changedetection.io-osint-processor 0.0.1__py3-none-any.whl

changedetection_io_osint_processor-0.0.1.dist-info/METADATA

@@ -0,0 +1,274 @@
+Metadata-Version: 2.4
+Name: changedetection.io-osint-processor
+Version: 0.0.1
+Summary: OSINT Reconnaissance Processor for changedetection.io with Email Security, DNSSEC, SSH & SMTP
+Home-page: https://github.com/dgtlmoon/changedetection.io
+Author: changedetection.io contributors
+License: AGPL-3.0
+Keywords: osint reconnaissance dns dnssec spf dmarc dkim whois ssl tls ssh smtp port-scan changedetection monitoring email-security
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Information Technology
+Classifier: Topic :: Internet :: WWW/HTTP :: Site Management
+Classifier: Topic :: System :: Monitoring
+Classifier: Topic :: System :: Networking :: Monitoring
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: dnspython>=2.0.0
+Requires-Dist: python-whois>=0.8.0
+Requires-Dist: sslyze>=6.0.0
+Requires-Dist: requests>=2.26.0
+Requires-Dist: mac-vendor-lookup>=0.1.12
+Requires-Dist: cryptography<45,>=43
+Requires-Dist: python-socks[asyncio]>=2.0.0
+Dynamic: author
+Dynamic: classifier
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: keywords
+Dynamic: license
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+# 🔍 OSINT Reconnaissance Changedetection.io Processor Agent
+
+> **Comprehensive network intelligence and security monitoring leveraging changedetection.io**
+
+**Monitor your infrastructure for unexpected changes.** Detect unauthorized modifications to SSL/TLS certificates, DNS records, BGP routing, open ports, WHOIS registration details, HTTP security headers, and TLS cipher configurations. Perfect for security teams, DevOps engineers, SRE teams, and OSINT practitioners who need continuous visibility into their infrastructure's security posture. Get instant notifications when certificates are about to expire, DNS records change, new vulnerabilities appear, or network paths are rerouted—before they become security incidents or outages.
+
+Use the existing text filters built into [changedetection.io](https://github.com/dgtlmoon/changedetection.io) to trim out information you don't need and keep only what's relevant to you. Easily connect change alerts to Discord, Slack, email, and 90+ other notification backends, leveraging the awesomeness of changedetection.io's powerful notification system.
+
+## ✨ Features
+
+**Network Intelligence**
+- DNS Records (A, AAAA, MX, NS, TXT, SOA, CAA)
+- DNSSEC Validation (cryptographic signatures, chain of trust)
+- WHOIS Lookup (registration, nameservers, expiry)
+- BGP/ASN Info (ISP, network ownership)
+- Traceroute (network path analysis)
+- MAC Address (vendor identification via IEEE OUI)
+
+**Email Security**
+- SPF Records (Sender Policy Framework anti-spoofing)
+- DMARC Records (email authentication policy)
+- DKIM Records (email signature verification)
+- Email security posture assessment
+
+**Security Analysis**
+- SSL/TLS Certificates (subject, issuer, validity, SANs)
+- Cipher Suites (SSL 2.0 → TLS 1.3)
+- Vulnerability Scanning (Heartbleed, ROBOT, CCS Injection, CRIME, etc.)
+- HTTP Security Headers (HSTS)
+- SSH Fingerprinting (banner, version, host keys, algorithms)
+- SMTP Security (encryption, authentication methods)
+
+**Application Layer**
+- HTTP Fingerprinting (headers, cookies, redirects, CDN/WAF detection)
+- Port Scanning (common service ports)
+- OS Detection (TTL-based fingerprinting)
+- SSH Server Analysis (port 22)
+- SMTP Server Analysis (ports 25, 587, 465)
+
+**Performance**
+- Parallel Mode (4-5x faster scans)
+- Serial Mode (safer, easier to debug)
+- Configurable modules (enable/disable any scan)
+- Real-time status updates
+
+_Example settings_
+
+<img src="docs/osint-changedetection-settings.png" style="max-width: 500px;" alt="OSINT changedetection.io settings page example" title="OSINT changedetection.io settings page example">
+
+#### Pro-tips:
+- Use the _"Only trigger when unique lines appear in all history"_ text filter setting to limit to new events 
+that has not been seen before (ignores text moving around like IP addresses in a pool).
+
+
+## 📦 Installation
+
+This processor agent is only used with changedetection.io
+
+### `docker-compose.yml` based installations.
