Awesome Osint Operator

Awesome OSINT Operator

Turn a giant tool list into a disciplined investigation workflow. The catalog is a lead generator, not evidence. A tool result is never a finding until it is independently verified and cited.

Non-negotiable operating rules

1. Scope first. Record the target, legitimate purpose, jurisdiction, time range, allowed sources, and prohibited actions.
2. Use public and lawfully accessible sources only. Do not bypass authentication, paywalls, rate limits, robots controls, or technical access controls. A CAPTCHA is an access barrier, not an automatic mission stop: do not automate its circumvention. First try lawful public alternatives; when ordinary user verification is available, pause and request a human checkpoint so the operator can complete the challenge manually in the normal browser, then resume. Never extract, export, replay, or transfer CAPTCHA tokens, session cookies, or authentication material.
3. Minimize personal data. Purpose-bound profiling of private individuals is permitted when it is necessary to a legitimate investigation, proportionate to the objective, and limited to public or authorized sources. Avoid unnecessary or invasive profiling, sensitive-trait inference, minors, home addresses, family mapping, real-time location, and unrelated personal details. A narrower exception exists only for adults who pass the active official wanted/fugitive-person gate in workflows/wanted-person-location-intelligence.md.
4. Never obtain or expose credentials. Breach-related tools may be used only for defensive exposure checks on assets the user owns or is authorized to assess. Report exposure status and remediation, never passwords, tokens, raw dumps, or stealer-log contents.
5. No doxxing, stalking, harassment, or biometric identification. Reverse-image provenance and scene verification are acceptable; identifying a private person by face is not. Bounded public-source location inference is allowed only under the verified official wanted/fugitive-person workflow and never extends to continuous live surveillance.
6. Threat intelligence stays defensive. Prefer hashes, IOCs, reports, sandbox summaries, and vendor analysis. Do not execute malware or download samples unless the user has explicit authorization and a dedicated safe environment.
7. Verify freshness. Tools and facts change. Check current availability, terms, and dates before relying on a catalog entry.
8. Cite every material claim. Preserve source URL, title, publisher, publication date, access time, and a short supporting excerpt or note.
9. Separate fact, inference, hypothesis, and unknown. State confidence, contradictions, and what remains untested explicitly.
10. Do not dump hundreds of links. Select the smallest useful set—normally 3–7 tools—explain why each is chosen, and include a fallback.
11. For images and video, inventory before searching. Sweep the entire frame, record alternate readings, keep multiple candidates alive, and require independent clue families plus geometric verification before a precise location answer.
12. Do not finalize while material first-party evidence remains unprocessed. Original files, explicit source hints, embedded resources, metadata, source code, alternate views, and relevant low-risk transformations must be resolved or deliberately ruled out before a lead becomes submission-safe.
13. A rejected answer is evidence. Do not keep mutating wording around the same unsupported hypothesis. Roll back to the last verified checkpoint, mark the failed hypothesis, reopen unresolved evidence, change one assumption at a time, and continue the loop.

Read references/safety-policy.md before any people, username, email, phone, breach, dark-web, threat-actor, or official wanted/fugitive task. Read references/hypothesis-convergence.md before any multi-stage investigation, puzzle-like artifact chain, or task where a plausible early answer could be overturned by later evidence. At a consequential branch decision or strategic stall, read references/adaptive-investigation-strategy.md. Use it to choose the next evidence-changing action; it adds no collection permissions and does not replace the convergence gate. For an adult who is currently named in an active official wanted/fugitive notice, verify that status and identity first, then read workflows/wanted-person-location-intelligence.md before performing any person-location inference.

Default workflow

1. Intake and safety gate

Capture:

• Objective and decision the research will support
• Target type and known identifiers
• Time window and geography
• Authorization / public-interest basis
• Sensitive-data risks
• Stop conditions

Classify the request:

• Low risk: company, domain ownership, public filings, official statements, news verification, image provenance, public infrastructure, academic research.
• Guarded: usernames, public-person research, purpose-bound private-person profiling, email/phone exposure checks, breach status, social graphing, threat actors, dark-web references, and verified official wanted/fugitive-person location intelligence.
• Disallowed: credentials, doxxing, stalking, covert tracking outside the official wanted-person exception, private-account access, deanonymization for harassment, abusive or invasive dossier building, targeted surveillance of vulnerable people, continuous live person tracking, or illegal access.

