Brazilian public portals by input type (CPF, CNPJ, plate, domain, phone) for authorized investigations and threat-intel research |
| Safe Use | Intended for authorized professionals — journalists, researchers, security and compliance teams — doing documented, LGPD-compliant open-source research in labs, assessments, or defensive investigations |
| Telemetry Note | Purely a link catalog and dataset; it performs no network activity itself, but the listed public portals log queries, impose rate limits, and may require gov.br registration, leaving query traces on government systems |
osint-brazuca is not a scanner, an exploit framework, or an automation engine — it is something arguably more durable: a maintained, community-driven catalog of Brazilian open-source intelligence sources, backed by 2,722 stars on GitHub and an MIT license. The project, authored by Cleiton P. (MrCl0wnLab) and Diego (c4nh0t0), bills itself as a repository of public, legal information portals, organized for investigators who need to answer the practical question: given a CPF, a CNPJ, a vehicle plate, a domain, or a phone number, which official Brazilian sources can I legitimately consult, and what will each one return?
The README opens with a Portuguese-language framing that is unusually explicit for this genre: "conhecer para proteger, investigar para defender" — know to protect, investigate to defend. That defensive orientation carries through the entire document. The authors anchor the project in Brazilian legal reality, citing Lei nº 13.709/2018 (the LGPD, Brazil's general data protection law), Lei nº 12.965/2014 (Marco Civil da Internet), and Lei nº 12.527/2011 (the Access to Information Law). For any professional operating in or against Brazilian data, this legal scaffolding is itself valuable documentation.
What elevates osint-brazuca above a typical "awesome list" is its generated structured dataset under data/. The canonical file data/sources.json contains 510 sources across 39 categories, while data/index.json flattens this into 1,258 individual link records ready for programmatic search. The taxonomy is what makes it operationally interesting: data/taxonomy.json defines a controlled vocabulary of 31 input types, 41 return types, and 14 source types. In other words, the dataset is queryable by pivoting logic — you already hold a phone number, so enumerate every source that accepts a phone number as input.
The build pipeline is documented and refreshingly simple. The JSON files are generated from the human-maintained README by tools/build_dataset.py, which requires only Python 3 with no external dependencies. Regeneration is a single invocation: python3 tools/build_dataset.py. Importantly, the README warns that sources.json and index.json are build artifacts — manual edits get overwritten — and that classification corrections belong in data/overrides.json. Each source carries a stable id in the categoria/nome format, deliberately decoupled from its position in the README so the identifiers survive restructuring. This is thoughtful data engineering for a community resource.
The categorical coverage is broad and almost entirely government-transparency oriented. The table of contents spans social benefit programs (Auxílio Emergencial, Meu INSS), missing persons portals across multiple states, court process lookups, electoral and political records, real estate and property registries, environmental registries, foreign trade data, trademark and patent databases, official gazettes (Diários Oficiais), telecom records including ERB radio base station data, academic records, and georeferencing resources. There are also sections for Brazilian-context search dorks, instant-messaging service indexers, blockchain analytics, transport registries, and .br domain categories.
Several entries go beyond bare links and document query mechanics in a way that clarifies the data model. The Central Bank's "valores a receber" lookup, for example, is described as accepting a GET request where the URL path carries a CPF or CNPJ (formatted without dots or dashes) plus a birth date in ANO-MES-DIA form. This is the kind of interface detail that matters to analysts building lawful enrichment workflows against published public endpoints — and it is exactly what the input/return taxonomy in data/taxonomy.json is designed to capture systematically.
The operational caveats section deserves attention from anyone planning to operationalize the catalog. The README warns that public data may be stale, that government systems go into maintenance windows, and that cross-validation across multiple sources is mandatory before treating a result as fact. On the technical side, it notes that some portals require prior registration through gov.br, that CAPTCHA may block automated queries, that public APIs impose request limits, and that bulk querying can get blocked. The practical guidance — cache aggressively, respect rate limits, query selectively — reads like hard-won operational experience rather than boilerplate.
The ethics section is one of the most detailed in this project class. Good practices listed include using only official public sources, respecting privacy and dignity, documenting sources and methodology, maintaining a legitimate purpose (journalism, research, security, compliance), and never publishing sensitive data publicly. Explicitly prohibited uses include social engineering, system intrusion, stalking or harassment, discrimination, unauthorized commercialization of data, and violation of professional confidentiality. The blunt closing admonition — essentially "don't be a jerk" — is characteristic of the project's tone, but the legal warning underneath it is serious: misuse of LGPD-protected personal data can carry civil and criminal sanctions.
Supporting documentation is split across dedicated files: EXEMPLOS_PRATICOS.md for worked scenarios, FLUXOGRAMA.md for investigation flowcharts, GUIA_RAPIDO.md as a quick-start reference, and CONTRIBUICAO.md covering contribution norms including how to fix dataset classification. The presence of flowcharts signals the intended audience: analysts who need decision trees for which source to consult at which stage of an investigation, rather than developers wiring up tooling.
For defenders, the catalog has a less obvious second life. Blue-team and threat-intelligence teams investigating fraud campaigns, brand abuse, or actor infrastructure with a Brazilian nexus can use the indexed sources as a legitimate enrichment layer — checking company registrations, official gazettes, or CNPJ data to map fraudulent entities to real-world administrative records. Because everything listed is public and legal, using it introduces no exposure of stolen or breached data into an investigation's evidentiary chain.
Where osint-brazuca fits in an authorized workflow is straightforward: it is the reconnaissance map, not the weapon. An analyst conducting a documented engagement, a journalist verifying a corporate entity, or a compliance team screening a counterparty starts with the input type they already hold, queries data/index.json for matching sources, and consults those portals within their published limits and within LGPD's purpose-limitation requirements. The repo does not ship scrapers, bypass tooling, or aggregation scripts — deliberately so, given the legal framing. Its value is curation, structure, and the discipline of keeping 510 sources classified, versioned, and regenerable from a single python3 script. For anyone whose threat landscape or investigative mandate touches Brazil, it is a reference worth bookmarking and, given the MIT license and active contribution flow, worth forking.
osintbrazuca/osint-brazuca.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.