+
+Uncomment and/or add this package to the `EXTRA_PACKAGES` var in `docker-compose.yml` of your changedetection.io installation.
+
+```
+  environment:                                                                                                                                                                                                      
+    - EXTRA_PACKAGES=changedetection.io-osint-processor
+```
+
+`EXTRA_PACKAGES` is a space-separated list of extra packages to add at startup time to changedetection.io.
+
+### Standalone pip3 installations.
+
+```bash
+pip3 install changedetection.io-osint
+```
+
+**⚠️ Note:** Requires `cryptography>=43,<45` for sslyze compatibility.
+
+### 🔒 SOCKS5 Proxy Support
+
+The OSINT processor supports **SOCKS5 proxies** for enhanced privacy and anonymity. This is perfect for:
+- 🧅 **Tor onion routing** (`socks5h://127.0.0.1:9050`)
+- 🛡️ **Anonymous reconnaissance** without exposing your IP
+- 🌍 **Geolocation bypass** via SOCKS5 proxy servers
+- 🔐 **Privacy-focused monitoring** of sensitive targets
+
+#### ⚠️ **CRITICAL SECURITY WARNING: DNS Leaks**
+
+**Always use `socks5h://` (not `socks5://`) to prevent DNS leaks!**
+
+- ✅ `socks5h://127.0.0.1:9050` - Remote DNS resolution (secure)
+- ❌ `socks5://127.0.0.1:9050` - Local DNS resolution (**LEAKS YOUR QUERIES**)
+
+The `h` in `socks5h://` forces hostname resolution through the SOCKS5 proxy, preventing your DNS queries from leaking to your local DNS server.
+
+**What we do to prevent leaks:**
+- DNS scans use TCP (port 53) through SOCKS5 - **no local DNS**
+- HTTP scans skip local DNS resolution when proxy is configured
+- SSH/SMTP pass hostnames to proxy - **remote DNS only**
+- If SOCKS5 connection fails, we **block the request** (no fallback to direct connection)
+
+**Without these protections**, your real IP and DNS queries would be exposed even when using a proxy!
+
+**Supported Steps**:
+
+| Step | SOCKS5 Support | Notes |
+|------|----------------|-------|
+| DNS Records | ✅ Supported | Uses DNS-over-TCP (port 53) through SOCKS5 |
+| HTTP Fingerprinting | ✅ Supported | Full proxy support via requests library |
+| SSH Fingerprinting | ✅ Supported | TCP connections proxied via python-socks |
+| SMTP Fingerprinting | ✅ Supported | MX server scans through SOCKS5 proxy |
+| DNSSEC Validation | ⚠️ Partial | DNS-over-TCP possible (not yet implemented) |
+| Email Security (SPF/DMARC/DKIM) | ⚠️ Partial | DNS-over-TCP possible (not yet implemented) |
+| WHOIS Lookup | ⚠️ Partial | TCP port 43 compatible (library limitation) |
+| TLS Analysis | ⚠️ Partial | TCP-based but SSLyze doesn't support SOCKS5 |
+| Port Scanning | ❌ Not supported | Raw socket connections |
+| Traceroute | ❌ Not supported | ICMP/UDP packets incompatible |
+| BGP/ASN Info | ❌ Not supported | API lookups (not yet implemented) |
+| OS Detection | ❌ Not supported | Raw socket fingerprinting |
+| MAC Address Lookup | ❌ Not supported | Layer 2 local network only |
+
+**Note**: When a SOCKS5 proxy is configured, unsupported steps are automatically skipped and listed in the scan output.
+
+**⚠️ Important**: Only SOCKS5 proxies are supported. HTTP/HTTPS proxies will be rejected with an error message.
+
+## 🚀 Quick Start
+<img src="docs/osint-use.png" style="max-width: 500px;">
+
+1. Create a watch with URL: `https://example.com`
+2. Select processor: **OSINT Reconnaissance**
+3. Configure OSINT Settings (optional):
+   - DNS Server: 8.8.8.8 (or 1.1.1.1, 9.9.9.9)
+   - Scan Mode: Serial or Parallel
+   - Enable/Disable modules as needed
+
+## 📊 Sample Output
+
+
+<img src="docs/osint-example-difference.png" style="max-width: 500px;" alt="Difference detected to IP address, routers, DNS etc"  title="Difference detected to IP address, routers, DNS etc">
+
+```
+Target: https://example.com
+Hostname: example.com
+IP Address: 93.184.216.34
+Reverse DNS: example.com.
