@lovehlmmm/primekit 1.0.0

package/skills/cti-expert/techniques/fx-email-header-analysis.md

@@ -0,0 +1,91 @@
+# fx-email-header-analysis
+
+## Purpose
+Parse raw email headers to trace the routing path, verify sender authentication, and flag spoofing or manipulation. Scope is headers only — no body content analysis.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /analyze-email |
+| Input | Pasted raw email header block |
+| Output | Routing trace, auth verdict, anomaly list |
+| Confidence | HIGH for server-generated fields; LOW for sender-claimed fields |
+
+## Annotated Header Example
+```
+Received: from mail.attacker.io (HELO legit.bank.com [198.51.100.9])   ← HELO spoofed
+        by mx.victim.com with ESMTPS id x7f;
+        Mon, 15 Jan 2025 09:14:02 +0000
+
+Received: from webmail.attacker.io ([10.0.0.5])                        ← private IP origin
+        by mail.attacker.io with HTTP id y2c;
+        Mon, 15 Jan 2025 09:13:55 +0000
+
+Authentication-Results: mx.victim.com;
+        spf=fail smtp.mailfrom=attacker.io;                             ← SPF failure
+        dkim=none;                                                       ← no signature
+        dmarc=fail header.from=legit.bank.com                          ← DMARC fail
+
+From: "Legit Bank Security" <security@legit.bank.com>                  ← display name lie
+Return-Path: <bounce@attacker.io>                                      ← mismatch
+```
+
+## Methodology
+1. Read `Received` chain **bottom-to-top** — oldest hop first, newest (your server) at top
+2. Extract originating IP from the lowest `Received` line's bracket value
+3. Check HELO name matches the sending IP's reverse DNS — mismatch = suspicious
+4. Parse `Authentication-Results` for SPF, DKIM, DMARC — record each as pass/fail/none
+5. Compare `Return-Path` domain to `From` domain — divergence flags forwarding or spoofing
+6. Calculate per-hop transit time; flag negative deltas or gaps exceeding 24 hours
+7. Geolocate originating IP (ipinfo.io); verify timezone in `Date` header plausibly matches
+8. Check `Message-ID` format matches claimed sending platform (Gmail IDs differ from Outlook)
+
+## Auth Decision Matrix
+| SPF | DKIM | DMARC | Verdict |
+|-----|------|-------|---------|
+| pass | pass | pass | Authenticated |
+| pass | none | pass | Acceptable |
+| fail | pass | pass | Suspicious |
+| fail | fail | fail | Likely spoofed |
+| none | none | none | Unverifiable |
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | MXToolbox Header Analyzer | mxtoolbox.com/EmailHeaders | Paste-and-parse; free |
+| 2 | Google Admin Toolbox | toolbox.googleapps.com/apps/messageheader | Visualizes hop timing |
+| 3 | mailheader.org | mailheader.org | Lightweight alternative |
+| 4 | dig / nslookup | Built-in | Manual SPF/DKIM DNS lookup |
+| 5 | ipinfo.io | ipinfo.io | IP geolocation of originating hop |
+
+## Output Format
+```
+Originating IP: 198.51.100.9 → AS64496 (OVH FR)
+HELO Claim:     legit.bank.com [MISMATCH — no reverse DNS match]
+
+Routing (oldest→newest):
+  09:13:55Z  webmail.attacker.io (10.0.0.5)  → internal submit
+  09:14:02Z  mail.attacker.io                 → +7s normal
+  09:14:08Z  mx.victim.com                    → +6s normal
+
+Auth: SPF=fail | DKIM=none | DMARC=fail
+
+Anomalies:
+  - From domain (legit.bank.com) ≠ Return-Path domain (attacker.io)
+  - No DKIM signature present
+  - HELO name does not resolve to sending IP
+
+Verdict: HIGH CONFIDENCE SPOOFING
+```
+
+## Limitations
+- Early `Received` headers are operator-controlled and can be forged entirely
+- NAT hides true internal origin; private IPs reveal topology but not identity
+- Greylisting causes legitimate delays that mimic suspicious timing patterns
+- Clock skew across mail servers produces false anomalies in timing analysis
