Omen-Osint - A local-first personal exposure and network securi

项目说明

OMEN

Note: The link on the guthub page dies not work an is sn older of the project. Clone the Repository locally and run.

Personal Exposure & Network Security Console

![Node.js CI]()

OMEN is a local-first, browser-based security and OSINT console designed to help users in publicly a information and perform defensi checks from a single interface.

It combines li search, public username , network diagnostics, and several defensi utilities in one lightweight Node.js application.

> E first. No fabricated profiles. No pri access. No identity guessing.

---

Screenshots

| Dashboard | Web Search |
|---|---|
| !Dashboard | !Web Search |

| Social Scan |
|---|
| !Social Scan |

---

O

OMEN was built around a simple idea:

If information is publicly exposed, make it easier to find, inspect, and understand — without pretending that search results prove more than they actually do.

The project currently provides two major in paths:

* Public Web OSINT — search indexed public pages for names, phrases, usernames, handles, keywords, and other identifiers using Tavily and Google Search APIs.
* Public Profile — check selected public platform endpoints for username presence with comprehensi extraction.

It also includes defensi for areas such as network connectivity, DNS/email configuration, URL safety, TLS/SSL information, and password exposure checks.

---

Features

🔎 Public Web OSINT

OMEN can send li to Tavily and Google Search APIs and stream the returned results directly into the console.

The search system:

* Accepts names, usernames, handles, phrases, and keywords
* Generates multiple search
* Performs real pro searches
* Returns real indexed URLs
* Displays titles and snippets
* Remo URLs
* Streams results as they arrive
* Shows the number of results discovered

Example inputs:

OMEN does not generate fake profile URLs or fabricate search results.

---

👤 Public Profile & Social Scan

OMEN can check selected public endpoints for username presence across:

* GitHub
* GitLab
* Bluesky
* Keybase
* Reddit
* npm maintainer e

NEW: The enhanced Social Scan feature now includes:

* Web-backed discovery for impro
* Profile extraction with rich metadata
* Interacti cards
* Google Search API integration for deeper social discovery
* Comprehensive scan results with confidence indicators

These checks are intended to answer:

> "Does this public endpoint currently provide e for this username?"

They are not intended to answer:

> "Does this account definitely belong to this person?"

---

🌐 Network & Endpoint Diagnostics

The console also provides defensi utilities, including:

* Endpoint reachability
* Latency checks
* DNS information
* Network-device checks
* Connectivity diagnostics
* Impro detection

---

🛡️ Defensi Checks

OMEN includes utilities for inspecting security-related configuration and exposure, including:

* DNS configuration
* Email security configuration
* SPF / DMARC checks
* URL safety checks
* SSL/TLS information
* Certificate information
* Password exposure checks

The project is designed so that sensiti are not sent to the frontend as part of normal operation.

---

How Public Web Search Works

OMEN's public-web search is powered by Tavily and Google Search APIs.

A search input is expanded into several query to reduce obvious blind spots.

For example:

may produce such as:

The backend sends these searches to the configured pro and streams the returned results to the browser.

OMEN then:

1. Receives the provider response
2. Extracts the returned public URLs
3. Remo URLs
4. Displays the a metadata
5. Reports the final number of unique URLs

Important

OMEN searches public pages returned by the configured search pro.

It does not crawl the entire internet.

Search co depends on:

* Search-engine indexing
* Provider a
* Query formulation
* Rate limits
* Website accessibility
* Pages being publicly indexed

---

Accuracy & E Model

OMEN deliberately avoids treating a search result as proof of identity.

A returned result means:

> The configured search provider returned a publicly indexed page for the submitted query.

It does not automatically mean:

* The page belongs to the person being in
* The username belongs to that person
* Two accounts belong to the same person
* A mention is current
* A profile is authentic
* The person controls the account
* The search result represents every occurrence on the internet

This distinction is fundamental to OMEN.

E ≠ Identity

OMEN displays e.

The user is responsible for interpreting that e.

---

Privacy & Scope

OMEN is designed around public, user-initiated research.