For guarded work, narrow scope, prefer first-party or official sources, and redact unnecessary PII. For wanted/fugitive cases, do not infer location until the dedicated activation gate has passed.

2. Build a collection plan

Choose the matching workflow:

• workflows/domain-infrastructure.md
• workflows/company-org.md
• workflows/username-social.md
• workflows/people-public-interest.md
• workflows/wanted-person-location-intelligence.md
• workflows/email-phone-defensive.md
• workflows/image-video-geolocation.md
• workflows/news-fact-check.md
• workflows/threat-intelligence.md
• workflows/monitoring.md

Route directly to workflows/wanted-person-location-intelligence.md only when all activation conditions are satisfied: active official wanted/fugitive status, strong identity match, adult target, lawful public-safety purpose, and public/lawfully supplied evidence. Otherwise remain in workflows/people-public-interest.md and do not infer current location.

Start from hypotheses and questions, not tools. Define what evidence would confirm or falsify each hypothesis.

Create two explicit queues before deep searching:

• Primary-evidence queue: original files, direct URLs, embedded assets, metadata, source code, archives, attachments, alternate representations, and source-provided hints that have not yet been tested.
• Hypothesis ledger: each candidate explanation with its supporting evidence, contradictions, falsifier, confidence, and status (open, leading, contradicted, verified).

For image/video tasks, first read references/visual-clue-taxonomy.md and create a clue inventory from templates/visual-clue-inventory.csv. Do not let the first readable sign, plaque, face, logo, QR payload, or reverse-image hit become the answer.

For structured visual carriers such as QR codes, barcodes, steganographic layouts, or deliberately transformed puzzle artifacts, preserve every reproducible decode separately and test source-signaled transformations such as rotation, mirror, inversion, threshold/channel changes, or alternate layers before treating one valid payload as exhaustive.

3. Choose the next action, then its tools

Compare a small set of feasible actions against the current evidence gap. Convert the leading hypothesis's fastest falsifier into an executable source/artifact check before deepening that branch; execute it or explain why a different action has greater expected value. Rank qualitatively by discrimination, source fit, cost, repetition and fidelity after applying scope/access/safety constraints.

Log the expected discriminator, actual result and resulting evidence change. When rephrased queries return the same source lineages without narrowing the question, consider an original artifact, representation/habitat pivot, documented technique transfer, method search, or deterministic/manual fallback. Changing a query or website alone is not progress. No fixed action count or tool order is required. Use templates/strategy-checkpoint.md only when it helps a branch decision.

For historical questions, current representations are discovery leads until the required time is verified. Park unexplained clues with revisit triggers. Task wording, AI output and generatively reconstructed detail are not factual evidence.

The catalog helps implement the selected action; its rankings are not a case plan.

Search locally:

python scripts/search_catalog.py "reverse image metadata geolocation" --top 12
python scripts/search_catalog.py "域名 DNS 证书历史" --top 12
python scripts/select_tools.py --workflow domain --per-stage 2
python scripts/visual_case.py init case/image-001

Defaults exclude restricted entries. Treat catalog cost/auth signals as hints only; verify them on the tool's current official page.

Selection criteria:

• Direct relevance to the question
• Source authority and transparency
• Freshness and geographic coverage
• Privacy and legal fit
• Reproducibility
• Independent-source diversity
• Lowest necessary risk

4. Collect broad-to-narrow

For visual investigations, collect frame-wide clues before web results: full-frame scene model, grid/semantic crops, uncertain transcriptions, clue-family scoring, and at least two competing candidates.

Use this source order unless the workflow says otherwise:

1. Official / first-party sources
2. Primary records and registries
3. Reputable archives and datasets
4. Search engines and discovery tools
5. Secondary reporting and aggregators
6. Community or user-generated sources, clearly labeled

Work the primary-evidence queue before expanding a weak lead into broad web search. A search-engine match must not outrank an unresolved original artifact that could directly answer or falsify the question.

Pivot only on corroborated identifiers. Keep a pivot log so aliases, dates, domains, hashes, and locations do not become mixed across entities.

When a public-source collection route hits a CAPTCHA, classify it as an access barrier. Try lawful alternate public routes first. If the site presents ordinary human verification, pause for an operator checkpoint and resume only after the operator completes the challenge manually. Do not automate CAPTCHA solving or transfer verification/session material between environments.

For official wanted/fugitive-person cases, build a location timeline that separates source time, content time, inferred place, and freshness. Do not turn a historical or reposted clue into a current-location claim.