+- ARC chains (forwarded mail) add complexity; treat preserved auth results cautiously
+
+## Related Techniques
+- [fx-http-fingerprint.md](fx-http-fingerprint.md) — server-side header analysis
+- [fx-breach-discovery.md](fx-breach-discovery.md) — verify sender address against known exposures
+- [fx-network-mapping.md](fx-network-mapping.md) — map sending infrastructure as network finding

package/skills/cti-expert/techniques/fx-geolocation.md

@@ -0,0 +1,70 @@
+# fx-geolocation
+
+## Purpose
+Convert location artifacts (GPS coordinates, IP addresses, visual cues) into a confidence-tiered geographic finding. Structured from coarse city-level down to building-level resolution.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /geo-locate |
+| Input | GPS coordinates, IP address, or image with location context |
+| Output | Location finding with accuracy tier and verification status |
+| Confidence | HIGH for EXIF GPS; MEDIUM for IP geolocation; VARIABLE for visual inference |
+
+## Accuracy Tiers
+| Tier | Resolution | Source | Typical Accuracy |
+|------|-----------|--------|-----------------|
+| City | ~10 km radius | IP geolocation | 80–90% correct country, 60–70% correct city |
+| District | ~1 km radius | Cell tower / WiFi | Varies by urban density |
+| Street | ~50 m radius | Network-assisted GPS | Common for mobile photos |
+| Building | ~3–10 m radius | Smartphone GPS hardware | Reliable in open sky |
+
+## Methodology
+1. **City tier — IP source:** Extract IP from available artifacts (email headers, access logs); query ipinfo.io or ip-api.com; record country, city, ASN
+2. **Street tier — EXIF GPS:** Run `exiftool -GPSLatitude -GPSLongitude -GPSAltitude -GPSDateStamp` on image; convert DMS to decimal degrees if needed
+3. Convert coordinates: `DD = Degrees + Minutes/60 + Seconds/3600`; apply N/S and E/W sign
+4. Reverse geocode: `curl "https://nominatim.openstreetmap.org/reverse?format=json&lat=LAT&lon=LON&zoom=18"`
+5. **Building tier — verification:** Open coordinates in Google Maps satellite view; confirm visible features match photo content
+6. Cross-check sun position against claimed timestamp using suncalc.org — solar angle inconsistency invalidates claimed time/place
+7. If EXIF absent, apply visual geolocation: identify landmarks, signage language, architectural style, vegetation type
+8. Record accuracy tier, verification method, and any anomalies found
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | exiftool | `apt install libimage-exiftool-perl` | GPS extraction from images |
+| 2 | Nominatim (OSM) | nominatim.openstreetmap.org | Free reverse geocoding |
+| 3 | ipinfo.io | ipinfo.io | IP → city/ASN |
+| 4 | suncalc.org | Browser | Sun position verification |
+| 5 | Google Maps satellite | maps.google.com | Visual building-tier confirmation |
+| 6 | Sentinel Hub | sentinel-hub.com | Historical satellite imagery |
+
+## Output Format
+```
+Subject location finding:
+
+Tier Achieved: Street (±15 m)
+Coordinates:   48.8584°N, 2.2945°E
+Address:       Champ de Mars, 5 Av. Anatole France, Paris, FR
+Source:        EXIF GPSLatitude/GPSLongitude
+Timestamp:     2025-04-12T14:22:00+02:00
+
+Verification:
+  Satellite match: YES — Eiffel Tower base visible
+  Sun angle at 14:22 local: 42° elevation, 218° azimuth
+  Shadow check: CONSISTENT with photo content
+
+Accuracy Tier: Building (landmark confirmed)
+```
+
+## Limitations
+- GPS coordinates are hardware-generated but can be spoofed with SDR tools or software overrides
+- IP geolocation accuracy degrades significantly for mobile carriers and VPN exit nodes
+- Rural reverse geocoding returns approximate addresses; urban addresses are more reliable
+- Visual geolocation depends on distinctive features — featureless environments yield low confidence
+- Historical satellite imagery may not match the date of the subject's visit