+
+=== BGP / ASN Information ===
+ASN: 15133
+Organization: Edgecast Inc.
+Country: US
+
+=== DNS Records ===
+A Records: 93.184.216.34
+AAAA Records: 2606:2800:220:1:248:1893:25c8:1946
+NS Records: a.iana-servers.net., b.iana-servers.net.
+
+=== SSL/TLS Analysis (SSLyze) ===
+Certificate: CN=www.example.org
+Issuer: DigiCert TLS RSA SHA256 2020 CA1
+Valid: 2024-01-30 → 2025-03-01
+Status: ✓ Valid
+
+=== TLS Security Vulnerability Report ===
+Status: ✓ All checks passed
+  ✓ Secure: Heartbleed (CVE-2014-0160)
+  ✓ Secure: ROBOT Attack
+  ✓ Secure: OpenSSL CCS Injection
+  ✓ HSTS: 31536000 seconds
+```
+
+## 🎯 Use Cases
+
+**Security Monitoring**
+- Certificate expiry alerts
+- Vulnerability detection (TLS/SSL)
+- DNS hijacking detection
+- TLS configuration monitoring
+
+**Infrastructure Tracking**
+- IP address changes
+- Nameserver updates
+- Network path changes (traceroute)
+- ASN migrations
+
+**Compliance & Audit**
+- TLS standards compliance
+- Security headers monitoring
+- Port exposure tracking
+- Certificate transparency
+
+## ⚙️ Configuration
+
+**Scan Modes**
+- **Serial (Default):** Safer, easier to debug, 30-60s typical
+- **Parallel:** 4-5x faster, higher resource usage, 10-20s typical
+
+**Module Selection**
+- Fast Scan (15-20s): DNS, WHOIS, HTTP, basic TLS
+- Comprehensive Scan (60-90s): All modules + vulnerability + port scanning
+
+**DNS Servers:** 8.8.8.8 (Google), 1.1.1.1 (Cloudflare), 9.9.9.9 (Quad9)
+
+## 🔧 Advanced Features
+
+- **Auto-discovery:** Automatically includes new sslyze vulnerability checks
+- **IP Detection:** Auto-detects IPv4/IPv6, skips DNS when needed
+- **Real-time Status:** Live scan progress updates
+- **Configurable:** Per-module enable/disable controls
+
+## 🐛 Troubleshooting
+
+**Cryptography Conflicts:** `pip install 'cryptography>=43,<45'`
+
+**TLS Scan Failures:** Normal for HTTP-only sites, IPs without TLS, or closed ports
+
+**Slow Scans:** Use Parallel mode, disable Port Scanning or Vulnerability Scanning
+
+## 📄 License
+
+GNU Affero General Public License v3.0 (AGPL-3.0)
+
+This ensures any modifications made to this software when running as a network service must be shared with users.
+
+## 🙏 Credits
+
+Built with: [changedetection.io](https://github.com/dgtlmoon/changedetection.io), [sslyze](https://github.com/nabla-c0d3/sslyze), [dnspython](https://github.com/rthalley/dnspython), [python-whois](https://github.com/richardpenman/pywhois), [mac-vendor-lookup](https://github.com/bauerj/mac_vendor_lookup)
+
+---
+
+<div align="center">
+
+Made with ❤️ for the OSINT community
+
+</div>

changedetection_io_osint_processor-0.0.1.dist-info/RECORD

@@ -0,0 +1,29 @@
+changedetection_io_osint_processor-0.0.1.dist-info/licenses/LICENSE,sha256=hIahDEOTzuHCU5J2nd07LWwkLW7Hko4UFO__ffsvB-8,34523
+changedetectionio_osint/__init__.py,sha256=95GJlGSuqHWBywy6XsW-4OeirRLsUQAWR5LNuz3ZDYA,738
+changedetectionio_osint/forms.py,sha256=rcJY6bg2VvKbpQjXDCPiNDsDSbz_pIUyro3M4egFpjI,10933
