DEV Community: Saveliy

How to Run a Full OSINT Recon on Any Domain in One Command

Saveliy — Sat, 04 Jul 2026 07:15:21 +0000

If you've ever needed to profile a domain — subdomains, open ports, breached emails, DNS hygiene, TLS posture — you know the pain: a dozen separate tools, a dozen output formats, and a lot of copy-paste.

Here's how to do all of it in one command, fully self-hosted, with no data leaving your machine.

The tool

PRISM is an open-source (MIT) OSINT platform. One target → 25+ modules run in parallel: WHOIS, DNS, certificate-transparency subdomains, Shodan, breach checks, dark-web mirrors, GeoIP, and more. It gives you an entity graph and an OPSEC exposure score at the end.

1. Get it running

Clone the repo and install:

git clone https://github.com/NovaCode37/Prism-platform
cd Prism-platform
pip install -r requirements.txt

Use it straight from the CLI:

python cli.py scan example.com

Or run the web UI in Docker (built from the repo):

docker build -t prism .
docker run -d -p 8080:8080 -e ALLOW_ANON_API=true prism
# open http://localhost:8080

2. Scan a domain

python cli.py scan example.com --type domain

In ~40 seconds you get, for example.com:

Subdomains from certificate transparency logs
Open ports + CVEs (via Shodan, if you add a key)
DNS records and whether SPF/DMARC are missing (spoofing risk)
WHOIS exposure (contact emails, org)
Archived sensitive URLs from the Wayback Machine

3. Read the OPSEC score

Every scan ends with a 0–100 exposure score across four categories — Data Exposure, Identity OPSEC, Infrastructure, Web Security. Lower = more exposed. It's a quick way to triage which targets need attention.

Tip: the score only reflects modules that actually ran — if you skip Shodan/VirusTotal, treat a high score as "less data," not "clean."

4. Export for reporting

python cli.py scan example.com --html -o report.html

HTML/PDF reports, plus CSV/Markdown/JSON, and a graph export to GraphML/GEXF for Gephi or Maltego.

Why self-host it

No third party sees your targets. You bring your own API keys, set your own rate limits, and everything runs on your box. For anyone doing authorized recon, that's the whole point.

Repo: https://github.com/NovaCode37/Prism-platform
Live demo (no signup): https://getprism.su

Built and maintained in the open — issues and PRs welcome.

Self-Hosted OSINT Tools in 2026 — an honest SpiderFoot/Maltego alternatives comparison

Saveliy — Mon, 29 Jun 2026 07:54:41 +0000

Self-Hosted OSINT Tools in 2026: An Honest Comparison

If you do reconnaissance, you've probably bounced between ten browser tabs and a dozen CLI tools. This is an honest look at the main self-hosted, open-source OSINT tools in 2026 — what each is good at, where it falls short, and which fits which workflow.

Disclosure: I built one of the tools below (PRISM), so I'm biased. I've tried to keep the comparison fair — every tool here is genuinely good at something.

What "good" means for an OSINT tool

Coverage - how many sources/targets it handles
Self-hosted & private - your investigation targets don't sit in someone else's logs
Usable - CLI power vs a dashboard you can actually read
Zero-key friendly - how much works before you start paying for API keys

theHarvester

The classic. Pulls emails, subdomains, and hosts for a domain from many passive sources. Fast, scriptable, and a staple of any recon pipeline. CLI-only, single-purpose — it does domain footprinting and nothing else, but it does it well.
Best for: quick domain/email footprinting in a terminal.

Sherlock / Maigret

Username hunters. Sherlock checks a username across hundreds of sites; Maigret pushes that to thousands and scrapes profile data. Indispensable for people-focused OSINT. CLI-first; you'll parse the output yourself.
Best for: finding every account a username owns.

SpiderFoot

The automation powerhouse. Point it at a target and it recursively pulls from a huge set of modules, with a web UI and an entity graph. Deep and powerful - also heavier to run and configure, and the UI feels dated.
Best for: deep, automated attack-surface mapping.

Recon-ng

A full, Metasploit-style recon framework in your terminal. Modular, scriptable, great for repeatable workflows — but it's CLI and has a learning curve.
Best for: power users who want a scriptable recon framework.

Maltego CE

The graph king. Unmatched for visual link analysis via transforms. But it's a commercial desktop app, the community edition is limited, and it's not really self-hosted-open-source in the same sense.
Best for: visual link analysis when you can live with the licensing.