+
+## Related Techniques
+- [fx-metadata-parsing.md](fx-metadata-parsing.md) — full EXIF field extraction procedure
+- [fx-image-verification.md](fx-image-verification.md) — shadow/sun cross-validation of claimed location
+- [fx-network-mapping.md](fx-network-mapping.md) — map IP-derived locations to infrastructure topology

package/skills/cti-expert/techniques/fx-http-fingerprint.md

@@ -0,0 +1,91 @@
+# fx-http-fingerprint
+
+## Purpose
+Identify web server software, CDN provider, WAF presence, and security posture from HTTP response headers. Findings reveal infrastructure stack without active exploitation.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /http-fingerprint |
+| Input | Target domain or IP address |
+| Output | Server fingerprint report with WAF detection and security header audit |
+| Confidence | HIGH for direct header values; MEDIUM for inferred stack versions |
+
+## Fingerprint Signal Map
+| Header | What It Reveals | Forgeable |
+|--------|----------------|-----------|
+| `Server` | Web server type and version | Yes |
+| `X-Powered-By` | Backend language/framework | Yes |
+| `Via` | Proxy or CDN hop chain | Partial |
+| `X-Cache` | CDN cache status (HIT/MISS) | Partial |
+| `X-Forwarded-For` | Original client IP through proxy | Yes |
+| `Set-Cookie` name patterns | Application framework (PHPSESSID, JSESSIONID) | Yes |
+| `X-AspNet-Version` | ASP.NET version | Yes |
+| `CF-Ray` | Cloudflare presence | No |
+| `X-Amz-Cf-Id` | AWS CloudFront presence | No |
+| `x-ms-request-id` | Azure presence | No |
+
+## WAF Detection Indicators
+| Vendor | Header Signature |
+|--------|-----------------|
+| Cloudflare | `CF-Ray`, `cf-cache-status` |
+| AWS WAF | `X-Amzn-RequestId` + 403 body |
+| Imperva Incapsula | `X-Iinfo`, `visid_incap_` cookie |
+| Akamai | `X-Check-Cacheable`, `X-Akamai-Request-ID` |
+| F5 BIG-IP | `X-Cnection`, `BIGipServer` cookie |
+| Sucuri | `X-Sucuri-ID`, `x-sucuri-cache` |
+
+## Methodology
+1. Fetch headers with verbose output: `curl -sI -A "Mozilla/5.0" https://target.com`
+2. Record all response headers — note both presence and absence
+3. Check `Server` and `X-Powered-By` for software and version strings
+4. Inspect cookie names in `Set-Cookie` — map to known framework patterns
+5. Cross-reference WAF indicator table above; if WAF present, note vendor
+6. Audit security header presence: `Strict-Transport-Security`, `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`
+7. Probe error responses (non-existent path) — different servers produce distinct 404 formats; WAFs often return 403 with vendor body
+8. Record TTL/cache headers for CDN confirmation; check `Age` and `X-Cache` consistency
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | curl | Built-in | `curl -sI` for header-only sweep |
+| 2 | whatweb | `apt install whatweb` | Fingerprints CMS, server, frameworks |
+| 3 | wafw00f | `pip3 install wafw00f` | Dedicated WAF detection |
+| 4 | httpx | `go install github.com/projectdiscovery/httpx` | Bulk header sweep |
+| 5 | Shodan | shodan.io | Historical banner data without direct contact |
+| 6 | securityheaders.com | Browser | Security header audit with grading |
+
+## Output Format
+```
+Target: https://example.com
+
+Server Stack:
+  Server:        nginx/1.24.0
+  X-Powered-By:  PHP/8.2.1
+  Framework:     Laravel (laravel_session cookie)
+
+CDN / WAF:
+  WAF Detected:  Cloudflare (CF-Ray: 8a3f2b1c4d5e6f70-IAD)
+  CDN:           Cloudflare (cf-cache-status: HIT)
+
+Security Headers:
+  HSTS:          present (max-age=31536000)
+  CSP:           ABSENT
+  X-Frame-Options: present (SAMEORIGIN)
+  X-Content-Type: present
+  Referrer-Policy: ABSENT
+
+Error Page Fingerprint: nginx default 404 (not WAF-intercepted)
+```
+
+## Limitations
+- Headers are operator-configurable; `Server` and `X-Powered-By` are routinely falsified or suppressed
