Omen-Osint

KO | EN

gitlite — search

#vue #windows #golang #shell #php #computer-vision #swift #list #svg #command-line

(★ 9)

A local-first personal exposure and network security console with real public-web OSINT and defensive security tools.

File Explorer

ZIP Download

- - node-ci.yml
- release.yml
- globals.css
- icon.svg
- layout.tsx
- page.tsx
- - omen-brand-identity-board.png
- - dashboard.png
  - social-scan.png
  - web-search.png
- app-shell.tsx
- dashboard-home.tsx
- hero-console.tsx
- logs-page.tsx
- omen-header.tsx
- omen-logo.tsx
- omen-sidebar.tsx
- omen-ui.tsx
- omen-wordmark.tsx
- quick-access.tsx
- quick-search.tsx
- recent-activity.tsx
- search-bar.tsx
- settings-page.tsx
- system-status.tsx
- tool-page.tsx
- - net.ts
- cn.ts
- omen.ts
- services.ts
- use-omen-log.ts
.env.example
.gitignore
CONTRIBUTING.md
index.html
LICENSE
next.config.mjs
package-lock.json
package.json
postcss.config.mjs
README.md
SECURITY.md
server.js
tsconfig.json
ui-fixes.css
ui.css
ui.js

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

### Personal Exposure & Network Security Console

[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://raw.githubusercontent.com/amoghbalapurepy-cmd/Omen-Osint/main/LICENSE)
[![Node.js CI](https://github.com/amoghbalapurepy-cmd/Omen-Osint/actions/workflows/node-ci.yml/badge.svg)](https://github.com/amoghbalapurepy-cmd/Omen-Osint/actions/workflows/node-ci.yml)

**OMEN** is a local-first, browser-based security and OSINT console designed to help users investigate **publicly available information** and perform defensive security checks from a single interface.

It combines live public-web search, public username verification, network diagnostics, and several defensive security utilities in one lightweight Node.js application.

> **Evidence first. No fabricated profiles. No private-account access. No identity guessing.**

---

## Screenshots

| Dashboard | Web Search |
|---|---|
| ![Dashboard](https://raw.githubusercontent.com/amoghbalapurepy-cmd/Omen-Osint/main/assets/screenshots/dashboard.png) | ![Web Search](https://raw.githubusercontent.com/amoghbalapurepy-cmd/Omen-Osint/main/assets/screenshots/web-search.png) |

| Social Scan |
|---|
| ![Social Scan](https://raw.githubusercontent.com/amoghbalapurepy-cmd/Omen-Osint/main/assets/screenshots/social-scan.png) |

---

## Overview

OMEN was built around a simple idea:

**If information is publicly exposed, make it easier to find, inspect, and understand — without pretending that search results prove more than they actually do.**

The project currently provides two major investigation paths:

* **Public Web OSINT** — search indexed public pages for names, phrases, usernames, handles, keywords, and other identifiers.
* **Public Profile Verification** — check selected public platform endpoints for username presence.

It also includes defensive utilities for areas such as network connectivity, DNS/email configuration, URL safety, TLS/SSL information, and password exposure checks.

---

## Features

### 🔎 Public Web OSINT

OMEN can send live searches to Tavily and stream the returned results directly into the console.

The search system:

* Accepts names, usernames, handles, phrases, and keywords
* Generates multiple search variants
* Performs real provider-backed searches
* Returns real indexed URLs
* Displays titles and snippets
* Removes duplicate URLs
* Streams results as they arrive
* Shows the number of results discovered

Example inputs:

```text
plague.programmer
Example name
"example phrase"
example_username
```

OMEN does **not** generate fake profile URLs or fabricate search results.

---

### 👤 Public Profile Verification

OMEN can check selected public endpoints for username presence across:

* GitHub
* GitLab
* Bluesky
* Keybase
* Reddit
* npm maintainer evidence

These checks are intended to answer:

> "Does this public endpoint currently provide evidence for this username?"

They are **not** intended to answer:

> "Does this account definitely belong to this person?"

