From e1db144be482d0b2a0754deeea062eedf27e83f1 Mon Sep 17 00:00:00 2001 From: s0lray Date: Fri, 27 Mar 2026 09:35:15 -0400 Subject: [PATCH] Enrich Social Networks tools metadata (THE-141) Co-Authored-By: Paperclip --- public/arf.json | 396 ++++++++++++++++++++++++++++++++++++++++++------ 1 file changed, 348 insertions(+), 48 deletions(-) diff --git a/public/arf.json b/public/arf.json index b8b4568..37b10e3 100644 --- a/public/arf.json +++ b/public/arf.json @@ -2889,22 +2889,82 @@ { "name": "Tinfoleak Web", "type": "url", - "url": "https://tinfoleak.com/" + "url": "https://tinfoleak.com/", + "description": "Web-based platform for Twitter/X intelligence analysis, user profiling, and geolocation-oriented review of public activity.", + "status": "live", + "pricing": "freemium", + "bestFor": "Twitter profile and timeline intelligence", + "input": "Twitter/X username or profile URL", + "output": "Profile details, tweet history views, and account activity context", + "opsec": "active", + "opsecNote": "Queries are sent to third-party service infrastructure and may be logged.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Tinfoleak.py (T)", "type": "url", - "url": "https://www.vicenteaguileradiaz.com/tools/" + "url": "https://github.com/vaguileradiaz/tinfoleak", + "description": "Python command-line tool for collecting Twitter/X account intelligence and metadata from target profiles.", + "status": "live", + "pricing": "free", + "bestFor": "CLI-based Twitter metadata collection", + "input": "Twitter/X usernames or profile identifiers", + "output": "User profile metadata and related account intelligence artifacts", + "opsec": "active", + "opsecNote": "Direct requests to platform endpoints expose source IP and request patterns.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "DMI-TCAT (T)", "type": "url", - "url": "https://github.com/digitalmethodsinitiative/dmi-tcat" + "url": "https://github.com/digitalmethodsinitiative/dmi-tcat", + "description": "Twitter Capture and Analysis Toolset for collecting and analyzing Twitter datasets using self-hosted infrastructure.", + "status": "live", + "pricing": "free", + "bestFor": "Large-scale Twitter collection and analysis", + "input": "API credentials plus search terms, handles, or tracking filters", + "output": "Stored tweet datasets, exports, and analysis-ready records", + "opsec": "active", + "opsecNote": "Requires authenticated API collection and self-hosted data processing.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "Twint (T)", "type": "url", - "url": "https://github.com/twintproject/twint" + "url": "https://github.com/twintproject/twint", + "description": "Open-source Twitter scraping utility for collecting public tweet and user data without official API usage.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical Twitter scraping without API keys", + "input": "Handles, keywords, hashtags, and date filters", + "output": "Tweet collections, user metadata, and exportable structured results", + "opsec": "active", + "opsecNote": "Scraping activity can be detected and blocked by the target platform.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true } ] }, @@ -2915,22 +2975,82 @@ { "name": "GeoSocial Footprint", "type": "url", - "url": "https://geosocialfootprint.com/" + "url": "https://geosocialfootprint.com/", + "description": "Geolocation-focused social media analysis service for mapping public location traces and movement patterns.", + "status": "live", + "pricing": "freemium", + "bestFor": "Location and movement pattern analysis", + "input": "Public social identifiers and geotagged content references", + "output": "Mapped points, movement timelines, and location summaries", + "opsec": "active", + "opsecNote": "Use may be logged by the provider and linked to investigator activity.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "One Million Tweet Map", "type": "url", - "url": "https://onemilliontweetmap.com/" + "url": "https://onemilliontweetmap.com/", + "description": "Interactive map for viewing recent geolocated tweets and filtering by keyword and region.", + "status": "live", + "pricing": "free", + "bestFor": "Real-time geolocated tweet monitoring", + "input": "Keyword, map area, and time filters", + "output": "Mapped tweet locations with associated post content", + "opsec": "passive", + "opsecNote": "Read-only web usage with no direct target interaction required.