+- WAF detection by headers alone misses transparent in-line WAFs with no header injection
+- CDN presence obscures true origin server location and real IP
+- Version numbers in headers may lag actual patched version
+- Rate limiting or IP blocking may prevent sweep completion on hardened targets
+
+## Related Techniques
+- [fx-email-header-analysis.md](fx-email-header-analysis.md) — email header analysis (different protocol layer)
+- [fx-network-mapping.md](fx-network-mapping.md) — build infrastructure map from fingerprint findings
+- [fx-leak-monitoring.md](fx-leak-monitoring.md) — monitor for version exposure in public commits

package/skills/cti-expert/techniques/fx-image-verification.md

@@ -0,0 +1,87 @@
+# fx-image-verification
+
+## Purpose
+Determine whether an image is authentic, original, or manipulated by running reverse search first (provenance), then EXIF cross-validation, then shadow/sun consistency analysis.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /verify-image |
+| Input | Image file or URL |
+| Output | Authenticity verdict with findings chain |
+| Confidence | HIGH for exact reverse search match or EXIF/sun cross-validation; MEDIUM for visual-only |
+
+## Methodology
+
+### Step 1 — Reverse Search (Provenance First)
+1. Upload full image to Google Images, TinEye, and Yandex Images simultaneously
+2. Record earliest publication date found across all engines — this is the provenance anchor
+3. Note all contexts in which the image appears; flag mismatched captions
+4. If multiple versions exist, crop distinctive background features and re-search to identify original
+5. If no match: image may be original, very recent, or sourced from non-indexed channels
+
+### Step 2 — EXIF Cross-Validation
+6. Run `exiftool -DateTimeOriginal -GPSLatitude -GPSLongitude -Make -Model -Software target.jpg`
+7. Compare `DateTimeOriginal` to earliest reverse search publication date — EXIF should precede publication
+8. Map GPS coordinates (if present) to claimed location; discrepancy = finding
+9. Check `Software` field: presence of Photoshop, GIMP, or Affinity Photo indicates post-processing
+
+### Step 3 — Shadow and Sun Analysis
+10. Identify reference objects with known height (people, vehicles, poles)
+11. Measure shadow azimuth using image editor angle tool
+12. Calculate expected sun azimuth at the claimed location, date, and time using suncalc.org
+13. Compare measured vs expected: >15° divergence warrants flagging
+14. Verify all shadows in-frame share a consistent single vanishing point
+
+## Reverse Search Engine Comparison
+| Engine | Strength | Best Use |
+|--------|---------|---------|
+| TinEye | Oldest-version tracking | Finding original publication date |
+| Google Images | Largest index | Broadest match coverage |
+| Yandex | Face and object recognition | Non-Western sources; faces |
+| Bing Visual | Microsoft ecosystem | Alternative index coverage |
+| Baidu | Chinese-language web | China-region content |
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | TinEye | tineye.com | Best for provenance dating |
+| 2 | Google Images | images.google.com | Widest coverage |
+| 3 | Yandex Images | yandex.com/images | Strong face recognition |
+| 4 | exiftool | `apt install libimage-exiftool-perl` | EXIF extraction |
+| 5 | suncalc.org | Browser | Solar position at claimed time/place |
+| 6 | FotoForensics | fotoforensics.com | ELA (Error Level Analysis) for compression artifacts |
+
+## Output Format
+```
+Image: photo_claim.jpg
+
+Provenance (Reverse Search):
+  Earliest match: 2023-08-14 via news.bbc.co.uk
+  Context on source: Syrian conflict, Idlib, August 2023
+  Claimed context: Ukraine, 2025
+  Verdict: MISATTRIBUTED
+
+EXIF Findings:
+  DateTimeOriginal: 2023:08:14 11:30:00
+  GPS:              ABSENT