---

### 🌐 Network & Endpoint Diagnostics

The console also provides defensive network utilities, including:

* Endpoint reachability
* Latency checks
* DNS information
* Network-device checks
* Connectivity diagnostics

---

### 🛡️ Defensive Security Checks

OMEN includes utilities for inspecting security-related configuration and exposure, including:

* DNS configuration
* Email security configuration
* SPF / DMARC checks
* URL safety checks
* SSL/TLS information
* Certificate information
* Password exposure checks

The project is designed so that sensitive credentials are not sent to the frontend as part of normal operation.

---

## How Public Web Search Works

OMEN's public-web search is powered by **Tavily**.

A search input is expanded into several query variations to reduce obvious blind spots.

For example:

```text
plague.programmer
```

may produce variations such as:

```text
"plague.programmer"
plague.programmer
"plague programmer"
@plague.programmer
```

The backend sends these searches to Tavily and streams the returned results to the browser.

OMEN then:

1. Receives the provider response
2. Extracts the returned public URLs
3. Removes duplicate URLs
4. Displays the available metadata
5. Reports the final number of unique URLs

### Important

OMEN searches **public pages returned by the configured search provider**.

It does **not** crawl the entire internet.

Search coverage depends on:

* Search-engine indexing
* Provider availability
* Query formulation
* Rate limits
* Website accessibility
* Pages being publicly indexed

---

## Accuracy & Evidence Model

OMEN deliberately avoids treating a search result as proof of identity.

A returned result means:

> The configured search provider returned a publicly indexed page for the submitted query.

It does **not** automatically mean:

* The page belongs to the person being investigated
* The username belongs to that person
* Two accounts belong to the same person
* A mention is current
* A profile is authentic
* The person controls the account
* The search result represents every occurrence on the internet

This distinction is fundamental to OMEN.

### Evidence ≠ Identity

OMEN displays evidence.

**The user is responsible for interpreting that evidence.**

---

## Privacy & Scope

OMEN is designed around public, user-initiated research.

It does not:

* Log into third-party accounts
* Bypass authentication
* Access private accounts
* Circumvent access controls
* Attempt to defeat security mechanisms
* Claim identity matches without evidence
* Generate fabricated OSINT results

The project is intended for lawful and authorized research, defensive security work, privacy awareness, and investigation of information that is legitimately available to the user.

---

## Architecture

```text
┌───────────────────────────────┐
│          OMEN UI              │
│       Browser Interface       │
└───────────────┬───────────────┘
                │
                ▼
┌───────────────────────────────┐
│       Local Node.js Server    │
│                               │
│  • Search orchestration       │
│  • Result streaming           │
│  • Public endpoint checks     │
│  • Security utilities         │
└───────┬───────────┬───────────┘
        │           │
        ▼           ▼
   ┌─────────┐  ┌────────────────┐
   │ Tavily  │  │ Public network │
   │ Search  │  │ / security APIs│
   └─────────┘  └────────────────┘
```

The browser communicates with the local Node.js backend.

API credentials such as the Tavily key are kept server-side through environment variables rather than embedded in the frontend.

---

## Requirements

### Software

* Node.js **18+**
* Internet connection
* A Tavily API key

Node.js 20+ is recommended.

---

## Installation

Clone the repository:

```bash
git clone https://github.com/amoghbalapurepy-cmd/Omen-Osint.git
cd Omen-Osint
```

Install dependencies:

```bash
npm install
```

---

## Configuration

OMEN expects the Tavily API key to be available as an environment variable. Copy `.env.example` to `.env` and fill in your key:

```bash
cp .env.example .env
```

```text
TAVILY_API_KEY=your_tavily_api_key_here
PORT=8787
```

### Running the app (Next.js — recommended)

```bash
npm run dev
```

Then open:

```text
http://localhost:3000
```

For a production build:

```bash
npm run build
npm run start
```

### Running the legacy standalone server

An earlier, non-Next.js version of the console is still available via `server.js`:

```bash
export TAVILY_API_KEY="YOUR_TAVILY_API_KEY"   # Linux/macOS
# $env:TAVILY_API_KEY="YOUR_TAVILY_API_KEY"   # Windows PowerShell
# set TAVILY_API_KEY=YOUR_TAVILY_API_KEY      # Windows CMD

node server.js
```

Then open `http://localhost:8787`.