PRISM

The one I built. It takes the breadth of the tools above — domain, IP, email, phone, and username recon across 22+ modules - and puts it in a self-hosted web dashboard with an entity graph, a GeoIP map, an OPSEC exposure score, and HTML/PDF reports. 14 of the 22 modules work with no API keys, and it runs with one docker compose up. It's not as deep as SpiderFoot on pure attack-surface recursion, and it's newer/less battle-tested - but if you want all-target recon in one readable dashboard instead of ten tabs, that's the niche.
Best for: all-in-one recon in a self-hosted dashboard, no CLI required.

Quick comparison

	Targets	Interface	Self-hosted	Zero-key	License
theHarvester	domain	CLI	yes	partial	open source
Sherlock/Maigret	username	CLI	yes	yes	open source
SpiderFoot	many	web (dated)	yes	partial	open source
Recon-ng	many	CLI	yes	partial	open source
Maltego CE	many	desktop	no	no	commercial
PRISM	domain/IP/email/phone/username	web dashboard	yes	14/22 modules	MIT

How to pick

Just a domain, fast? theHarvester.
Chasing a username? Maigret.
Deep automated recon? SpiderFoot.
Scriptable framework? Recon-ng.
Visual link analysis? Maltego.
One readable dashboard for everything, self-hosted? PRISM.

All of these are free to try (Maltego CE aside). Pick the one that matches how you actually work - and for the self-hosted ones, your targets never have to leave your machine.

PRISM is open source (MIT): github.com/NovaCode37/Prism-platform · live demo. For lawful, authorized OSINT only.

I Built an Evil Twin Attack in 15 Minutes — Here's What I Learned About Public Wi-Fi

Saveliy — Thu, 30 Apr 2026 15:29:36 +0000

A full lab reproduction of the Evil Twin attack on isolated Kali Linux + airgeddon, plus a 6-rule defense framework for everyday users. Awarded 3rd place at the Lomonosov Readings 2026 research conference."

TL;DR — I reproduced an end-to-end Evil Twin attack in an air-gapped VirtualBox lab using airgeddon on Kali Linux. From "VM boot" to "captured credentials shown on the attacker's terminal" took about 15 minutes. The attacker doesn't break cryptography — they bypass it by exploiting auto-connect and user trust. Below: the 5-stage attack chain, what actually happens at each layer, and a practical 6-rule defense framework.

This is a write-up of an individual research project I conducted at MAOU Gymnasium №16 (Tyumen, Russia), which was awarded 3rd Place at the Lomonosov Readings 2026 research conference (Informatics category). Full repository, paper, and slides are linked at the bottom.

1. Why Evil Twin still matters in 2026

You walk into a cafe. Your phone shows two networks named CoffeeHouse_Guest. You connect to the one with the stronger signal — because that's what your OS does by default. Within seconds you might be:

Connected to a rogue laptop, not the real router
Browsing through an attacker-controlled DNS and HTTP gateway
One redirect away from a captive portal asking for your "Wi-Fi password" or Google credentials

The attack does not require breaking WPA2. It does not require advanced skills. The barrier is so low that the most useful contribution a researcher can make today isn't a new exploit — it's a clear, reproducible explanation of how trivial the attack already is, and what users can actually do about it.

2. Lab architecture (fully air-gapped)

Ethics first: the entire experiment ran in a VirtualBox Internal Network, with zero connectivity to any physical network. All credentials were synthetic. All hardware was mine.

[Windows host]
    └─ VirtualBox Internal Network  ──►  no external connectivity
          ├── Kali Linux 2024.1   (attacker)
          └── Android VM/device   (victim — manually connected)

Stack:

Kali Linux 2024.1 + USB Wi-Fi adapter capable of monitor/AP mode
airgeddon v11.22 as the orchestration layer
Underneath airgeddon: airodump-ng, aireplay-ng, hostapd, dnsmasq, lighttpd, iptables

If you want to replicate: do it only on hardware you own, in an isolated network. Unauthorized deployment is a criminal offense in most jurisdictions (in Russia, Articles 272–273 of the Criminal Code).

3. The 5-stage attack chain

Recon → Rogue AP → Deauth → Interception → Phishing Portal

Stage 1 — Reconnaissance

Put the wireless interface in monitor mode and dump nearby APs and clients:

airmon-ng start wlan0
airodump-ng wlan0mon

Output gives you BSSID, channel, encryption, and connected client MACs for every AP in range. This is the targeting data for everything that follows.

