|
1 | 1 | 
|
2 | 2 | =======
|
| 3 | +[](https://forthebadge.com) |
| 4 | + |
3 | 5 | [](https://github.com/netevert/delator/releases)
|
4 | 6 | []()
|
5 | 7 | [](https://github.com/netevert/delator/commit/master)
|
| 8 | +[](http://makeapullrequest.com) |
6 | 9 |
|
7 |
| -POCKINT (a.k.a. Pocket Intelligence) is being developed to be the OSINT Swiss Army Knife for DFIR professionals. Designed to be a lightweight and portable GUI program (to be carried within USBs or investigation VMs), it will provide users with essential OSINT capabilities: an input box will accept typical indicators (URL, IP, MD5) and POCKINT will perform basic OSINT data mining tasks. |
| 10 | +POCKINT (a.k.a. Pocket Intelligence) is the OSINT swiss army knife for DFIR professionals and analysts. Designed to be a lightweight and portable GUI program (to be carried within USBs or investigation VMs), it provides users with essential OSINT capabilities in a compact form factor: POCKINTs input box accepts typical indicators (URL, IP, MD5) and gives users the ability to perform basic OSINT data mining tasks in an iterable manner. |
8 | 11 |
|
9 | 12 | 
|
10 | 13 |
|
11 |
| -POCKINT is scheduled for beta release by the end of May 2019. It will initially be available only for Windows, though versions will also be released for Linux and Mac once a stable v.1 is built. |
| 14 | +** **Thank you for your interest in POCKINT! Please note that POCKINT is currently in BETA. The software is provided for interested users to test the core functionality and features. I am actively looking for feedback and trying to determine potential interest in the tool. If POCKINT is of interest to you please make sure to star the repo. If you'd like to report bugs or would like to request a feature please do so through the [issues page](https://github.com/netevert/pockint/issues) or feel free to write to me on twitter [@netevert](https://twitter.com/netevert).** ** |
| 15 | + |
| 16 | +POCKINT is scheduled for v.1.0.0 release by the end of June 2019 for both Windows and Linux platforms. |
| 17 | + |
| 18 | +## Installation |
| 19 | + |
| 20 | +You can grab a testing copy from the [releases page](https://github.com/netevert/pockint/releases). POCKINT is provided as a single executable that can be stored anywhere on computers. Throughout the beta phase POCKINT will be available for Windows only. |
| 21 | + |
| 22 | +## Features |
| 23 | + |
| 24 | +Why use it? POCKINT is designed to be simple, portable and powerful. |
| 25 | + |
| 26 | +**Simple**: There's a plethora of awesome OSINT tools out there. Trouble is they either require analysts to be reasonably comfortable with the command line (think [pOSINT](pOSINThttps://github.com/ecstatic-nobel/pOSINT)) or give you way too many features (think [Maltego](https://www.paterva.com/web7/)). POCKINT focuses on simplicity: INPUT > RUN TRANSFORM > OUTPUT ... rinse and repeat. It's the ideal tool to get results quickly and easily through a simple interface. |
| 27 | + |
| 28 | +**Portable**: Most tools either require installation, a license or configuration. POCKINT is ready to go whenever and wherever. Put it in your jump kit USBs, investigation VMs or laptop and it will just run. Nobody needs graphs on an incident response :) |
| 29 | + |
| 30 | +**Powerful**: POCKINT combines cheap OSINT sources (whois/DNS) with the power of specialised [APIs](https://www.theguardian.com/media/pda/2007/dec/14/thenutshellabeginnersguide). From the get go you can use a suite of in-built transforms. Add in a couple of API keys and you can unlock even more specialised data mining capabilities. |
| 31 | + |
| 32 | +The beta version is capable of running the following data mining tasks: |
| 33 | + |
| 34 | +<details><summary>Domains</summary> |
| 35 | +<p> |
| 36 | + |
| 37 | +* dns: ip lookup |
| 38 | +* dns: mx lookup |
| 39 | +* dns: txt lookup |
| 40 | +* dns: ns lookup |
| 41 | +* virustotal: downloaded samples |
| 42 | +* virustotal: detected urls |
| 43 | +* virustotal: subdomains |
| 44 | + |
| 45 | +</p> |
| 46 | +</details> |
| 47 | +<details><summary>IP Adresses</summary> |
| 48 | +<p> |
| 49 | + |
| 50 | +* dns: reverse lookup |
| 51 | +* shodan: ports |
| 52 | +* shodan: geolocate |
| 53 | +* shodan: coordinates |
| 54 | +* shodan: cves |
| 55 | +* shodan: isp |
| 56 | +* shodan: city |
| 57 | +* shodan: asn |
| 58 | +* virustotal: network report |
| 59 | +* virustotal: communicating samples |
| 60 | +* virustotal: downloaded samples |
| 61 | +* virustotal: detected urls |
| 62 | + |
| 63 | +</p> |
| 64 | +</details> |
| 65 | +<details><summary>Urls</summary> |
| 66 | +<p> |
| 67 | + |
| 68 | +* dns: extract hostname |
| 69 | +* virustotal: malicious check |
| 70 | +* virustotal: reported detections |
| 71 | + |
| 72 | +</p> |
| 73 | +</details> |
| 74 | +<details><summary>Hashes</summary> |
| 75 | +<p> |
| 76 | + |
| 77 | +* virustotal: malicious check |
| 78 | +* virustotal: malware type |
| 79 | + |
| 80 | +</p> |
| 81 | +</details> |
| 82 | +<details><summary>Emails</summary> |
| 83 | +<p> |
| 84 | + |
| 85 | +* extract domain |
| 86 | + |
| 87 | +</p> |
| 88 | +</details> |
| 89 | + |
| 90 | +More API and input integrations are planned for the future. Consult the [roadmap](https://github.com/netevert/pockint/milestones) to check out what's brewing or [propose](https://github.com/netevert/pockint/issues) your own favourite API/input. |
| 91 | + |
| 92 | +## Credits |
| 93 | + |
| 94 | +Credit goes to the following people for their contributions to the project, either as providers of early feedback/ideas or for their awesome help in spreading the word: |
| 95 | + |
| 96 | +* [Olaf Hartong](https://twitter.com/olafhartong) |
| 97 | +* [Uriel](https://github.com/0x557269656C) |
| 98 | +* [Jake Creps](https://twitter.com/jakecreps) |
| 99 | +* [Simon Biles](https://twitter.com/si_biles) |
0 commit comments