+  Software:         None detected
+  Device:           Apple iPhone 13
+
+Shadow Analysis: N/A — overcast conditions in image, no shadows
+
+Final Verdict: NOT AUTHENTIC FOR CLAIMED CONTEXT
+Confidence: HIGH (reverse search date predates claimed event by 18 months)
+```
+
+## Limitations
+- No reverse search engine indexes the full web; absence of match does not confirm authenticity
+- EXIF timestamps and GPS are erasable and forgeable; manipulated metadata passes tool checks
+- Shadow analysis requires clear shadows and known reference dimensions — low-light or indoor images yield no data
+- Expert-level AI compositing leaves no detectable EXIF anomalies
+- Social media platforms strip EXIF on upload — downloaded images often lack GPS data
+
+## Related Techniques
+- [fx-metadata-parsing.md](fx-metadata-parsing.md) — full EXIF field reference and extraction
+- [fx-geolocation.md](fx-geolocation.md) — convert extracted GPS coordinates to location finding
+- [fx-document-forensics.md](fx-document-forensics.md) — verify images embedded within documents

package/skills/cti-expert/techniques/fx-leak-monitoring.md

@@ -0,0 +1,84 @@
+# fx-leak-monitoring
+
+## Purpose
+Establish ongoing visibility into new credential exposures, config leaks, and data dumps targeting a specific subject, domain, or organization. Distinct from point-in-time discovery — this technique is about continuous alerting.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /leak-monitor |
+| Input | Domain, organization name, or email pattern |
+| Output | Alert configuration plan + immediate findings |
+| Confidence | HIGH for confirmed indexed content; LOW for unverified paste snippets |
+
+## Methodology
+1. Run immediate baseline sweep (see [fx-breach-discovery.md](fx-breach-discovery.md) for procedure)
+2. Configure Google Alerts for persistent surface monitoring:
+   - `"domain.com" site:pastebin.com`
+   - `"orgname" "database dump"`
+   - `"orgname" "credentials"`
+3. Set HIBP notification subscription for the subject's email domains
+4. Configure GitHub code search saved alerts: `org:targetorg "password"`, `org:targetorg filename:.env`
+5. Deploy automated scanner on known repositories using TruffleHog (continuous mode) or Gitleaks in CI hooks
+6. Schedule weekly manual paste site sweeps (psbdmp.ws, pastebinsearch.com) for domain terms
+7. On alert trigger: verify finding authenticity (check for test data, placeholders, revoked credentials)
+8. For confirmed findings: log timestamp, source URL, data class, estimated exposure window; escalate per case protocol
+
+## Alert Sources
+| Source | Coverage | Setup Cost | Latency |
+|--------|---------|-----------|---------|
+| HIBP email notifications | Breach databases | Free signup | Hours to days after indexing |
+| Google Alerts | Paste sites, public web | Free | 1–24 hours |
+| GitHub code search notifications | Public repos | Free | Near-real-time |
+| TruffleHog continuous | Git commit streams | Tool install | Per-commit |
+| IntelligenceX alerts | Dark web pastes | Paid | Hours |
+| Shodan Monitor | Internet-exposed services | Paid | Continuous |
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | TruffleHog | `pip3 install trufflehog` | Best for repo scanning; validates secrets as live |
+| 2 | Gitleaks | `brew install gitleaks` | Fast; CI-friendly |
+| 3 | HaveIBeenPwned API | haveibeenpwned.com/API | Programmatic breach lookup |
+| 4 | Google Alerts | alerts.google.com | No install; covers indexed paste sites |
+| 5 | detect-secrets | `pip3 install detect-secrets` | High-entropy detection baseline |
+| 6 | Shodan Monitor | shodan.io/monitor | Covers exposed services, not credential dumps |
+
+## False Positive Triage
+Before escalating any finding, verify:
+- Is the exposed value a placeholder (`your-api-key-here`, `CHANGEME`)?
