OSINT commands BETA

Send "osint" in your chat and the model replies with these commands and their exact syntax — no need to memorize anything.

These commands are new and may have bugs.

• osint:email <address>

  Builds a full picture of an email address — where it is registered, the identity behind it, and where it appears online — without ever alerting the owner.

  whoisdigholehemosintgravatarGitHubweb searchwebfetch

  How it works

  #	Step	What it does
  1	whois	Domain registration record
  2	dig	DNS records (A, MX, NS, TXT)
  3	holehe	Sites the email is registered on
  4	mosint	Email OSINT aggregator
  5	gravatarcustom	Public Gravatar profile
  6	githubcustom	GitHub account + leaked commit emails
  7	webfetchcustom	Rendered page fetch (headless browser)

• osint:person <name>

  Finds the public profiles and accounts tied to a name across the web.

  maigretsocial-analyzerGitHubtheHarvesterweb searchwebfetch

  How it works

  #	Step	What it does
  1	maigret	Username search across ~3000 sites
  2	social_analyzer	Profile search across ~1000 sites
  3	githubcustom	GitHub account + leaked commit emails
  4	theharvester	Emails, subdomains, hosts, employees

• osint:company <name>

  Resolves a company name to its real infrastructure and the people behind it.

  theHarvesterwhoiscrt.shdigcloud_enumweb searchwebfetch

  How it works

  #	Step	What it does
  1	theharvester	Emails, subdomains, hosts, employees
  2	whois	Domain registration record
  3	crtsh	Subdomains from certificate-transparency logs
  4	dig	DNS records (A, MX, NS, TXT)
  5	cloud_enum	Public cloud buckets (S3/Azure/GCP)

• osint:domain <domain>

  Maps a domain end to end — who owns it, its subdomains, which hosts are live and what they run, its DNS, and its history.

  whoissubfinderamasscrt.shhttpxwhatwebwafw00fdigtheHarvestercloud_enumweb searchwebfetch

  How it works

  #	Step	What it does
  1	whois	Domain registration record
  2	subfinder	Passive subdomain enumeration
  3	crtsh	Subdomains from certificate-transparency logs
  4	httpx	Live-host probe: title, status, tech
  5	whatweb	Web stack fingerprinting
  6	wafw00f	Detects a web application firewall
  7	dig	DNS records (A, MX, NS, TXT)
  8	theharvester	Emails, subdomains, hosts, employees
  9	cloud_enum	Public cloud buckets (S3/Azure/GCP)

• osint:mentions <email|name|handle|phone>

  Finds the web pages that mention a target — email, name, handle or phone — and pulls the contacts posted alongside it.

  web searchwebfetch

  How it works

  #	Step	What it does
  1	webfetchcustom	Rendered page fetch (headless browser)

• osint:phone <number>

  Profiles a phone number and finds where it appears online.

  phoneinfogaweb searchwebfetch

  How it works

  #	Step	What it does
  1	phoneinfoga	Phone-number footprint
  2	webfetchcustom	Rendered page fetch (headless browser)

• osint:username <handle>

  Investigates one exact username across the web and ties it to a GitHub identity.

  maigretsocial-analyzerGitHubweb searchwebfetch

  How it works

  #	Step	What it does
  1	maigret	Username search across ~3000 sites
  2	social_analyzer	Profile search across ~1000 sites
  3	githubcustom	GitHub account + leaked commit emails

• osint:instagram <handle>

  Deep-dives one Instagram account — its public email and phone, its surface presence, and where the handle appears online.

  maigrettoutatisGitHubweb searchwebfetch

  How it works

  #	Step	What it does
  1	maigret	Username search across ~3000 sites
  2	toutatis	Instagram email / phone deep-dive
  3	githubcustom	GitHub account + leaked commit emails
  4	webfetchcustom	Rendered page fetch (headless browser)

Steps tagged "custom" are my own custom tools, built by me for this platform. The rest are third-party tools.

The tools

Every tool an command can run, with a link and what it does. All of them are pre-installed on your Kali machine.

• maigret — Username enumeration across ~3000 sites, extracting profile data (name, bio, avatar, linked accounts).
• theHarvester — Emails, subdomains, hosts and employee names for a domain, from many public sources.
• holehe — Checks which sites an email address is registered on, without alerting the account.
• mosint — Email OSINT aggregator: validation, IP/domain info and public pastebin dumps (breach/related-email services need API keys).
• phoneinfoga — Phone-number footprint: country, carrier and line type, plus search leads.
• toutatis — Instagram deep-dive: the public email and phone an account displays (needs your Instagram session id).
• social-analyzer — Profile search across ~1000 sites with a No/Maybe/Yes rating — the maigret fallback.
• subfinder — Fast passive subdomain enumeration.
• amass — In-depth passive subdomain and attack-surface mapping.
• httpx — Probes which hosts are live and returns titles, status codes and detected tech.
• whatweb — Fingerprints a website’s technologies (CMS, frameworks, servers).
• wafw00f — Detects whether a site sits behind a WAF and which one.
• cloud_enum — Finds public AWS S3 / Azure blob / GCP buckets tied to a name or domain.
• crt.sh — Certificate-transparency search that reveals subdomains from issued TLS certs.
• gravatar — Maps an email to its public Gravatar profile (name, location, linked accounts).
• GitHub — Backend lookup: an email/username/name → the GitHub account and any leaked commit emails.
• whois — Domain registration record: registrar and creation date where available.
• dig — DNS records for a domain (A, MX, NS, TXT).
• web search — My own SearXNG metasearch (Google/Bing/Brave/DuckDuckGo) via an authenticated in-house proxy — the single search source for every command.
• webfetch — My headless-browser page fetcher: renders JS and clears simple bot protection to read a page as plain text.

Kali machine

Each command needs an active Kali Linux machine — all the tooling (theHarvester, maigret, whois, holehe, and more) is pre-installed on it, so the model can run everything live. Rent one in the Virtual Machines section.

Multiple machines

Have more than one machine? Add --machine <name> (or -m <name>) to the end of any command — e.g. osint:domain example.com --machine kali-osint — to pin every command to that machine. Without it, your active machine is used.

Reports

Every OSINT run saves its full report to a file on your Kali machine (under /root/osint/) and the reply gives you the exact path — download it from the machine card on the home page, or fetch it over SSH with your key.