socialscope

Passive social-media OSINT — username enumeration, email-existence probes, search-engine dorking, image EXIF

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install socialscope

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- socialscope

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

socialscope --help                # subcommand catalogue + flags
socialscope --full                # extended help across every subcommand
socialscope --about               # machine-readable attribution (JSON)
socialscope --version             # version string

What it does

socialscope is the cli.johlem.net suite's passive, ToS-respecting social-media OSINT tool. Seven subcommands: user (Sherlock-class username enumeration across 30+ public sites), email (Holehe-class email-existence probe against 5 default-on platforms — Gravatar / GitHub Search / GitLab Search / Mastodon WebFinger / HIBP), dork (search-engine dorking via DuckDuckGo HTML against 3 starter packs — paste sites / code leaks / social-handle brand monitor), image (EXIF + GPS extraction from local file or URL), verify (orchestrator: runs the above against one or more --target inputs and emits a single jfind/v1 NDJSON bundle for dossier), packs + sites (data introspection). socialscope REFUSES BY DESIGN to scrape LinkedIn / Instagram / TikTok / Facebook authenticated content, run headless browsers, store platform credentials, or bypass rate limits — the brand promise is OSINT that respects platform ToS. Strict-abuse-class endpoints (Twitter/X legacy email-available, Instagram account-exists, Snapchat / TikTok / Facebook) are default-off; opt-in via --include-abuse-class-strict. jfind/v1 output pre-fills DORA Art. 28 (third-party-risk on code-leak dorks), NIS2 Art. 21(2)(d), and ISO/IEC 27001:2022 A.5.34 (PII in image metadata). Vendored data at data/sites.toml + data/email_sites.toml + data/dorks/*.yaml is the source of truth — extend via fork+recompile. 18 unit + 14 integration tests; zero compiler warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.