+- Is the file a test fixture or documentation example?
+- Has the credential already been rotated (test API validity carefully and only with permission)?
+- Is the paste date-stamped well before the subject's known involvement?
+
+If any check passes → log as LOW, monitor for confirmation.
+
+## Output Format
+```
+Monitor Target: acme-corp.com
+
+Alert Configuration:
+  HIBP: active (acme-corp.com domain)
+  Google Alerts: 3 queries active
+  GitHub: org:acmecorp saved search (password, .env, api_key)
+  TruffleHog: scheduled nightly on github.com/acme-corp/*
+
+Current Findings (baseline sweep):
+  Source: pastebin.com/xYz123 (indexed 2025-02-14)
+  Data:   acme-corp.com email list + MD5 hashes (127 records)
+  Status: UNVERIFIED — pending hash sample check
+
+Next Review: 2026-04-07
+```
+
+## Limitations
+- Deleted paste content may not be archived; ephemeral findings require immediate capture
+- GitHub private repositories are not accessible; only public commits are swept
+- Automated scanners produce false positives — human triage required before escalation
+- Dark web sources require paid tooling or direct access
+- Alert latency means exposure may be hours or days old when notification arrives
+
+## Related Techniques
+- [fx-breach-discovery.md](fx-breach-discovery.md) — point-in-time breach sweep (run before monitoring setup)
+- [fx-http-fingerprint.md](fx-http-fingerprint.md) — monitor for exposed version headers as attack surface
+- [fx-network-mapping.md](fx-network-mapping.md) — correlate exposed infrastructure with network topology

package/skills/cti-expert/techniques/fx-metadata-parsing.md

@@ -0,0 +1,96 @@
+# fx-metadata-parsing
+
+## Purpose
+Systematically extract and tabulate embedded metadata from files to surface authorship, device identity, timestamps, and location data without inspecting file content.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /extract-meta |
+| Input | File path (image, PDF, Office doc, archive) |
+| Output | Normalized metadata table with confidence ratings |
+| Confidence | HIGH for hardware-generated fields; MEDIUM for user-set fields |
+
+## Field Reference by Format
+
+### Image (EXIF)
+| Field | Category | Forensic Value | Forgeable |
+|-------|----------|---------------|-----------|
+| GPSLatitude / GPSLongitude | Location | Primary location finding | Difficult |
+| DateTimeOriginal | Time | Capture timestamp anchor | Yes |
+| GPSTimeStamp | Time | UTC atomic clock reading | Difficult |
+| Make / Model | Device | Hardware fingerprint | Yes |
+| Software | Processing | Edit detection | Yes |
+| BodySerialNumber | Device | Device tracking | Yes |
+| OffsetTime | Time | Timezone offset | Yes |
+
+### PDF
+| Field | Category | Forensic Value | Forgeable |
+|-------|----------|---------------|-----------|
+| Author / dc:creator | Identity | Attribution | Yes |
+| CreationDate | Time | Document origin | Yes |
+| ModDate | Time | Edit detection | Yes |
+| Producer | Software | Conversion chain | Yes |
+| Creator (xmp:CreatorTool) | Software | Authoring app | Yes |
+
+### Office (DOCX/XLSX)
+| Field | Source File | Forensic Value |
+|-------|------------|---------------|
+| dc:creator | core.xml | Original author |
