X-osint is a Python and bash OSINT framework that consolidates IP, email, phone, DNS, and domain reconnaissance lookups into a single interactive menu, aimed at authorized investigators.
| Tool | TermuxHackz/X-osint — open source intelligence framework aggregating phone, email, IP, DNS, and domain lookups |
| Category | OSINT / reconnaissance framework |
| Primary Use | Running consolidated OSINT lookups (IP info, email info, DNS lookups, subdomain enumeration, phone number intelligence) from one numbered menu during authorized investigations |
| Safe Use | Intended for authorized security assessments, investigations of assets you own or are contracted to test, and educational security research only |
| Telemetry Note | Relies heavily on third-party APIs (Shodan, hunter.io, numverify, Vonage, OpenCage), so every query leaves a traceable audit trail in those providers' logs tied to your API keys |
X-osint is an open source intelligence framework written in Python and bash, maintained under GPL-3.0 and currently sitting at roughly 2666 stars on GitHub. Rather than inventing new collection techniques, it aggregates a broad set of established OSINT modules behind a single numbered interactive menu: you launch xosint in a terminal, pick an option by number, and follow the prompts. The project's stated purpose in the README is gathering "credible valid information" about phone numbers, email addresses, and IP addresses, with the topic list confirming ambitions well beyond those three, including host and port discovery, subdomain enumeration, and metadata extraction.
The feature list is unusually wide for a single-menu tool. It covers IP address information gathering, email address information gathering, phone number lookup, location metadata extraction from images, host finding, port finding, subdomain enumeration, a CVE exploit finder, an email finder, access to an open source vulnerability database, DNS lookup and reverse DNS, a VIN extractor, ProtonMail OSINT, phone location, and global infostealer attack checking. Version 2.3 added generalized metadata extraction for any file type, a DNSinf module for benchmarking and performance-testing DNS servers, text analysis powered by scapy for tokenization, POS tagging, NER, and dependency parsing, and a beta network mapper aimed at WiFi networks. The breadth is the selling point: it is a Swiss-army consolidation play rather than a deep specialist.
Architecturally, X-osint is best understood as an orchestration layer over third-party APIs and borrowed sub-projects. The README is explicit that several modules require user-supplied API keys: a Shodan key for options 4 through 9, hunter.io for email discovery, opencagedata for phone number geolocation, a Google Custom Search key for the ImageHunt feature, numverify and Vonage keys for phone number information. This has a practical operational consequence that professionals should internalize: every query you run is attributable to your own API accounts, logged by those providers, and rate-limited accordingly. For authorized engagements this is fine; for anything else it is a persistent, self-incriminating audit trail.
The ProtonMail module is a repackaging of pixelbubble's ProtOSINT, credited in the README, and is split into four sub-modules: testing the validity of a single ProtonMail account and retrieving additional information, generating candidate addresses from known identity fields to probe whether a target has a ProtonMail account, checking whether your own IP is affiliated with ProtonVPN, and retrieving a ProtonMail user's PGP key directly in the terminal. The README labels this educational-purposes-only, and it is the module that most obviously brushes against privacy sensitivities, since mass address generation against a provider is the kind of activity that gets API access and accounts terminated when done outside authorized contexts.
Two modules deserve careful framing for defenders. The SMTP analysis feature enumerates whether an SMTP server is vulnerable, which edges from passive OSINT into active service assessment, and should only be pointed at infrastructure you own or are contractually authorized to test. The Google Dork feature ships a set of predefined search queries for use against google.com, effectively packaging passive search-engine recon. The CVE Exploits Finder and vulnerability database options similarly provide research lookup capability, not exploitation tooling — the tool's value here is indexing and surfacing, and nothing in the README suggests weaponized payload generation.
Installation is conventional for the genre. After cloning https://github.com/TermuxHackz/X-osint, you run chmod +x * and then sudo bash setup.sh, after which the entry point is simply xosint or python xosint. For Termux users the same flow applies with pkg instead of apt and without sudo. If dependency installation struggles — and the README candidly admits it might, noting "a lot" of Python packages are required — the recommended fallback is a python3 -m venv virtual environment, pip install -r requirements.txt, and running the setup inside it. Updates are handled either manually by deleting the old binary and re-cloning, or automatically from option 99 in the menu for versions 2.1 and above.
The project shows signs of active maintenance and community traction rather than abandonment. Version 2.3 changelogs list revamped metadata extraction, the DNSinf addition, and the beta network mapper; version 2.2 fixed critical bugs and the author notes the codebase passed a DeepSource analysis scan for bugs and OWASP-flagged security risks. There is also a partnership with tookie-osint, installable from within X-osint's "NEXT tools" menu and runnable via python3 brib.py, which folds another author's OSINT utilities into the same interface. The maintainer, AnonyminHack5, communicates via a Protonmail contact address and GitHub issues.
A few quirks are worth noting as due diligence. The subdomain feature requires an external wordlist that the README links from MediaFire rather than shipping in the repository — a questionable distribution choice that means the tool, as documented, depends on a download outside the repo's integrity guarantees, and prudent users should supply their own wordlist instead. The license plate lookup only works for US-registered plates across a listed set of states and the District of Columbia, and pulls from a government database without an API key. The README also contains promotional Discord bot links unrelated to the tool itself, which says something about the project's monetization-adjacent ambitions but nothing about its function.
Within an authorized workflow, where X-osint fits is the early collection and pivoting phase: confirming whether an email or phone identifier is live, enriching an IP with contextual data, mapping a domain's subdomains and DNS posture, or extracting metadata from documents and images in an investigation set. Its consolidation value is real for solo practitioners and small teams who would otherwise juggle a dozen separate scripts, and its dependence on named commercial APIs means results quality tracks directly with which keys you have configured.
The defensive mirror image matters too. Blue teams should understand that tools like this normalize querying numverify, Shodan, and hunter.io against their organizations' exposed identifiers, so monitoring those same public sources for your own domains, email patterns, and phone ranges is a cheap early-warning exercise. From an educational standpoint, X-osint is a readable case study in how modern OSINT is less about clever tradecraft and more about competent composition of public APIs — and why API key hygiene and provider-side audit logs are now part of the threat model for anyone doing open source intelligence work.
TermuxHackz/X-osint.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.