Metadata-Version: 2.4
Name: klyrek-osint
Version: 0.1.0
Summary: Optional public intelligence source integrations for the Klyrek ecosystem
Author: Klyrek Contributors
License: MIT
Keywords: appsec,osint,pentesting,reconnaissance,security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Information Technology
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Topic :: Security
Requires-Python: >=3.10
Requires-Dist: httpx>=0.27
Requires-Dist: klyrek-core
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pytest>=8.0; extra == 'dev'
Requires-Dist: ruff>=0.6; extra == 'dev'
Description-Content-Type: text/markdown

# klyrek-osint

Optional integrations with **free, keyless** public intelligence sources. Deliberately not
wired into `klyrek crawl`'s default pipeline — querying third-party services about a target
(even passively) is a separate decision from crawling the target directly, so this stays an
opt-in library rather than something that fires on every scan.

- **`certificate_transparency`** — `query_crtsh(domain)` queries [crt.sh](https://crt.sh) for
  every certificate ever issued for `*.domain`, returning the unique hostnames found. This is
  passive: it queries a public CT log, not the target's own infrastructure, so it doesn't go
  through `klyrek-http`'s `AuthorizationScope` the way a direct request to the target would.
  Often finds far more subdomains than DNS brute-forcing (`klyrek-assets`), since it covers any
  subdomain that ever had a certificate issued, not just a wordlist guess.
- **`whois`** — `whois_lookup(domain)` is a minimal WHOIS client using the standard two-step
  IANA-referral pattern over a raw socket (no `python-whois` dependency): ask
  `whois.iana.org` which registrar server owns the TLD, then query that server directly.
- **`cve_lookup`** — `search_cves(keyword)` queries the public [NVD](https://nvd.nist.gov/) REST
  API (no key required, just rate-limited) for known CVEs matching a technology name/version —
  e.g. feed it something `klyrek-tech` fingerprinted. `cve_to_finding(record)` converts a result
  into a `klyrek_core.models.Finding` so it composes with the rest of the ecosystem.

```python
from klyrek_osint.certificate_transparency import query_crtsh
from klyrek_osint.cve_lookup import cve_to_finding, search_cves
from klyrek_osint.whois import whois_lookup

subdomains = query_crtsh("target.com")
record = whois_lookup("target.com")
findings = [cve_to_finding(c) for c in search_cves("nginx 1.18.0")]
```
