From bfd562a7f653dde7cac2352b1cb56de2c5b9f5a9 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 12:25:32 -0400 Subject: [PATCH] Enrich Instant Messaging tools metadata (THE-143) Co-Authored-By: Paperclip --- public/arf.json | 357 +++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 336 insertions(+), 21 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..7cc0824 100644 --- a/public/arf.json +++ b/public/arf.json @@ -3308,7 +3308,22 @@ { "name": "Comms Analyzer Toolbox (T)", "type": "url", - "url": "https://github.com/bitsofinfo/comms-analyzer-toolbox" + "url": "https://github.com/bitsofinfo/comms-analyzer-toolbox", + "description": "Open-source toolkit for forensic analysis of communication archives with Elasticsearch/Kibana dashboards for message timelines and pattern analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Email/SMS chat archive forensics and timeline analysis", + "input": "Communication exports and structured message datasets", + "output": "Searchable communication records, timelines, and analytics dashboards", + "opsec": "passive", + "opsecNote": "Performs local analysis on collected datasets and does not contact targets by default.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3319,12 +3334,42 @@ { "name": "Disboard", "type": "url", - "url": "https://disboard.org/" + "url": "https://disboard.org/", + "description": "Public Discord server discovery platform used to find communities by topic, language, and popularity.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering public Discord communities and server metadata", + "input": "Keyword, category, or tag searches", + "output": "Indexed public Discord server listings with invite links and tags", + "opsec": "passive", + "opsecNote": "Searches are performed against Disboard listings; browsing does not interact with target users directly.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DiscordOSINT (T)", "type": "url", - "url": "https://github.com/husseinmuhaisen/DiscordOSINT" + "url": "https://github.com/husseinmuhaisen/DiscordOSINT", + "description": "GitHub repository of Discord investigation techniques, queries, and tooling references for OSINT workflows.", + "status": "live", + "pricing": "free", + "bestFor": "Learning Discord investigation methods and toolchains", + "input": "Manual review of documentation and linked resources", + "output": "Investigation guidance, resource links, and workflow references", + "opsec": "passive", + "opsecNote": "Reference material only; OPSEC depends on which downstream tools are executed.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3335,7 +3380,22 @@ { "name": "Awesome OSINT", "type": "url", - "url": "https://github.com/jivoi/awesome-osint" + "url": "https://github.com/jivoi/awesome-osint", + "description": "Large curated OSINT resource list covering investigation tools, techniques, and training references.", + "status": "live", + "pricing": "free", + "bestFor": "Broad OSINT tool discovery and methodology reference", + "input": "Manual browsing by topic", + "output": "Categorized links to OSINT tools and learning resources", + "opsec": "passive", + "opsecNote": "Reference index only; OPSEC depends on the external resources selected.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3346,7 +3406,22 @@ { "name": "OSINT Industries", "type": "url", - "url": "https://www.osint.industries/" + "url": "https://www.osint.industries/", + "description": "Commercial OSINT investigation platform focused on account attribution and cross-platform identity correlation.", + "status": "live", + "pricing": "paid", + "bestFor": "Enterprise-grade identity enrichment and account correlation", + "input": "Email addresses, usernames, phone numbers, and account identifiers", + "output": "Correlated identity intelligence and linked platform account results", + "opsec": "passive", + "opsecNote": "Lookups run through the provider platform; no direct contact with targets is required for standard queries.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3357,17 +3432,62 @@ { "name": "SlackPirate (T)", "type": "url", - "url": "https://github.com/emtunc/SlackPirate" + "url": "https://github.com/emtunc/SlackPirate", + "description": "Security testing tool for Slack workspaces that enumerates channels and extracts accessible messages/files from authenticated sessions.", + "status": "live", + "pricing": "free", + "bestFor": "Slack workspace enumeration and sensitive data exposure assessment", + "input": "Authenticated Slack session/token and workspace target", + "output": "Channel/user inventory and extracted accessible Slack content", + "opsec": "active", + "opsecNote": "Interacts directly with Slack workspace APIs and can leave observable request activity.