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Creepy (T)", "type": "url", - "url": "https://www.geocreepy.com/" + "url": "https://github.com/ilektrojohn/creepy", + "description": "Desktop geolocation intelligence tool aggregating public geotagged data from supported social sources.", + "status": "degraded", + "pricing": "free", + "bestFor": "Cross-platform geolocation aggregation", + "input": "Usernames and supported social platform account identifiers", + "output": "Location points, maps, and metadata for linked accounts", + "opsec": "active", + "opsecNote": "Tool pulls remote platform data and can generate identifiable request traffic.", + "localInstall": true, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "Fedica", "type": "url", - "url": "https://fedica.com/" + "url": "https://fedica.com/", + "description": "Social analytics platform with audience and engagement insights across multiple social networks.", + "status": "live", + "pricing": "freemium", + "bestFor": "Cross-platform social analytics and tracking", + "input": "Connected social accounts or profile targets", + "output": "Engagement metrics, trend data, and audience analytics", + "opsec": "active", + "opsecNote": "Platform usage and connected account actions are visible to service provider logs.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2941,17 +3061,62 @@ { "name": "All My Tweets", "type": "url", - "url": "https://www.allmytweets.net/connect/" + "url": "https://www.allmytweets.net/", + "description": "Twitter/X account history viewer for reviewing public tweet timelines in a single interface.", + "status": "live", + "pricing": "free", + "bestFor": "Quick review of tweet history", + "input": "Twitter/X username", + "output": "Chronological list of public tweets and profile activity", + "opsec": "active", + "opsecNote": "Uses third-party web service access that can be logged by provider systems.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Spoonbill", "type": "url", - "url": "https://spoonbill.io" + "url": "https://spoonbill.io/", + "description": "Service that tracks Twitter/X profile changes such as bios, names, and avatars over time.", + "status": "live", + "pricing": "freemium", + "bestFor": "Monitoring profile change history", + "input": "Twitter/X usernames", + "output": "Historical profile snapshots and change alerts", + "opsec": "passive", + "opsecNote": "Monitoring is indirect; investigator does not directly engage target accounts.", + "localInstall": false, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "TweetVacuum (T)", "type": "url", - "url": "https://github.com/UberKitten/TweetVacuum" + "url": "https://github.com/UberKitten/TweetVacuum", + "description": "Tool for extracting larger Twitter/X timeline archives beyond default on-platform browsing constraints.", + "status": "live", + "pricing": "free", + "bestFor": "Expanded tweet history export", + "input": "Twitter/X account identifiers", + "output": "Archived tweet records in local export formats", + "opsec": "active", + "opsecNote": "Collection patterns may be visible through account- or IP-linked activity.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] } @@ -2964,22 +3129,82 @@ { "name": "Reddit Metis", "type": "url", - "url": "https://redditmetis.com/" + "url": "https://redditmetis.com/", + "description": "Reddit user analyzer summarizing posting behavior, language patterns, and subreddit activity.", + "status": "live", + "pricing": "free", + "bestFor": "Reddit user behavior profiling", + "input": "Reddit username", + "output": "Account statistics, subreddit distribution, and content summaries", + "opsec": "passive", + "opsecNote": "Reads public Reddit data without direct interaction with target users.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reddit Archive", "type": "url", - "url": "https://www.redditarchive.com/" + "url": "https://www.redditarchive.com/", + "description": "Archive-oriented Reddit lookup resource for historical post and comment discovery workflows.", + "status": "degraded", + "pricing": "free", + "bestFor": "Historical Reddit content lookup", + "input": "Subreddit names, usernames, and keyword queries", + "output": "Archived post and comment references from historical datasets", + "opsec": "passive", + "opsecNote": "Read-only archive queries; availability may vary with backend data sources.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "subreddits", "type": "url", - "url": "https://subreddits.org/" + "url": "https://subreddits.org/", + "description": "Subreddit discovery index for identifying communities by topic and interest area.", + "status": "live", + "pricing": "free", + "bestFor": "Topic-based subreddit discovery", + "input": "Topic keywords or category browsing", + "output": "Lists of relevant subreddits and navigation paths", + "opsec": "passive", + "opsecNote": "Public index browsing with no direct target engagement.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "Reddit Comment History", "type": "url", - "url": "https://roadtolarissa.com/javascript/reddit-comment-visualizer/" + "url": "https://roadtolarissa.com/javascript/reddit-comment-visualizer/", + "description": "Visualization utility for reviewing Reddit account comment history and timing patterns.", + "status": "live", + "pricing": "free", + "bestFor": "Comment activity timeline analysis", + "input": "Reddit username", + "output": "Comment history visualizations and posting cadence insights", + "opsec": "passive", + "opsecNote": "Analyzes publicly accessible Reddit comment data.