OSINT / Threat Intel CLI tool.
As a pre-requesite for Harpoon, you need to install lxml requirements, on Debian/Ubuntu : sudo apt-get install libxml2-dev libxslt-dev python-dev.
You need to have geoipupdate installed and correctly configured to use geolocation correctly (make sure you to have GeoLite2-Country GeoLite2-City GeoLite2-ASN as EditionIDs).
If you want to use the screenshot plugin, you need phantomjs and npm installed:
npm install -g phantomjs
You can simply install the package from pypi with pip install harpoon
If the above install instructions didn't work, you can build the tool from source by executing the following commands in the terminal (this assumes you are using virtualenvs):
git clone https://github.com/Te-k/harpoon.git
cd harpoon
pip3 install .
You may want to install harpoontools to have additional commands using harpoon features.
To configure harpoon, run harpoon config and fill in the needed API keys.
Then run harpoon config -u to download needed files. Check what plugins are configured with harpoon config -c.
After configuration the following plugins are available within the harpoon command:
asn Gather information on an ASN
binaryedge Request BinaryEdge API
bitly Request bit.ly information through the API
cache Requests webpage cache from different sources
censys Request information from Censys database (https://censys.io/)
certspotter Get certificates from https://sslmate.com/certspotter
circl Request the CIRCL passive DNS database
config Configure Harpoon
crtsh Search in https://crt.sh/ (Certificate Transparency database)
cybercure Check if intelligence on an IP exists in cybercure.ai
dns Map DNS information for a domain or an IP
dnsdb Requests Farsight DNSDB
fullcontact Requests Full Contact API (https://www.fullcontact.com/)
github Request Github information through the API
googl Requests Google url shortener API
greynoise Request Grey Noise API
help Give help on an Harpoon command
hibp Request Have I Been Pwned API (https://haveibeenpwned.com/)
hunter Request hunter.io information through the API
hybrid Requests Hybrid Analysis platform
ip Gather information on an IP address
ipinfo Request ipinfo.io information
malshare Requests MalShare database
misp Get information from a MISP server through the API
numverify Query phone number information from NumVerify
opencage Forward/Reverse geocoding using OpenCage Geocoder API
otx Requests information from AlienVault OTX
permacc Request Perma.cc information through the API
pgp Search for information in PGP key servers
pt Requests Passive Total database
quad9 Check if a domain is blocked by Quad9
robtex Search in Robtex API (https://www.robtex.com/api/)
safebrowsing Check if the given domain is in Google safe Browsing list
save Save a webpage in cache platforms
screenshot Takes a screenshot of a webpage
securitytrails Requests SecurityTrails database
shodan Requests Shodan API
spyonweb Search in SpyOnWeb through the API
telegram Request information from Telegram through the API
threatgrid Request Threat Grid API
threatminer Requests TreatMiner database https://www.threatminer.org/
tor Check if an IP is a Tor exit node listed in the public list
totalhash Request Total Hash API
twitter Requests Twitter API
urlscan Search and submit urls to urlscan.io
vt Request Virus Total API
You can get information on each command with harpoon help COMMAND
- AlienVault OTX
- BinaryEdge
- bit.ly
- Censys
- CertSpotter : paid plans provide search in expired certificates (little interests imho, just use crtsh or censys). You don't need an account for actual certificates
- CIRCL Passive DNS
- Farsight Dnsdb
- FullContact
- Have I Been Pwned
- Hunter
- Hybrid Analysis
- ipinfo.io
- MalShare
- NumVerify
- OpenCage
- PassiveTotal
- Permacc
- Security Trails
- Shodan
- SpyOnWeb
- Telegram : Create an application
- Total Hash
- Virus Total : for public, create an account and get the API key in the Settings page
This code is released under GPLv3 license.