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "slack-intelbot (T)", "type": "url", - "url": "https://github.com/pun1sh3r/slack-intelbot" + "url": "https://github.com/pun1sh3r/slack-intelbot", + "description": "Slack bot that enriches indicators such as domains, IPs, and hashes by querying external threat intelligence services.", + "status": "live", + "pricing": "free", + "bestFor": "In-channel IOC enrichment for threat intelligence triage", + "input": "Indicators posted in Slack and configured API credentials", + "output": "Automated enrichment responses with indicator context and reputation data", + "opsec": "passive", + "opsecNote": "Queries third-party intelligence APIs; no direct interaction with investigation targets by default.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "slack-web-scraper (T)", "type": "url", - "url": "https://github.com/iulspop/slack-web-scraper" + "url": "https://github.com/iulspop/slack-web-scraper", + "description": "Automation script for collecting Slack channel history and metadata from accessible workspaces.", + "status": "live", + "pricing": "free", + "bestFor": "Archiving Slack channel content for offline analysis", + "input": "Slack-authenticated browser/session context", + "output": "Scraped channel messages and related metadata exports", + "opsec": "active", + "opsecNote": "Direct scraping activity against Slack endpoints may be logged and rate-limited.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3378,27 +3498,102 @@ { "name": "Google CSE for Telegram links", "type": "url", - "url": "https://cse.google.com/cse?cx=006368593537057042503:efxu7xprihg" + "url": "https://cse.google.com/cse?cx=006368593537057042503:efxu7xprihg", + "description": "Preconfigured Google Custom Search Engine focused on public Telegram links and channel discovery.", + "status": "live", + "pricing": "free", + "bestFor": "Finding public Telegram channels and groups by keyword", + "input": "Keyword search terms", + "output": "Google CSE results linking to public Telegram resources", + "opsec": "passive", + "opsecNote": "Queries are sent to Google CSE rather than directly to Telegram services.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": true, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Telegago (T)", "type": "url", - "url": "https://tools.osintnewsletter.com/osint-tools/telegago-telegram" + "url": "https://tools.osintnewsletter.com/osint-tools/telegago-telegram", + "description": "Telegram-focused search interface built on Google CSE to discover public channels, groups, and related pages.", + "status": "live", + "pricing": "free", + "bestFor": "Keyword discovery across publicly indexed Telegram content", + "input": "Keyword search terms", + "output": "Search results pointing to public Telegram channels and posts", + "opsec": "passive", + "opsecNote": "Uses indexed search results and does not require direct interaction with target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Telegram-OSINT (T)", "type": "url", - "url": "https://github.com/The-Osint-Toolbox/Telegram-OSINT" + "url": "https://github.com/The-Osint-Toolbox/Telegram-OSINT", + "description": "Curated Telegram OSINT repository linking tools, techniques, and investigative references.", + "status": "live", + "pricing": "free", + "bestFor": "Sourcing Telegram-specific tooling and investigative playbooks", + "input": "Manual review of listed tools and references", + "output": "Collection of Telegram OSINT resources and workflows", + "opsec": "passive", + "opsecNote": "Reference repository only; OPSEC depends on the selected downstream tools.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TGStat", "type": "url", - "url": "https://tgstat.com/" + "url": "https://tgstat.com/", + "description": "Telegram analytics platform indexing public channels and chats with growth, engagement, and content metrics.", + "status": "live", + "pricing": "freemium", + "bestFor": "Telegram channel trend analysis and engagement benchmarking", + "input": "Channel names, keywords, and Telegram entity identifiers", + "output": "Audience metrics, posting statistics, and channel ranking insights", + "opsec": "passive", + "opsecNote": "Reads TGStat indexed analytics data; no direct contact with targets for normal lookups.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Tosint (T)", "type": "url", - "url": "https://github.com/drego85/tosint" + "url": "https://github.com/drego85/tosint", + "description": "Telegram OSINT script for profiling bots, extracting public metadata, and correlating related infrastructure clues.", + "status": "live", + "pricing": "free", + "bestFor": "Telegram bot reconnaissance and metadata extraction", + "input": "Telegram bot usernames, links, or identifiers", + "output": "Extracted bot metadata, discovery artifacts, and investigation leads", + "opsec": "active", + "opsecNote": "Performs direct queries to Telegram services for target resolution and metadata retrieval.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3409,32 +3604,122 @@ { "name": "Sogou WeChat Search", "type": "url", - "url": "https://weixin.sogou.com/" + "url": "https://weixin.sogou.com/", + "description": "Chinese search portal indexing publicly accessible WeChat articles and official account content.", + "status": "live", + "pricing": "free", + "bestFor": "Discovering public WeChat posts and organization presence", + "input": "Chinese keywords, account names, or article titles", + "output": "Indexed WeChat article pages and related account search results", + "opsec": "passive", + "opsecNote": "Queries Sogou index results and does not require direct access to target accounts.