Stage 2 — Rogue Access Point

hostapd is told to broadcast an SSID identical to the legitimate target — same name, attacker's BSSID, encryption deliberately disabled to look like a "guest" variant:

ssid=Free_Public_Lab
channel=6
hw_mode=g

This is the entire trick. There is no protocol violation. 802.11 simply has no built-in mechanism for a client to tell two APs with the same SSID apart.

Stage 3 — Deauthentication

To force migration from the real AP to the twin, send forged 802.11 deauth frames:

aireplay-ng --deauth 0 -a <real_BSSID> wlan0mon

Most clients will silently reconnect — and because the rogue AP is open and stronger, that's where they land. Auto-connect is what makes this stage devastating.

Stage 4 — Traffic interception

dnsmasq provides DHCP + DNS to the victim, and iptables redirects all HTTP traffic to a local web server:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 80

Now the victim has "internet" — except every DNS query and every cleartext request flows through the attacker.

Stage 5 — Captive portal

lighttpd serves a clone of a familiar login page (router admin, ISP portal, or a generic "Confirm your connection" form). The user submits credentials. They appear immediately in the attacker's terminal.

In my run, the test victim entered test_user / Sup3rSecret! — captured in plaintext within seconds.

I also validated the WPA2 variant: even when the legitimate network has a shared password (PublicPassword123), the attack still works, because the password is shared and any client (including the attacker) can use it to host a convincing twin.

4. Why the usual advice fails

A few lessons that actually mattered after running this end-to-end:

"Just check for HTTPS" is not enough. Captive portals can serve valid Let's Encrypt certs for attacker-controlled domains. Your browser's padlock confirms the connection is encrypted to the attacker.
"Use the password-protected network" is not enough. WPA2-PSK protects only against outsiders who don't know the key. In a public cafe, the key is on a chalkboard.
"I'll just notice" is not enough. Modern OSes hide BSSIDs and silently roam between APs with the same SSID. The attack is invisible at the UI layer.

The attack doesn't break cryptography. It bypasses it by exploiting an architectural assumption baked into 802.11 itself: that SSIDs are trustworthy identifiers.

5. The 6-Rule Defense Framework

This is the practical output of the project — a checklist designed for non-technical users.

#	Rule	Why it works
1	Use a VPN (WireGuard / OpenVPN, no-logs provider)	Encrypts the entire tunnel before it touches the rogue AP. The attacker sees opaque traffic to the VPN server.
2	Disable auto-connect, delete saved public networks	Removes the silent reconnection that makes deauth effective.
3	No sensitive actions on public Wi-Fi without VPN	Use 4G/5G for banking, email, work logins. Cellular has built-in link-layer encryption.
4	Enable 2FA everywhere	Captured passwords become useless without the second factor.
5	Technical verification — confirm SSID with staff, watch for duplicate BSSIDs (Wi-Fi Analyzer)	Catches the most obvious twin deployments.
6	Keep OS and browser updated	Closes vulnerabilities a MitM can exploit even inside a session.

Comparative effectiveness (from the paper):

Method	Protection	Speed	Accessibility
VPN (WireGuard / OpenVPN)	★★★★★	★★★★☆	★★★★☆
Personal hotspot (4G/5G)	★★★★★	★★★★★	★★★☆☆
Tor Browser	★★★★☆	★★☆☆☆	★★★☆☆
HTTPS only	★★☆☆☆	★★★★★	★★★★★
Auto-connect disabled	★★★☆☆	★★★★★	★★★★★

6. What I took away from the project

Three things stuck with me after the lab work:

The interesting layer is human, not technical. Every interesting failure mode I observed was a UX decision (auto-connect, hidden BSSID, identical SSID rendering) rather than a cryptographic weakness.
Live demonstrations change behavior more than warnings. Showing classmates their own captured test credentials on a screen produced a sharper reaction than any infographic. That's why the deliverable is education, not tooling.
Reproducibility is half the value. A one-off attack proves nothing. A documented, isolated, repeatable lab — with the exact tool versions and a step-by-step chain — is what makes the result useful to someone else.

7. Repository

Repo: https://github.com/NovaCode37/eviltwin
Full paper (RU, ~21 pages): materials/ru/
English executive summary: docs/executive-summary.md
Diagrams (Mermaid): diagrams/
Award: 3rd Place — Lomonosov Readings 2026, MAOU Gymnasium №16, Tyumen

If you build a similar lab or want to discuss any stage of the chain in more depth, I'd be glad to compare notes in the comments.