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -2990,22 +3215,82 @@ { "name": "LinkedInt - LinkedIn Recon Tool (T)", "type": "url", - "url": "https://github.com/vysecurity/LinkedInt" + "url": "https://github.com/vysecurity/LinkedInt", + "description": "LinkedIn reconnaissance script for enumerating employee profiles and organization-linked data points.", + "status": "degraded", + "pricing": "free", + "bestFor": "LinkedIn employee enumeration", + "input": "Company names, LinkedIn URLs, and search targets", + "output": "Employee profile lists and organization intelligence leads", + "opsec": "active", + "opsecNote": "Automated LinkedIn collection can violate platform policy and trigger detection.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": true }, { "name": "ScrapedIn (T)", "type": "url", - "url": "https://github.com/dchrastil/ScrapedIn" + "url": "https://github.com/dchrastil/ScrapedIn", + "description": "Open-source LinkedIn scraping utility for extracting profile and contact-style data from search results.", + "status": "live", + "pricing": "free", + "bestFor": "LinkedIn profile data extraction", + "input": "LinkedIn search queries and profile targets", + "output": "Structured profile records and contact-oriented datasets", + "opsec": "active", + "opsecNote": "Scraping traffic and automated behavior are detectable by LinkedIn controls.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false }, { "name": "InSpy (T)", "type": "url", - "url": "https://github.com/jobroche/InSpy" + "url": "https://github.com/jobroche/InSpy", + "description": "LinkedIn-focused reconnaissance tool that combines profile discovery with email pattern generation.", + "status": "live", + "pricing": "free", + "bestFor": "Employee and email pattern discovery", + "input": "Company name and domain context", + "output": "Employee candidates with associated role and email pattern hints", + "opsec": "active", + "opsecNote": "Enumeration and enrichment workflows can expose investigator infrastructure.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": true, + "invitationOnly": false, + "deprecated": false }, { "name": "raven (T)", "type": "url", - "url": "https://github.com/0x09AL/raven" + "url": "https://github.com/0x09AL/raven", + "description": "LinkedIn information gathering utility for automated employee enumeration and role filtering.", + "status": "live", + "pricing": "free", + "bestFor": "Automated LinkedIn org mapping", + "input": "Company, role, and location filters", + "output": "Enumerated employee records and role-based lists", + "opsec": "active", + "opsecNote": "Automated platform queries can be rate-limited or flagged.", + "localInstall": true, + "googleDork": false, + "registration": true, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3017,14 +3302,14 @@ "name": "TikTok (M)", "type": "url", "url": "https://www.tiktok.com/@username", - "description": "Direct TikTok profile lookup by manually editing the username in the URL. Quick way to check if a target has a TikTok presence.", + "description": "Manual TikTok profile URL pattern for direct lookup of public account pages.", "status": "live", "pricing": "free", - "bestFor": "Quick TikTok profile existence check", - "input": "TikTok username (replace 'username' in URL)", - "output": "Public TikTok profile page with videos, bio, and follower counts", - "opsec": "passive", - "opsecNote": "Standard web request to TikTok; profile views are not visible to the account owner without login.", + "bestFor": "Fast manual TikTok profile checks", + "input": "TikTok username inserted into the URL", + "output": "Public profile page with videos, bio, and engagement counts", + "opsec": "active", + "opsecNote": "Direct visits are observable by platform infrastructure; use caution when logged in.", "localInstall": false, "googleDork": false, "registration": false, @@ -3037,14 +3322,14 @@ "name": "TikTok-OSINT (T)", "type": "url", "url": "https://github.com/Omicron166/TikTok-OSINT", - "description": "Python CLI tool for collecting OSINT data from TikTok profiles including user metadata, video listings, and engagement statistics. Last updated October 2022.", - "status": "degraded", + "description": "Python tool for extracting TikTok profile metadata and video-linked OSINT artifacts.", + "status": "live", "pricing": "free", - "bestFor": "Automated TikTok profile data collection", - "input": "TikTok username or profile URL", - "output": "User metadata, video listings, engagement stats, and follower data", + "bestFor": "Automated