+changedetectionio_osint/plugin.py,sha256=zQWpvN_TNovWomRk5jP0P9ceDyMuYJ6s9ncm1jc6b9Y,1121
+changedetectionio_osint/processor.py,sha256=WYpT905U6D7jIZc1kL-ADY8YmXKlymXumSRiHPm1hWs,31752
+changedetectionio_osint/steps/__init__.py,sha256=XGWm1QmuPIUgGhg_OMArihag5_opZ2J2pmzmPO3rMw4,111
+changedetectionio_osint/steps/base.py,sha256=nQe5dab8lgfCI-OdJAg9yrql4b2NG8BOtF-1KhBz4ss,2124
+changedetectionio_osint/steps/bgp.py,sha256=IDAODWtZ_6_4zz_bI_2VbPkwYy_QJVkK4hGF3dqIvyg,2783
+changedetectionio_osint/steps/dns.py,sha256=viyb-zi1vSDrpcaUfU4NXQODt_GKSkvAULDbANhmw5Q,5691
+changedetectionio_osint/steps/dns_scan.py,sha256=bWB0mEIzZpg0H9LSNV1qFonkDm9oiSTLuUqJefbOofg,3319
+changedetectionio_osint/steps/dnssec.py,sha256=RtRPBoiZTGdo9OCd7ieUpMIhnpfEJha6jKdY2uEF1Zs,10786
+changedetectionio_osint/steps/email_security.py,sha256=a4HrHduuG0O1xdFR9bR8zrGO3GAuvhHr0db1hegDcFk,9929
+changedetectionio_osint/steps/http_fingerprint.py,sha256=k94JWpot1afiHnnd0VuDAbT36o6e_s17LWcAyBy1xbI,15732
+changedetectionio_osint/steps/http_scan.py,sha256=hYQA1lntOb8sdjkSuUGIJDxoxn1aaIBvHW7cfOag9wo,924
+changedetectionio_osint/steps/mac_lookup.py,sha256=uwUyfIqagprI1Hgka5eyGxea606RUZsNmGyfqXv1OjI,7642
+changedetectionio_osint/steps/os_detection.py,sha256=xXu3o9HznfJ70yZ_P_MlULtuIH1Cc48x0M374THfYts,7053
+changedetectionio_osint/steps/portscan.py,sha256=wBb87ic-JJv45tYzIvaH-soLhg290IyFPk4kohydWAI,5098
+changedetectionio_osint/steps/registry.py,sha256=cIevKfZq_5gHbMBi28V05U6C-gvJA1WX1dTaly2RgX0,1214
+changedetectionio_osint/steps/smtp_fingerprint.py,sha256=5m3JcVztymUY1OC1orboj1GnaRYiSatPcN0gltqLB7c,22389
+changedetectionio_osint/steps/ssh_fingerprint.py,sha256=Z2IyTn4znujqSeEBM7TVkAgtfBCJ15iF-YkeMd9L6Vg,13867
+changedetectionio_osint/steps/tls_analysis.py,sha256=GQALlU7kxCYuAjwdPGyz9wZUCCu6oiGbgk_T1jWlmzE,14755
+changedetectionio_osint/steps/traceroute.py,sha256=a1g200xnwnk1OsNRjM1FPkuudJyXnCU_HZCXn7zJovM,4209
+changedetectionio_osint/steps/whois_lookup.py,sha256=uHqM1fe1vrjtvXkJrqmpYz1S4R45PQAOi3S_k_sEmyo,5059
+changedetectionio_osint/steps/whois_scan.py,sha256=TptYnuhyBgCuwUZ-MGstxI4rkGsMgwVxINsMQJ6O90o,5237
+changedetection_io_osint_processor-0.0.1.dist-info/METADATA,sha256=FFg1DZDKerv2MYi_62oghF14LQyjEuaJumQ4uD34JWQ,10951
+changedetection_io_osint_processor-0.0.1.dist-info/WHEEL,sha256=wUyA8OaulRlbfwMtmQsvNngGrxQHAvkKcvRmdizlJi0,92
+changedetection_io_osint_processor-0.0.1.dist-info/entry_points.txt,sha256=Y_GpLrgOwz4HfQJxwEO5VmFpgEs0K4r9WrX46Rew194,69
+changedetection_io_osint_processor-0.0.1.dist-info/top_level.txt,sha256=gAdL1GiHis3p-O1HVSWoNezvs7V9F_igFm0ZmtGqieU,24
+changedetection_io_osint_processor-0.0.1.dist-info/RECORD,,

changedetection_io_osint_processor-0.0.1.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (80.10.2)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

changedetection_io_osint_processor-0.0.1.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[changedetectionio]
+osint_processor = changedetectionio_osint.plugin