Disclaimer: All experiments were conducted on the researcher's own equipment, in a fully isolated virtual environment, using synthetic test credentials. This article is for educational and defensive purposes only.

How I built a self-hosted alternative to Maltego and SpiderFoot (with AI analysis)

Saveliy — Wed, 08 Apr 2026 12:31:24 +0000

A few months ago, I started building PRISM — a self-hosted OSINT platform designed to replace the patchwork of CLI tools I was using for passive reconnaissance. What started as a weekend project grew into a full-stack application featuring 22+ modules, an AI analysis layer, and a real-time dashboard.

The Problem

If you have ever tried to investigate a domain or check what is publicly exposed about an email address, you know the friction: run whois, then dig, then check Shodan, then VirusTotal, then search usernames manually across sites, and finally paste everything into a document. It takes too much time, and it is easy to miss critical data.

I wanted a single tool that handles all of these checks in parallel and presents the results in a unified dashboard.

What PRISM Does

You enter a target — domain, IP, email, phone number, or username — and PRISM runs 22+ passive recon modules simultaneously:

Infrastructure & Threat Intel

WHOIS, DNS (A/MX/NS/TXT/CNAME/SOA), certificate transparency via crt.sh
Shodan (open ports, services, CVEs), VirusTotal, AbuseIPDB
Censys, and Wayback Machine

Leaks & Dark Web

Breach/credential leak lookup
Email reputation (MX, SPF, DKIM, DMARC, disposable checks)
SMTP mailbox verification
Dark web .onion mirror checks via Ahmia and DarkSearch

People & Usernames

Blackbird (async username search across 50+ platforms)
Maigret (deep search across 3,000+ sites)
Telegram user lookup
Phone HLR validation

File Analysis

EXIF, GPS coordinates, and PDF/DOCX metadata extraction

Note: 14 out of 22 modules work with zero API keys. The remaining modules utilize free-tier keys (Shodan, VirusTotal, Censys, etc.).

Architecture & Stack

User → Next.js 14 Dashboard → FastAPI Backend → 22+ OSINT Modules → External APIs
                                    ↓
                              Scan Orchestrator (asyncio)
                                    ↓
                    WebSocket events → real-time progress in UI

Backend: Python 3.10+, FastAPI, asyncio, WebSockets, Pydantic, slowapi
Frontend: Next.js 14 (App Router), React, TypeScript, Tailwind CSS, Leaflet

The backend runs each module as an async task. As modules complete, WebSocket events stream directly to the frontend, updating the per-module status and progress bar in real time. Results are cached per module with a 24-hour TTL.

AI Analysis & OPSEC Scoring

After all modules finish, PRISM aggregates the results and sends them to an LLM via the free tiers of OpenRouter (Nvidia Nemotron) or Groq (Llama-3). The AI generates:

An executive summary highlighting the most critical findings
A risk assessment with prioritized action items
An interactive chat interface for follow-up questions about the scan data

The AI consistently catches cross-module patterns that are hard to spot manually — such as correlating a leaked credential from one database with an exposed admin panel found in Wayback URLs.

Additionally, the system computes a 0–100 OPSEC Score across four categories: data exposure, identity footprint, infrastructure vulnerabilities, and web security hygiene.

Security & What's New in v2.2

The platform has been hardened with a strong focus on security and production readiness:

Hardened Auth — API keys are accepted strictly via headers (X-API-Key / Bearer). Query-string tokens are rejected, and strict CORS is enabled by default
Webhook Callbacks — Complete scans trigger HMAC-signed payloads (X-Prism-Secret). SSRF protection blocks private, loopback, and link-local IP addresses
Mapping UI — The legacy single-iframe GeoIP embed has been replaced with a native, multi-marker Leaflet map
Localization — HTML and PDF report exports now fully render in English, Russian, and German

Quick Start

git clone https://github.com/NovaCode37/Prism-platform.git
cd Prism-platform
cp .env.example .env
docker compose up --build

Open http://localhost:3000 in your browser to run your first scan.

GitHub: https://github.com/NovaCode37/Prism-platform
License: MIT

Looking for Contributors

PRISM is fully open source. If you are looking to build up your resume or practice Python, TypeScript, or Docker, we have several open issues tagged as good first issue:

Add French or Spanish locale support (translating a single JSON file)
Add a Docker HEALTHCHECK instruction
Implement keyboard shortcuts for navigating result tabs

Check out the GitHub issues if you want to contribute! I would love to hear your feedback: what modules or open data sources should we add next?