HACKING PROJECT · social · Advanced
OSINT Automated Intelligence Dashboard
Automate multi-source OSINT collection and correlation to produce a unified, auditable attack-surface and exposure intelligence dashboard from a single seed input.
Open-source intelligence gathering during reconnaissance, threat research, and third-party risk assessment is fragmented across dozens of tools and manual queries, making it slow, inconsistent, and hard to audit. Analysts waste hours pivoting between WHOIS, DNS, certificate transparency, breach databases, and social sources without a unified, deduplicated view. Organizations need repeatable, ethical, and correlated OSINT collection that surfaces attack surface and exposure at scale.
**What you'll build**
Build a modular OSINT orchestration platform that ingests a seed (domain, org, email, IP) and automatically runs collectors across DNS, certificate transparency, subdomain enumeration, breach/leak data, WHOIS, and metadata sources, normalizing results into a graph model. Present correlated findings in an interactive dashboard with entity relationship visualization, exposure scoring, and export to threat-intel formats, with strict rate-limiting and source attribution.
**Objective** — Automate multi-source OSINT collection and correlation to produce a unified, auditable attack-surface and exposure intelligence dashboard from a single seed input.
**Expected outcome** — A working web dashboard plus collector framework that takes an organization seed and returns a correlated entity graph, exposure report, and STIX/CSV export of discovered assets and risks.
**Difficulty** — Advanced — requires API orchestration, data normalization, graph modeling, and careful handling of legal/ethical collection boundaries.
**Primary category** — Threat Intelligence / OSINT; Secondary = Attack Surface Management, Reconnaissance, GRC/TPRM
**Security domains** — Primary = Threat Intelligence; Secondary = Red Team (reconnaissance), GRC (third-party risk), Blue Team (attack-surface management)
**Technical focus** — Passive/active reconnaissance, subdomain enumeration, certificate transparency mining, DNS intelligence, breach-data correlation, entity resolution, graph data modeling, data visualization, API orchestration, rate-limiting, threat-intel export (STIX/TAXII)
**Core technologies** — Languages: Python, JavaScript/TypeScript; Frameworks/Libraries: FastAPI/Flask, Celery, React, D3.js/Cytoscape, spiderfoot modules, theHarvester, amass; Security Tools: Amass, Subfinder, SpiderFoot, Shodan/Censys APIs, crt.sh, Have I Been Pwned API; Cloud/Infra: Docker, Redis, task queues; AI/Data: NLP entity extraction, embedding-based deduplication; Databases: Neo4j (graph), PostgreSQL, Elasticsearch
**Where it's valued** — Threat-intel vendors, MSSPs, red-team/pentest consultancies, financial services, insurance (cyber underwriting), brand-protection, law enforcement, journalism
**Careers it builds toward** — Threat Intelligence Analyst, OSINT Investigator, Red Team Operator, Attack Surface Management Engineer, Third-Party Risk Analyst, Cyber Threat Researcher
**Framework alignment**
• MITRE ATT&CK: Reconnaissance — Gather Victim Identity Information (T1589), Gather Victim Network Information (T1590), Search Open Technical Databases (T1596), Active Scanning (T1595), Search Open Websites/Domains (T1593)
• NIST CSF 2.0: Identify (Asset Management, Risk Assessment), Detect (Continuous Monitoring), Govern (Supply Chain / third-party risk)
• OWASP: N/A directly (methodology project); aligns with attack-surface reduction, informs A05/A06 exposure
• CIS Controls v8: 1 (Inventory of Enterprise Assets), 2 (Inventory of Software Assets), 7 (Continuous Vulnerability Management), 15 (Service Provider Management)
**Innovation** — Improved Existing Solution — SpiderFoot and Recon-ng exist, but a correlated graph-native dashboard with exposure scoring and TI export has clear product value. Scores: Innovation 6/10, Startup 7/10, Enterprise-Readiness 6/10, Patent = No.