kmshihab7878/claude-code-setup/osint-recon

# Pattern: Multi-platform username check
import asyncio
import aiohttp
from typing import TypedDict
class UsernameResult(TypedDict):
    platform: str
    url: str
    status: str  # "found", "not_found", "error"
    response_time_ms: float
PLATFORMS = {
    "github": "https://github.com/{username}",
    "twitter": "https://x.com/{username}",
    "instagram": "https://instagram.com/{username}",
    "reddit": "https://reddit.com/user/{username}",
    "linkedin": "https://linkedin.com/in/{username}",
    "medium": "https://medium.com/@{username}",
    "dev.to": "https://dev.to/{username}",
    "hackernews": "https://news.ycombinator.com/user?id={username}",
}
async def check_username(
    session: aiohttp.ClientSession,
    platform: str,
    url: str,
) -> UsernameResult:
    """Check if username exists on a platform."""
    try:
        async with session.get(url, timeout=aiohttp.ClientTimeout(total=10)) as resp:
            return {
                "platform": platform,
                "url": url,
                "status": "found" if resp.status == 200 else "not_found",
                "response_time_ms": 0,
            }
    except Exception:
        return {"platform": platform, "url": url, "status": "error", "response_time_ms": 0}

# DNS enumeration
dig +short A example.com
dig +short MX example.com
dig +short TXT example.com
dig +short NS example.com
 
# WHOIS
whois example.com
 
# Subdomain enumeration
# Tools: subfinder, amass, sublist3r
subfinder -d example.com -silent
 
# Certificate transparency
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq '.[].name_value'

# Pattern: Email OSINT workflow
def email_osint(email: str) -> dict:
    """Gather intelligence from an email address."""
    local_part, domain = email.split("@")
    return {
        "email": email,
        "domain_info": {
            "mx_records": dns_lookup(domain, "MX"),
            "spf_record": dns_lookup(domain, "TXT", filter="spf"),
            "dmarc_record": dns_lookup(f"_dmarc.{domain}", "TXT"),
        },
        "breach_check": "Use HaveIBeenPwned API",
        "social_profiles": "Cross-reference with username enumeration",
        "domain_age": "WHOIS creation date",
    }

# Pattern: CTI feed aggregation
from dataclasses import dataclass
from datetime import datetime
from enum import Enum
class ThreatLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"
@dataclass
class ThreatIndicator:
    ioc_type: str  # ip, domain, hash, email, url
    ioc_value: str
    source: str
    threat_level: ThreatLevel
    first_seen: datetime
    context: str
    confidence: float  # 0.0 - 1.0

## Investigation: {{target}}
**Date**: {{date}}
**Objective**: {{objective}}
**Scope**: {{scope}}
 
### Findings
| Source | Data Point | Confidence | Notes |
|--------|-----------|------------|-------|
 
### Timeline
| Date | Event | Source |
 
### Connections Map
[Graph of relationships between entities]
 
### Assessment
**Confidence Level**: Confirmed / Probable / Possible / Doubtful
**Summary**:
**Recommendations**:

# Pattern: Cross-source entity matching
def correlate_entities(sources: list[dict]) -> list[dict]:
    """Match entities across different OSINT sources."""
    # Exact matches: email, phone, unique IDs
    # Fuzzy matches: names (Levenshtein), usernames (substring)
    # Behavioral matches: writing style, posting times
    # Visual matches: profile photo reverse image search
    ...

# Store investigation entities
mcp__memory__create_entities: [{name: "target_user", entityType: "person", observations: ["..."]}]
mcp__memory__create_relations: [{from: "target_user", to: "target_domain", relationType: "owns"}]
mcp__memory__search_nodes: {query: "target investigation"}