SearchPhone is a terminal-based Python OSINT toolkit that validates phone numbers, queries multiple APIs in parallel, and produces JSON/PDF reports for authorized investigations.
| Tool | HackUnderway/SearchPhone — multi-API phone number OSINT CLI with automatic reporting |
| Category | OSINT / reconnaissance automation |
| Primary Use | Enriching a phone number indicator during authorized investigations, combining Numverify carrier data, SerpAPI/DuckDuckGo web results, GitHub code search and Reddit mentions |
| Safe Use | Intended for authorized penetration tests, bug bounty research with proper scope, corporate threat intelligence, and lab-based defensive research on numbers you own or are licensed to investigate |
| Telemetry Note | Every query leaves a trail at the third-party services used: Numverify, SerpAPI, GitHub token audit logs, DuckDuckGo, Reddit, and the Hudson Rock Cavalier API — defenders can detect account-driven lookups via API usage logs |
SearchPhone is a Python 3.8+ command-line OSINT tool from HackUnderway (repo: HackUnderway/SearchPhone, ~2028 stars, MIT licensed) that takes a single phone number and fans out lookups across a stack of heterogeneous APIs. Rather than reinventing parsers, it leans on established services: Numverify for validation and carrier metadata, SerpAPI for Google results, a GitHub token for code search, DuckDuckGo and Reddit scraping for open-web and social mentions, and the free Hudson Rock Cavalier API for infostealer compromise intelligence. The result is a consolidated picture of where a number appears and whether it has leaked into criminal ecosystems.
Architecturally, the interesting part is the parallelism. The README explicitly advertises parallel processing so the engines are queried simultaneously rather than sequentially, which matters when you consider that the free tiers (Numverify at 100 requests/month, SerpAPI at 250 searches/month, GitHub at 5000 requests/hour) reward efficiency. The pipeline presumably begins with validation and normalization via the phonenumbers library — a Google-derived libphonenumber port — so downstream APIs always receive a consistently formatted E.164-style input. That validation step is quietly the most important: garbage or malformed numbers never waste quota.
The Numverify integration delivers what the README calls operator and location data: carrier identification and coarse geography. In an authorized investigation this is typically the first attribution pivot — knowing whether a number belongs to a specific MVNO or a known VoIP provider changes how you interpret everything downstream. A number hosted on a disposable-VoIP-friendly carrier behaves differently in fraud patterns than one on a national incumbent, and SearchPhone surfaces that signal before you spend queries elsewhere.
The code repository angle is the GitHub token feature: searching GitHub-hosted code for occurrences of the number. This is a genuinely common leak vector — developers hard-code contact numbers, SMS gateway test fixtures, and Twilio-style integration configs into repos that later become public. For a defender doing exposure assessment on their own organization's numbers, this module is essentially a credential-hygiene audit: it tells you which internal phone numbers are sitting in searchable public code and need scrubbing.
The Hudson Rock Cavalier integration is the most defensive-flavored feature. It checks whether a phone number appears in infostealer datasets — machines infected with info-stealer malware whose logs ended up in Hudson Rock's corpus. No API key is required, which makes it the lowest-friction module. From a blue-team perspective this is breach-exposure intelligence: if a corporate number shows up in stealer logs, the associated employee device or account may already be compromised, and the finding belongs in your incident triage rather than your recon notes.
Web and social coverage comes from Google via SerpAPI, from DuckDuckGo, and from Reddit. These catch the long tail: marketplace listings, forum posts, classified ads, complaint boards, and any other indexed page where the number leaked. Combining a structured search engine API with DuckDuckGo is a pragmatic pattern — the free tier of SerpAPI burns quickly, and DuckDuckGo acts as an unauthenticated fallback that keeps the workflow moving when quota runs out mid-engagement.
Configuration follows a conventional pattern: the repo ships an example.env file, you copy it to .env (cp example.env .env), edit it with your editor of choice, and populate NUMVERIFY_KEY, SERPAPI_KEY, and GITHUB_TOKEN. Keeping keys in a dotenv file rather than baked into the script is good hygiene, though operators should remember that .env files are a classic accidental-commit risk — add it to .gitignore in any fork. Notably, three of the four data sources require keys; only Hudson Rock is keyless.
Output handling is where SearchPhone earns its place in a professional workflow: it automatically generates both JSON and PDF reports. The JSON artifact matters for automation and for feeding results into downstream tooling or a case management system; the PDF matters for the human audience — a client deliverable in an authorized assessment. Tools that end with structured, archivable output are far easier to defend in a scoping dispute than ones that only print colored text to a terminal, though the colorful output mode is present too for interactive use.
Platform support is explicitly documented and broad for a hobby-scale project: verified working on Kali Linux 2026.2, Parrot Security OS 6.3, Windows 11, BackBox 9, and Arch Linux (2024.12.01). The installation is minimal — git clone https://github.com/HackUnderway/SearchPhone.git, cd SearchPhone, pip install -r requirements.txt, then python3 search_phone.py. The single-script entrypoint (search_phone.py) suggests a flat, readable codebase, which is a plus for auditors who want to verify exactly what data leaves the machine before running it against sensitive indicators.
Operationally, the telemetry footprint deserves emphasis because it cuts both ways. Every run makes authenticated calls to Numverify, SerpAPI, and GitHub under your own accounts, meaning your investigation is fully logged at those providers. For authorized work this is fine and even useful for audit trails, but it also means the tool is a poor fit for any scenario requiring source anonymity — the API keys deanonymize the investigator even when the target is unaware. The Hudson Rock calls are keyless but still originate from your IP.
The README closes with a predictable amount of self-promotion — a commercial hackunderway.io 'Enterprise Mode' OSINT platform, Patreon, and social links — which is worth discounting when evaluating the tool itself. The core script, the documented API matrix, and the report generation are the substance. One caveat for defenders using the Hudson Rock example URL in the README: it embeds what looks like a real phone number as an example query, so treat it as documentation, not a target.
For the intended audience — bug bounty hunters within scope, pentesters doing authorized reconnaissance, and corporate threat-intel teams checking their own exposure — SearchPhone is a competent aggregator rather than a novel technique. Its value is consolidation: one command, one report, five data sources. Used strictly against numbers you own, numbers covered by engagement scope, or public exposure checks of your organization, it is a legitimate time-saver; pointed at strangers, the same capability becomes a stalking tool, and that line is entirely the operator's responsibility.
HackUnderway/SearchPhone.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.