+| cp:lastModifiedBy | core.xml | Most recent editor |
+| cp:revision | core.xml | Edit count |
+| dcterms:created | core.xml | Creation timestamp |
+| Template | app.xml | Internal template name |
+| Company | app.xml | Organization affiliation |
+| TotalTime | app.xml | Cumulative edit duration |
+
+## Methodology
+1. Determine file type: `file target` (do not trust extension alone)
+2. Run full extraction: `exiftool -a -u -g1 target > meta.txt`
+3. For PDF additionally: `pdfinfo target.pdf` and `pdfdetach -list target.pdf`
+4. For Office: `unzip -p target.docx docProps/core.xml` and `unzip -p target.docx docProps/app.xml`
+5. Normalize all timestamps to ISO 8601 UTC
+6. Flag inconsistencies: GPS UTC vs local DateTimeOriginal offset mismatch; Creator ≠ LastModifiedBy; CreationDate after ModDate
+7. Cross-reference device serial numbers across multiple files in the same case
+8. Rate each field confidence (HIGH/MEDIUM/LOW) based on forgability and source
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | exiftool | `apt install libimage-exiftool-perl` | Universal; handles all formats |
+| 2 | pdfinfo | `apt install poppler-utils` | PDF-specific; fast |
+| 3 | exiv2 | `apt install exiv2` | Image EXIF alternative |
+| 4 | oletools | `pip3 install oletools` | Legacy binary Office formats |
+| 5 | unzip + xmllint | Built-in | Manual Office XML parse |
+| 6 | mat2 | `apt install mat2` | Shows what metadata is strippable |
+
+## Output Format
+```
+File: report_final.pdf
+
+Field                  Value                           Confidence
+─────────────────────────────────────────────────────────────────
+Author                 j.harris@corp-internal.com      MEDIUM
+Creator Tool           Microsoft Word for Mac 16.89    MEDIUM
+PDF Producer           macOS Quartz PDFContext          HIGH
+CreationDate           2025-10-04T11:32:00-04:00        HIGH
+ModDate                2025-11-18T09:15:00-05:00        HIGH
+Timezone Offset Change -04:00 → -05:00 (DST transition) HIGH
+
+Anomalies:
+  - Author email reveals internal domain (corp-internal.com)
+  - Created on macOS, produced via Quartz (not Adobe)
+  - Timezone shift consistent with US Eastern DST change
+```
+
+## Limitations
+- All metadata fields accept arbitrary strings; values are findings, not facts
+- Stripped files (mat2, Document Inspector) yield empty output — absence is informative
+- Timezone fields absent from many older images; GPS UTC is the reliable anchor
+- Camera serial numbers uniquely identify hardware but require a reference database to attribute
+- Archive timestamps reflect the archiving system's clock, not the original file creation
+
+## Related Techniques
+- [fx-document-forensics.md](fx-document-forensics.md) — hidden content and redaction verification
+- [fx-geolocation.md](fx-geolocation.md) — convert GPS fields into location findings
+- [fx-image-verification.md](fx-image-verification.md) — cross-validate metadata against visual content

package/skills/cti-expert/techniques/fx-network-mapping.md

@@ -0,0 +1,95 @@
+# fx-network-mapping
+
+## Purpose
+Construct a node-edge map of infrastructure or social relationships associated with a subject. Output is graph-ready data suitable for visualization in tools like Gephi or Maltego.
