This repository is a curated 'awesome list' of public security-related APIs, not a software application or data pipeline. The primary artifact is README.md, a hand-maintained table of roughly 100 APIs categorized into Online services, Tools, SIEM platforms, and Various. Each entry records the API name, description, authentication type, HTTPS support, documentation link, and licensing model. The only executable logic is a GitHub Actions workflow that runs awesome_bot weekly to detect broken links in the README. A supplementary document, apidocs/haveIBeenPwned.md, documents unofficial Have I Been Pwned domain-search endpoints discovered in 2018. Despite being classified as an application for tooling purposes, there is no application code, library, or service in this repository. It functions as a knowledge base for security engineers and threat intelligence practitioners. The CI workflow is the only automated component and is a standard awesome-list link checker. The value is in the curation and categorization of APIs, not in reusable software components. The list is actively maintained, but some entries are aging and may reflect outdated API details or vendor changes.
The exifLooter is a command-line application written in Go that extracts EXIF metadata, particularly GPS coordinates, from image files. It relies on the external exiftool command-line utility to perform the actual metadata extraction and provides a user-friendly interface for analyzing single images, directories of images, or images downloaded from URLs via stdin. The tool also offers functionality to remove all metadata from images and to generate OpenStreetMap URLs from GPS coordinates found in images. The architecture is a standard CLI tool built using the Cobra library for command parsing and the fatih/color library for colored terminal output. The main entry point is in main.go, which delegates to the command defined in cmd/root.go. The core functionality involves invoking exiftool via os/exec, parsing its output to detect GPS-related tags, and presenting the results with color-coded warnings when geolocation data is detected. Additional features include downloading images from URLs (with validation of content type) for batch processing in a pipe mode. While the tool fulfills its intended purpose, the codebase exhibits some areas for improvement: the pipe mode's image validation step is inefficient (rescanning the entire directory for each download), the OpenStreetMap URL generation function incorrectly handles southern and western hemisphere coordinates, and there is a lack of automated tests. Despite these issues, the project is actively maintained with recent commits and uses dependency management via Go modules.
Seeker is a CLI-based social engineering tool that hosts fake web pages designed to trick users into granting geolocation permissions. When a victim visits the served page, JavaScript collects precise GPS coordinates, device fingerprinting data (OS, CPU cores, RAM, screen resolution, GPU, browser, IP addresses), and public IP information via ipwhois.app. The tool uses PHP's built-in server to serve the templates and handles incoming data through PHP endpoints that write to local log files. Seeker then polls these logs, stores results in CSV/KML formats, and can forward captured data to Telegram bots or Discord webhooks. It supports multiple phishing templates (Google Drive, WhatsApp, Telegram, Zoom, reCAPTCHA, and a 'NearYou' map page) and integrates with tunneling services like ngrok for public exposure. The repository is primarily a penetration testing and educational proof-of-concept, demonstrating the ease of harvesting geolocation data through deceptive web pages. While functional and well-documented, the codebase lacks tests and uses environment-variable-driven configuration to avoid interactive prompts in deployment scenarios.
This repository is a curated list (awesome list) of open-source intelligence (OSINT) tools and resources. It is not a software application or a data research pipeline; it is a static markdown document that categorizes and links to hundreds of OSINT-related websites, tools, and services. The list covers a wide range of categories including search engines, social media tools, domain and IP research, people investigations, email search, phone number research, threat intelligence, and more. It is maintained by the community through pull requests and follows the awesome-list format. As a curated list, there is no executable code, no data ingestion, no transformation logic, and no analytical models. The value lies in the curation and organization of resources. The repository is primarily a reference for OSINT practitioners, researchers, and security professionals. While not a traditional software project, the list is well-structured and actively maintained. It can be easily cloned and used offline. However, from a software engineering perspective, there are no reusable components or architectural patterns to evaluate.
maltego-trx is the legacy Python SDK for building Maltego transforms (the OSINT/graph investigation platform), now explicitly archived and superseded by the actively maintained maltego-transforms SDK. In production it runs as a Flask HTTP server: the Maltego desktop client POSTs an XML transform request to /run/<transform_name>/, the server parses it into a MaltegoMsg, dispatches to a registered transform class, and serializes the resulting MaltegoTransform response back as XML. Transform classes are auto-discovered from the project's local `transforms` package (class name must match the filename and subclass DiscoverableTransform). The package also ships a CLI (`maltego-trx start`/`init`) that scaffolds new transform projects from a template directory, plus a project-level CLI (`project.py runserver/list/local`) implemented in handler.py.
AssetsHunter is a Python-based information gathering framework designed for asset discovery and reconnaissance. It provides both active and passive modules for tasks such as web service detection (Hawkeye), information leakage checks (InfoRisk), CMS fingerprinting (WhatCMS), and various passive data collection methods including DNS resolution, WHOIS queries, SSL certificate transparency logs, and IP reputation services. The framework uses a modular architecture with command-line argument parsing to select specific reconnaissance modules. While functional, the code exhibits several quality issues: inconsistent error handling, tight coupling between modules and configuration, repetitive code patterns (especially in the passive modules), and limited use of modern Python practices. The framework demonstrates basic reconnaissance capabilities but lacks sophistication in areas like rate limiting, robust error handling, and modular extensibility.
This repository is a curated list of links for image-related OSINT (Open Source Intelligence) tools and resources. It categorizes tools into reverse image search, stock image search, facial recognition, image investigation, and image manipulation. The repository contains no executable code, only a README.md file with the list of links. As such, it functions as a reference resource rather than a software application or data processing pipeline. The README provides organized tables and descriptions but lacks any code, data processing, or analytical components.
This repository is a curated cheat sheet for web application security testing, penetration testing, and bug bounty hunting. It aggregates a vast collection of tools, commands, URLs, and references organized by phases: discovering, enumerating, scanning, monitoring, attacking, manual exploitation, and AI-related security. The repo contains no application code; it is a markdown document only. It is a valuable reference for security professionals but lacks any executable software components or data pipelines. The information is comprehensive and well-structured, but the repository itself is not a functional system and does not demonstrate software architecture or engineering craftsmanship beyond content curation.
This repository is a large collection of standalone Python scripts designed for the Termux environment on Android. It is marketed as an educational cybersecurity toolkit but contains functional phishing pages, credential harvesters, location trackers, camera/mic capture scripts, and a trojan for data exfiltration. The codebase also includes some legitimate utilities such as a password manager, file converter, network scanner, and backup tool. The architecture is highly fragmented: each script is self-contained with its own dependency auto-installation, Flask server, and cloudflared tunnel for public exposure. There is no shared module structure, and the code is heavily duplicated across English and Greek translations. The overall quality is low due to copy-paste patterns, hardcoded secrets, suppressed error logging, lack of testing, and reliance on external services like cloudflared. The repository poses significant legal and ethical risks due to its phishing and surveillance capabilities.
This repository is a curated collection of over 1000 OSINT (Open Source Intelligence) tools, services, and resources organized by category. It is not a software application itself, but a static list compiled in a README.md file with occasional supporting HTML pages for specific searches (court records, graves, hashtags). The repository contains no executable code, libraries, or frameworks—it serves purely as a reference directory. Weekly update HTML files track additions over time. While popular (8700+ stars), the repository offers zero reusable software components, architecture, or data pipelines. It is a flat list of links with brief descriptions, useful for human browsing but not for programmatic consumption or reuse as a codebase.