It does not:

* Log into third-party accounts
* Bypass authentication
* Access private accounts
* Circumvent access controls
* Attempt to defeat security mechanisms
* Claim identity matches without e
* Generate fabricated OSINT results

The project is intended for lawful and authorized research, defensi work, privacy awareness, and in of information that is legitimately a to the user.

---

Architecture

The browser communicates with the local Next.js backend.

API credentials such as Tavily and Google Search keys are kept ser through en rather than embedded in the frontend.

---

Requirements

Software

* Node.js 18+
* Internet connection
* A Tavily API key
* A Google Search API key (optional, for enhanced social scanning)

Node.js 20+ is recommended.

---

Installation

Clone the repository:

Install dependencies:

---

Configuration

OMEN expects API keys to be a as en . Copy .en to .env and fill in your keys:

Running the app (Next.js — recommended)

Then open:

For a production build:

Running the legacy standalone server

An earlier, non-Next.js of the console is still a via server.js:

Then open .

Ne your real API keys

Your real API keys should remain local. .env is already excluded via .gitignore — only .en is tracked.

---

API Endpoints

OMEN currently exposes local endpoints through its Next.js backend.

Health

Returns the current backend status.

Public Web Search

Runs the multi-provider public-web search and streams newline-delimited results.

Public Username Recon & Social Scan

Checks configured public platform endpoints for username e with comprehensi extraction.

---

Project Structure

---

Security Considerations

OMEN itself should be treated as security-sensiti.

When running or modifying the project:

* Ne API keys
* Ne secrets in frontend Ja
* Keep dependencies updated
* user input
* Use request timeouts
* Avoid logging credentials
* Avoid storing sensiti data unnecessarily
* Review third-party API terms before deployment
* Prefer running the application locally unless remote deployment is intentionally secured

For reporting , see SECURITY.md.

---

Responsible Use

OMEN is intended for:

* Defensi research
* Privacy awareness
* Public-information research
* Authorized in
* Security testing of systems you are permitted to test
* Educational purposes

Do not use OMEN to:

* Bypass authentication
* Access private information
* Circumvent security controls
* Harass or target indi
* Impersonate other people
* Collect information for malicious purposes

Always follow applicable laws, policies, and the terms of the services being queried.

---

Roadmap

OMEN is still under acti.

Recent impro:

* [x] Google Search API integration
* [x] Comprehensi scan with profile extraction
* [x] Web-backed discovery for social scan
* [x] Impro diagnostics
* [x] Enhanced UI with profile cards

Planned impro include:

* [ ] Better OSINT result categorization
* [ ] E confidence indicators
* [ ] Search/exposure timeline
* [ ] Scan history
* [ ] Scan comparison
* [ ] Domain security scanner
* [ ] HTTP security-header analyzer
* [ ] Public document exposure search
* [ ] Image exposure search
* [ ] GitHub public-repository exposure checks
* [ ] E export
* [ ] Automated in reports
* [ ] PDF report generation
* [ ] Impro filtering
* [ ] Additional public-data pro

The goal is to improve co and e quality, not to make unsupported identity claims.

---

Design Principles

OMEN follows a few core principles:

1. Real results o

If OMEN cannot a result, it should not invent one.

2. E o

A URL is e of a search result — not automatic proof of identity.

3. Public data only

The project focuses on information legitimately a through public sources.

4. Local-first operation

The application can run locally without requiring a hosted OMEN backend.

5. Security by default

Secrets should remain ser, and the project should minimize unnecessary data collection.

---

License

OMEN is released under the MIT License.

See LICENSE for the full license text.

---

Author

Created and maintained by Amogh Balapure.

If you find a bug, have an impro idea, or want to contribute, open an issue or pull request on the repository.

---

Disclaimer

OMEN is a research and defensi tool.

Search results and public profile information can be incomplete, outdated, inaccurate, or incorrectly associated with a search term.

Always independently important findings before acting on them.

项目信息

开发语言：TypeScript

Star 数：10

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A local-first personal exposure and network security console with real public-web OSINT and defensive security tools.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。