### Never commit your real API key

Your real Tavily key should remain local. `.env` is already excluded via `.gitignore` — only `.env.example` is tracked.

---

## API Endpoints

OMEN currently exposes local endpoints through its Node.js backend.

### Health

```text
GET /api/health
```

Returns the current backend status.

### Public Web Search

```text
GET /api/websearch?q=<query>
```

Runs the Tavily-powered public-web search and streams newline-delimited results.

### Public Username Recon

```text
GET /api/recon?username=<username>
```

Checks configured public platform endpoints for username evidence.

---

## Project Structure

```text
Omen-Osint/
│
├── app/                     # Next.js App Router
│   ├── api/
│   │   ├── health/
│   │   ├── recon/
│   │   └── websearch/
│   ├── globals.css
│   ├── layout.tsx
│   └── page.tsx
│
├── components/              # UI components (dashboard, sidebar, console, etc.)
├── lib/                     # Client + server helpers (lib/server/ is server-only)
├── assets/
│   └── branding/
│
├── index.html               # Legacy static entry point
├── server.js                # Legacy standalone Node server
├── ui.js / ui.css / ui-fixes.css   # Legacy frontend assets
│
├── README.md
├── LICENSE
├── SECURITY.md
├── CONTRIBUTING.md
│
├── .env.example
├── .gitignore
├── next.config.mjs
├── tsconfig.json
├── postcss.config.mjs
└── package.json
```

---

## Security Considerations

OMEN itself should be treated as security-sensitive software.

When running or modifying the project:

* Never commit API keys
* Never place secrets in frontend JavaScript
* Keep dependencies updated
* Validate user input
* Use request timeouts
* Avoid logging credentials
* Avoid storing sensitive search data unnecessarily
* Review third-party API terms before deployment
* Prefer running the application locally unless remote deployment is intentionally secured

For reporting vulnerabilities, see [`SECURITY.md`](SECURITY.md).

---

## Responsible Use

OMEN is intended for:

* Defensive security research
* Privacy awareness
* Public-information research
* Authorized investigations
* Security testing of systems you are permitted to test
* Educational purposes

Do not use OMEN to:

* Bypass authentication
* Access private information
* Circumvent security controls
* Harass or target individuals
* Impersonate other people
* Collect information for malicious purposes

Always follow applicable laws, policies, and the terms of the services being queried.

---

## Roadmap

OMEN is still under active development.

Planned improvements include:

* [ ] Better OSINT result categorization
* [ ] Evidence confidence indicators
* [ ] Search/exposure timeline
* [ ] Scan history
* [ ] Scan comparison
* [ ] Domain security scanner
* [ ] HTTP security-header analyzer
* [ ] Public document exposure search
* [ ] Image exposure search
* [ ] GitHub public-repository exposure checks
* [ ] Evidence export
* [ ] Automated investigation reports
* [ ] PDF report generation
* [ ] Improved result filtering
* [ ] Additional public-data providers

The goal is to improve **coverage and evidence quality**, not to make unsupported identity claims.

---

## Design Principles

OMEN follows a few core principles:

### 1. Real results over guesses

If OMEN cannot verify a result, it should not invent one.

### 2. Evidence over assumptions

A URL is evidence of a search result — not automatic proof of identity.

### 3. Public data only

The project focuses on information legitimately available through public sources.

### 4. Local-first operation

The application can run locally without requiring a hosted OMEN backend.

### 5. Security by default

Secrets should remain server-side, and the project should minimize unnecessary data collection.

---

## License

OMEN is released under the **MIT License**.

See [`LICENSE`](LICENSE) for the full license text.

---

## Author

Created and maintained by **Amogh Balapure**.

If you find a bug, have an improvement idea, or want to contribute, open an issue or pull request on the repository.

---

## Disclaimer

OMEN is a research and defensive-security tool.

Search results and public profile information can be incomplete, outdated, inaccurate, or incorrectly associated with a search term.

**Always independently verify important findings before acting on them.**

Omen-Osint

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README