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WechatSogou (T)", "type": "url", - "url": "https://github.com/Chowency/WechatSogou" + "url": "https://github.com/Chowency/WechatSogou", + "description": "Python package for automating Sogou WeChat searches and parsing returned article/account results.", + "status": "live", + "pricing": "free", + "bestFor": "Automating batch WeChat article and account discovery", + "input": "Search keywords and query parameters", + "output": "Parsed WeChat article and account metadata from Sogou results", + "opsec": "passive", + "opsecNote": "Automates queries to Sogou search endpoints; no direct messaging-platform interaction with target users.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "wechat-dump (T)", "type": "url", - "url": "https://github.com/ppwwyyxx/wechat-dump" + "url": "https://github.com/ppwwyyxx/wechat-dump", + "description": "Tool for exporting WeChat chat data from rooted Android devices for forensic examination and recovery.", + "status": "live", + "pricing": "free", + "bestFor": "Authorized mobile WeChat chat history extraction and preservation", + "input": "Rooted Android device data and WeChat app storage", + "output": "Extracted local WeChat message databases and media artifacts", + "opsec": "passive", + "opsecNote": "Operates on local device data and does not require contacting external targets.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "wechat-text-backup (T)", "type": "url", - "url": "https://github.com/zhaofeng-shu33/wechat-text-backup" + "url": "https://github.com/zhaofeng-shu33/wechat-text-backup", + "description": "WeChat database decryption and backup utility for exporting local message history into readable text formats.", + "status": "live", + "pricing": "free", + "bestFor": "Decrypting and backing up local WeChat message archives", + "input": "Local WeChat database files and decryption context", + "output": "Decrypted, readable WeChat chat history exports", + "opsec": "active", + "opsecNote": "Performs direct decryption and extraction actions against local account data stores.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "linelog2py (T)", "type": "url", - "url": "https://github.com/jyu0414/linelog2py" + "url": "https://github.com/jyu0414/linelog2py", + "description": "Python parser for processing exported LINE chat logs into structured records for analysis.", + "status": "live", + "pricing": "free", + "bestFor": "Converting LINE chat exports for downstream analysis workflows", + "input": "Exported LINE chat history files", + "output": "Structured parsed LINE messages and conversation artifacts", + "opsec": "passive", + "opsecNote": "Processes local chat export files without contacting target services.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "line-message-analyzer (T)", "type": "url", - "url": "https://github.com/chonyy/line-message-analyzer" + "url": "https://github.com/chonyy/line-message-analyzer", + "description": "Local analysis utility for LINE chat exports that computes message statistics and conversational activity patterns.", + "status": "live", + "pricing": "free", + "bestFor": "LINE conversation frequency and behavior analysis", + "input": "LINE exported chat history files", + "output": "Message analytics, usage trends, and conversation summaries", + "opsec": "passive", + "opsecNote": "Runs locally on exported chat data and does not directly query target accounts.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3445,12 +3730,42 @@ { "name": "Email2WhatsApp (T)", "type": "url", - "url": "https://github.com/dsonbaker/email2whatsapp" + "url": "https://github.com/dsonbaker/email2whatsapp", + "description": "OSINT utility for correlating email addresses to potential WhatsApp identifiers and account traces.", + "status": "live", + "pricing": "free", + "bestFor": "Email-to-WhatsApp account correlation during profiling", + "input": "Email address targets", + "output": "Potential linked WhatsApp account indicators and correlation results", + "opsec": "passive", + "opsecNote": "Primarily performs correlation lookups without messaging target accounts directly.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "WhatsApp-OSINT (T)", "type": "url", - "url": "https://github.com/kinghacker0/WhatsApp-OSINT" + "url": "https://github.com/kinghacker0/WhatsApp-OSINT", + "description": "WhatsApp reconnaissance toolchain using API-backed lookups for account and device-related intelligence collection.", + "status": "live", + "pricing": "freemium", + "bestFor": "Rapid WhatsApp account reconnaissance and metadata checks", + "input": "Phone numbers or WhatsApp account identifiers", + "output": "Enriched account metadata and reconnaissance results", + "opsec": "active", + "opsecNote": "Direct API-driven lookups against messaging infrastructure may be logged by providers.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }