osint-investigation

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

OSINT Investigation — Router

OSINT调查 — 路由工具

The front door for an open-source intelligence investigation. Use it when you have a starting point but aren't sure which workflow to run.

开源情报调查的入口工具。当你有一个调查起点但不确定要运行哪个工作流时，可以使用它。

Core vocabulary

核心术语

Selector — one identifiable data point: a name, username, email, phone, domain, photo, wallet, company, IP.
Pivot — turning one selector into new selectors (email → breach → reused password → forum handle → real name). Investigation is a chain of pivots.

Every workflow below takes starting selectors, pivots to new ones, and hands findings to

osint-report

Selector（选择器） — 一个可识别的数据点：姓名、用户名、邮箱、电话、域名、照片、钱包地址、公司、IP地址。
Pivot（转换） — 将一个选择器转换为新的选择器（例如：邮箱 → 数据泄露记录 → 复用密码 → 论坛账号 → 真实姓名）。调查的本质就是一系列的转换过程。

以下每个工作流都接收初始选择器，转换生成新的选择器，并将调查结果提交给

osint-report

。

Step 1 — Set authorized scope

步骤1 — 设定授权范围

Before anything, confirm the work is lawful and authorized. Read ../../ETHICS.md. Write down: who is the subject, what is the objective, what is in and out of bounds, and what jurisdiction applies. If you cannot state authorization, stop.

Done when scope and objective are written and passive-first is the default.

在开始任何工作之前，确认工作合法且已获得授权。阅读../../ETHICS.md。记录以下内容：调查对象是谁、调查目标是什么、调查的边界范围以及适用的司法管辖区域。如果你无法明确授权依据，请停止调查。

完成标志：已书面记录范围和目标，且默认采用被动式调查优先原则。

Step 2 — Route by starting selector

步骤2 — 根据初始选择器选择路由

Invoke the matching workflow skill (type its name):

You have…	Run
A person's name / real identity	`person-osint`
A company or brand	`company-osint`
A domain, website, or IP	`domain-osint`
A username / handle	`username-osint`
An email address	`email-osint`
A phone number	`phone-osint`
A photo or video to locate/verify	`geoint-photo`
A social media profile	`social-media-osint`

No clear starting selector? Start with whatever is richest (usually email or username) and pivot outward.

调用匹配的工作流技能（输入其名称）：

你拥有的信息…	运行的工作流
个人姓名/真实身份	`person-osint`
公司或品牌	`company-osint`
域名、网站或IP地址	`domain-osint`
用户名/账号昵称	`username-osint`
邮箱地址	`email-osint`
电话号码	`phone-osint`
需定位/验证的照片或视频	`geoint-photo`
社交媒体账号	`social-media-osint`

没有明确的初始选择器？从信息最丰富的内容开始（通常是邮箱或用户名），然后向外扩展转换。

Step 3 — Pivot with knowledge skills

步骤3 — 使用知识技能进行转换

The workflows pull in auto-triggered knowledge skills as needed: reverse-image-search, exif-metadata-analysis, whois-dns-recon, certificate-transparency, wayback-archives, google-dorking, github-git-recon, chronolocation, breach-data-analysis, crypto-blockchain-tracing, shodan-censys-recon, paste-forum-monitoring, media-verification, people-search-engines, corporate-registries, flight-vessel-tracking, sockpuppet-opsec, link-analysis-graphing. Just describe what you're doing and the relevant one loads.

工作流会根据需要自动调用相关知识技能：reverse-image-search、exif-metadata-analysis、whois-dns-recon、certificate-transparency、wayback-archives、google-dorking、github-git-recon、chronolocation、breach-data-analysis、crypto-blockchain-tracing、shodan-censys-recon、paste-forum-monitoring、media-verification、people-search-engines、corporate-registries、flight-vessel-tracking、sockpuppet-opsec、link-analysis-graphing。只需描述你的操作，相关技能就会自动加载。

Step 4 — Report

步骤4 — 生成报告

When enough selectors corroborate the objective, run

osint-report

to compile a sourced, timestamped intelligence product.

Investigation done when the objective question is answered with at least two independent corroborating sources, or you've documented that it can't be.

当有足够的选择器能够佐证调查目标时，运行

osint-report

来编译一份带有来源和时间戳的情报产物。

调查完成标志：调查目标问题已得到至少两个独立来源的佐证回答，或者你已记录无法达成目标的原因。