+
+## Quick Reference
+| Item | Detail |
+|------|--------|
+| Command | /map-network |
+| Input | Seed identifier (domain, IP, username, or organization name) |
+| Output | Node list, edge list, adjacency summary, visual-ready export |
+| Confidence | HIGH for directly observed connections; MEDIUM for inferred edges |
+
+## Methodology
+1. **Define the map boundary:** Set seed subject, hop depth (typically 2), and whether mapping infrastructure or social connections
+2. **Infrastructure map path:**
+   - Resolve all A/AAAA, MX, NS records for seed domain
+   - Run ASN lookup for each IP (`whois -h whois.cymru.com " -v IP"`)
+   - Enumerate subdomains via certificate transparency logs (crt.sh)
+   - Map CDN/hosting relationships via reverse IP lookup
+3. **Social map path:**
+   - Collect follower/following lists for subject accounts
+   - Extract co-mentions and replies from public posts
+   - Identify shared group/organization memberships
+4. For each connection found: record source node, target node, edge type, and first/last observed date
+5. Deduplicate nodes (same subject, different handles) using cross-platform username matching
+6. Assign edge weights: direct message (1.0), reply/mention (0.7), retweet (0.5), follow (0.2)
+7. Export in edge-list CSV format; optionally convert to GEXF for Gephi
+
+## Map Structure
+```
+Nodes:  subjects, organizations, IP blocks, domains
+Edges:  follows, mentions, employs, hosts, resolves-to, registered-by
+
+Example edge record:
+  source:     user_A
+  target:     user_B
+  type:       mention
+  weight:     0.7
+  platform:   twitter
+  first_seen: 2024-11-03
+  last_seen:  2025-02-18
+```
+
+## Tools & Fallbacks
+| Priority | Tool | Install | Notes |
+|----------|------|---------|-------|
+| 1 | Maltego CE | maltego.com | Visual graph building; transforms for OSINT |
+| 2 | Gephi | gephi.org | Post-collection visualization; layout algorithms |
+| 3 | crt.sh | crt.sh | Certificate transparency → subdomain nodes |
+| 4 | NetworkX (Python) | `pip3 install networkx` | Scripted graph analysis; centrality metrics |
+| 5 | SpiderFoot | `pip3 install spiderfoot` | Automated OSINT → graph data |
+| 6 | Shodan | shodan.io | Infrastructure node discovery |
+
+## Graph Metrics Reference
+| Metric | Meaning | High Value = |
+|--------|---------|-------------|
+| Degree centrality | Direct connection count | Popular / well-connected node |
+| Betweenness centrality | Bridge paths through node | Information broker, gatekeeper |
+| Closeness centrality | Average hops to all nodes | Rapid information spreader |
+| Clustering coefficient | Neighbor interconnection | Tight-knit local cluster |
+| PageRank | Weighted importance | Authority node |
+
+## Output Format
+```
+Seed: example.com
+
+Infrastructure Nodes (8):
+  93.184.216.34  (A record)      → AS15133 MCI Communications
+  ns1.example.com                → nameserver node
+  crt.sh: 14 subdomains found
+
+Social Nodes (23):
+  @example_official (Twitter, 14K followers)
+  example-corp (LinkedIn, 342 employees)
+
+Top Edges by Weight:
+  @example_official → @partner_org   (mention ×47, weight 0.9)
+  @exec_name        → @example_official (follow + mention ×12)
+
+Betweenness: @exec_name ranks highest — single bridge between
+             customer community and corporate account cluster
+```
+
+## Limitations
+- Private accounts and internal communications produce invisible edges — map is always incomplete
+- Cross-platform identity resolution is heuristic; false merges are possible
+- Large graphs (>10K nodes) require layout algorithm tuning to remain readable
+- Social graph is a time-frozen snapshot; relationships change faster than collection cycles
+- Infrastructure maps reflect DNS TTL state; short TTLs may show stale data
+
+## Related Techniques
+- [fx-social-topology.md](fx-social-topology.md) — deeper graph metrics and community detection
+- [fx-geolocation.md](fx-geolocation.md) — geolocate IP nodes onto physical map
+- [fx-http-fingerprint.md](fx-http-fingerprint.md) — fingerprint infrastructure nodes after mapping