Argos provisions an Ubuntu Budgie VM with 20+ OSINT tools, per-task menu launchers, and a case folder model that preserves commands, outputs and SHA-256 hashes for authorized investigations.
| Tool | SOsintOps/Argos — shell-based installer and launcher suite that turns Ubuntu Budgie 24.04/26.04 LTS into an OSINT workstation |
| Category | OSINT workstation provisioning and evidence management (Shell/Bash) |
| Primary Use | Building a reproducible per-case OSINT VM where results from Sherlock, Maigret, Amass, theHarvester, SpiderFoot and others land in structured case folders with hashes |
| Safe Use | Authorized investigations, private-sector due diligence, law-enforcement intelligence work, and defensive research inside dedicated lab VMs you own |
| Telemetry Note | The workstation itself is quiet, but its bundled tools generate visible query patterns: username-enumeration hits against social platforms, passive DNS lookups via Amass/subfinder, Shodan API calls, and Wayback/Common Crawl fetches via gau — all observable from the queried services' side |
Argos from SOsintOps/Argos answers a question most OSINT practitioners solve badly with ad-hoc scripts: how do you turn a freshly installed Linux VM into a complete, reproducible investigation environment without spending a weekend fighting Python versions and broken dependencies? The project, written in Shell and MIT-licensed with 171 stars at time of writing, targets Ubuntu Budgie 24.04 or 26.04 LTS specifically, installs more than twenty tools, and wraps each investigative task in a menu launcher so an analyst never has to remember a tool's flag soup. What makes it distinctive is not the tool list — most of these are household names in the OSINT community — but the evidence discipline layered on top of every run.
The core architectural commitment is the case model. You open Argos Case, create a case like 2026-017-fraud, and the case folder scaffolds itself under ~/Documents/Argos/cases/<case>/ with notes/, reports/, manual-captures/ and deliverables/ subdirectories. Every subsequent launcher invocation writes its output into <tool>/<UTC time>_<target>/, and crucially each run folder contains command.txt with the exact command, tool version, UTC timestamps and exit code, output.log with the complete tool output, and a SHA256SUMS file hashing every artifact produced. This is chain-of-custody thinking applied to OSINT, and it is what separates defensible findings from screenshots pasted into a chat.
The launcher matrix itself is broad. Username and email enumeration runs Sherlock, Maigret, Blackbird, User Scanner, Linkook, Socialscan and Consensus — the last being a meta-search over the lookup catalogues of nineteen username and email projects, introduced in 3.2.3-beta and saving its scan as JSON with an HTML report derived from it, optionally routed through Tor. Domain work combines theHarvester 5, subfinder, Amass v5 and gau for passive subdomain discovery and URL harvesting from Wayback Machine, Common Crawl, OTX and urlscan. Instagram collection uses Instaloader and Toutatis, the latter leveraging your existing Firefox session for stories, highlights and geotags.
Beyond collection, the suite covers documents and media forensics seriously. metagoofil and ExifTool extract document metadata into CSV; yt-dlp with deno handles video download including comments, subtitles and playlists; and the Video Tools launcher exposes ffmpeg, ffprobe and ExifTool for technical reports, frame extraction, motion-only summaries and contact sheets. Version 3.3.0-beta added EditSimple, a video editor forked with Linux fixes that turns raw footage into presentable evidence — tracking zoom, pixelation of faces and plates that follows subjects, freeze frames with a clock, and annotated exports to MP4. That is an unusual capability for an OSINT distribution and speaks to the project's report-first philosophy.
Reproducibility across Ubuntu releases is handled with real engineering care. Python-based tools run in environments managed by uv on a fixed, tested Python version regardless of what the system ships, which is the pragmatic answer to Debian/Ubuntu Python churn. Binaries are downloaded from official upstream releases with checksums verified. The installer logs everything to ~/Downloads/argos_install_<date>.log, continues past individual tool failures, and summarizes problems at the end — a resilience pattern that matters when you are pulling two dozen upstream projects in one pass. A shellcheck GitHub Actions workflow badge suggests the launcher code is linted in CI, and the README states launchers are covered by automated tests including real dialogs.
Installation is a deliberately boring three-step affair: sudo apt install -y git, git clone https://github.com/SOsintOps/Argos.git, then ./setup.sh from the repo directory, followed by a reboot. The README is explicit about not running the installer as root, requires English system language for the standard folder names (~/Documents, ~/Downloads), and reminds VirtualBox users to install Guest Additions first. Post-install, the Argos Check launcher starts every tool and reports anything broken — run it before you start a case. Selective re-runs are supported: ./setup.sh --list shows steps, ./setup.sh launchers reinstalls menu entries, and ./setup.sh python-tools amass theharvester updates just those tools.
Two analytical graph tools round out the picture: Quaesitor, an in-house fork of OSInt Graph, renders the case as a browser-based graph of people, phones, emails, profiles, vehicles, places and documents, with CSV/Excel import, OCR'd document sources and a local archive under ~/Documents/Argos/quaesitor — nothing leaves the machine. Flowsint from reconurge provides a Docker-based graph investigation platform with enrichers, started and stopped from its launcher. SpiderFoot and recon-ng veterans get their familiar interfaces too, with recon-ng workspaces auto-named after the active case, and Shodan access through a patched Shodan CLI that the README candidly notes needs a fix to start because upstream is unmaintained since 2024.
That candor extends to a full tool-status table checked against October 2026, grading each dependency as active, low, or unmaintained. Toutatis, Shodan CLI and PhoneInfoga are flagged unmaintained; Blackbird, Socialscan, EyeWitness and SpiderFoot are rated low. This is the kind of honest supply-chain accounting you want in a distribution that depends on two dozen third-party projects, and it doubles as a maintenance-risk briefing for anyone building an authorized workflow on top of the stack — tools querying rate-limited or hostile-to-scraping services can break without warning.
The reporting layer is where Argos shows its intelligence-community lineage. Version 3.1.2-beta aligned analysis guidelines and report templates with the project's own Intelligence Field Notes, adopting UNODC 4×4 source grading and a likelihood row following ICD 203; 3.1.3-beta added key judgements, gaps and annexes separated from findings; and 3.2.0-beta bundled ONLYOFFICE Desktop Editors to fill the .docx templates. For authorized professionals producing intelligence products rather than raw data dumps, this scaffolding — source grading baked into the template, run folders and hashes quotable in the source table — is arguably the strongest reason to adopt the project.
For defenders and red-teamers thinking about their own footprint: the README's Privacy and OPSEC section (referenced in the contents) plus the optional Tor routing for Consensus show awareness that OSINT collection is observable from the services being queried. Username enumeration across social platforms, passive DNS pulls and Shodan API usage all leave server-side traces regardless of client-side hygiene. The recommendation to use a dedicated VM per investigation, stated in Requirements, is both an OPSEC and a contamination-control measure worth copying even if you never install Argos itself. At version 3.3.1-beta with field testing ongoing before a stable release, it is a beta — but a beta with unusually rigorous evidence handling and documentation architecture, and one well suited to authorized investigations, lab training environments and due-diligence work in environments you control.
SOsintOps/Argos.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.