TikTok metadata collection", + "input": "TikTok usernames or profile URLs", + "output": "Profile metadata, video details, and engagement-related fields", "opsec": "active", - "opsecNote": "Makes direct API requests to TikTok servers; may trigger rate limiting.", + "opsecNote": "Automated requests can trigger anti-abuse controls and rate limits.", "localInstall": true, "googleDork": false, "registration": false, @@ -3056,15 +3341,15 @@ { "name": "Unfurl", "type": "url", - "url": "https://dfir.blog/unfurl/", - "description": "Web and CLI tool that extracts and visualizes metadata embedded in URLs, including TikTok share links, timestamps, and tracking parameters. Also installable locally via Python.", + "url": "https://github.com/obsidianforensics/unfurl", + "description": "Forensic parser that extracts and visualizes metadata components embedded in URLs.", "status": "live", "pricing": "free", - "bestFor": "URL metadata extraction and timestamp analysis", - "input": "Any URL (including TikTok share/video links)", - "output": "Visual graph of extracted URL components, timestamps, and embedded identifiers", + "bestFor": "URL parameter and metadata forensics", + "input": "URLs or encoded URL fragments", + "output": "Parsed components, decoded values, and relationship visualizations", "opsec": "passive", - "opsecNote": "Parses URL structure locally in browser or on the Unfurl server; does not contact the target platform. Local install available for sensitive investigations.", + "opsecNote": "Local analysis mode avoids contacting target platforms during parsing.", "localInstall": true, "googleDork": false, "registration": false, @@ -3077,14 +3362,14 @@ "name": "yt-dlp (T)", "type": "url", "url": "https://github.com/yt-dlp/yt-dlp", - "description": "Feature-rich command-line video downloader supporting 1000+ sites including TikTok. Extracts video files, metadata, thumbnails, subtitles, and comments.", + "description": "Actively maintained command-line downloader for collecting video content and metadata from many platforms.", "status": "live", "pricing": "free", - "bestFor": "Downloading TikTok videos and extracting metadata for preservation", - "input": "TikTok video URL or user profile URL", - "output": "Downloaded video files, JSON metadata, thumbnails, subtitles, and comments", + "bestFor": "Video evidence preservation and metadata export", + "input": "Video, playlist, or channel URLs", + "output": "Media files, JSON metadata, thumbnails, subtitles, and related artifacts", "opsec": "active", - "opsecNote": "Makes direct HTTP requests to TikTok to download content; IP is visible to the platform.", + "opsecNote": "Direct content fetch requests expose investigator network identifiers.", "localInstall": true, "googleDork": false, "registration": false, @@ -3102,7 +3387,22 @@ { "name": "Treeverse (T)", "type": "url", - "url": "https://github.com/paulgb/Treeverse" + "url": "https://treeverse.app/", + "description": "Thread visualization tool for exploring conversation trees on supported social platforms.", + "status": "live", + "pricing": "free", + "bestFor": "Conversation structure mapping", + "input": "Post or thread URLs", + "output": "Hierarchical thread trees with participant and reply context", + "opsec": "passive", + "opsecNote": "Public-content visualization without direct target interaction.", + "localInstall": false, + "googleDork": false, + "registration": false, + "editUrl": false, + "api": false, + "invitationOnly": false, + "deprecated": false } ] }, @@ -3114,14 +3414,14 @@ "name": "Bellingcat Meta Content Library", "type": "url", "url": "https://bellingcat.gitbook.io/toolkit/more/all-tools/meta-content-library", - "description": "Bellingcat's guide to Meta's Content Library, a research platform providing near-real-time searchable archive of public Threads, Facebook, and Instagram content.", + "description": "Guide to Meta Content Library access for researching public Facebook, Instagram, and Threads content.", "status": "live", "pricing": "free", - "bestFor": "Large-scale Threads content search for academic and non-profit research", - "input": "Search queries, date ranges, content filters", - "output": "Public posts, engagement metrics, and text-in-image search results from Threads and other Meta platforms", + "bestFor": "Meta platform archive research for eligible organizations", + "input": "Approved research queries and archive search filters", + "output": "Searchable public-content archive results and metadata", "opsec": "passive", - "opsecNote": "Searches Meta's research archive; does not interact with target accounts directly. Requires academic/non-profit eligibility approval.", + "opsecNote": "Archive-centric workflow with eligibility gate; no direct account engagement.", "localInstall": false, "googleDork": false, "registration": true,