📦tracelabs / tlosint-vm
← 返回首页
Trace Labs OSINT VM
⚖️ GPL-3.0🌐 docs.tracelabs.org📅 创建于 2023-01-20🔄 更新于 2026-10-12
🔗 GitHub Shell

📄 仓库 README

在 GitHub 查看 ↗
来自 GitHub 仓库自述文件 · 版权归原作者所有

Image Version event workflow License: GPL v3 Github All Releases

Maintainer Notes

This repository is actively maintained by Trace Labs staff.

  • Contributing: PRs are welcome. Please read CONTRIBUTING.md before opening a PR.
  • Issues: To recommend a tool, report a bug, or share feedback, open an issue.
  • Code of conduct: We follow the Contributor Covenant. By participating, you agree to uphold it.

Introduction

The repository includes a recipe file to build a Linux OSINT Distribution for Trace Labs based on the Kali Linux kali-vm script - https://gitlab.com/kalilinux/build-scripts/kali-vm

Using the VM

Option 1: Download the prebuilt Full Trace Labs OSINT VM

Use this if you just want to import and go.

Verify integrity

```bash # Linux sha256sum .ova

# macOS shasum -a 256 .qcow2

# Windows (PowerShell) Get-FileHash .\.ova -Algorithm SHA256 ```

Import the VM

  • VirtualBox: File → Import Appliance… → select .ova
  • VMware (Workstation/Player/Fusion): File → Open… → select .ova

Default login

username: osint password: osint

Option 2: Customize your own system with our tools script

Use this option if you want to start with your own base OS and then install OSINT tools and apply Firefox hardening on demand.

Note: tlosint-tools.sh is a standalone script that is not part of the VM build process. It's designed to be downloaded and run manually by end-users on any Kali or Debian-based system to install OSINT tools on-demand. This keeps the VM image size small while giving users flexibility to customize their toolset.

Download the raw file, not the GitHub "blob" page.

# Inside Kali (or other Debian-based OS)
cd ~/Desktop  # or any folder you prefer

# Fetch the script (RAW URL)
wget https://raw.githubusercontent.com/tracelabs/tlosint-vm/main/scripts/tlosint-tools.sh

# Give the script executable permission
chmod +x tlosint-tools.sh

# Execute the script
./tlosint-tools.sh

What the script does

  • Refreshes the Debian archive keyring and applies updates
  • Installs a curated OSINT toolset (Shodan CLI, Sherlock, PhoneInfoga, SpiderFoot, sn0int, Metagoofil, Sublist3r, steghide/stegseek, StegOSuite, exiftool, tor, torbrowser-launcher, translate-shell, etc.)
  • Installs a SOCMINT toolset — username enumeration (maigret, WhatsMyName), platform collection (Instaloader, GHunt), media acquisition (yt-dlp, gallery-dl, streamlink, ffmpeg), capture & archiving (auto-archiver, monolith, gowitness, internetarchive, Carbon14, HTTrack), signal extraction (tesseract-ocr), and investigator OPSEC (mat2)
  • Adds a Self-Heal & Update shortcut to the Desktop
  • Applies Firefox hardening (delete cookies/history on shutdown, block geolocation/mic/camera prompts by default, stronger tracking protection, preload OSINT bookmarks)

Releases

Releases follow a scheduled cadence. Releases are owned by assigned maintainers—usually Trace Labs staff. Release owners and timelines are proposed and confirmed during our quarterly planning meetings.

See RELEASES.md for more details.

About the releases

Releases are pre-built VM images you can import into VirtualBox or VMware. They are built from the main branch of this repo. The source here is the "recipe" for the VM; you can build your own or inspect how it was made.

After downloading a release, import it into your hypervisor. See Releases.

Login Credentials

osint osint

Obsidian

Note taking app Obsidian comes bundled with the VM. There is an icon on the desktop to launch Obisidian or you can run the appimage located in the home directory. We've already set up a vault for you called "TL Vault" that lives on the Desktop. The first time you run Obsidian open that vault folder. The default theme is the Trace Labs theme.

Build

If you'd rather build your own from source or modify the version we've released then building your own is fairly straight forward. (Note: You don't need to do this if you've already downloaded a release and imported to hypervisor)

We highly reccommend that you do your build in Docker. This assumes that you already have Docker installed on your system and that you are running the build on an Intel based chip.

With that in mind you can:

git clone https://github.com/tracelabs/tlosint-vm
cd tlosint-vm
chmod +x build-in-container.sh
./build-in-container.sh

You can explore the different build options with -h flag.

Applications

The majority of OSINT tools no longer come pre-packaged with the VM. There is an option to download them via a helper script. This keeps the size of the release small enough to build and host on GitHub.

Note: The tlosint-tools.sh script is a standalone utility that is not executed during the VM build process. It's provided as a convenience script for users who want to install OSINT tools on-demand after importing the VM.

If you want to install the tools using our helper script, run the tlosint-tools.sh script found in the scripts/ folder:

  • Open a terminal.
  • From the repository root (or wherever you saved the script), make it executable and run:
chmod +x scripts/tlosint-tools.sh
./scripts/tlosint-tools.sh
  • From the repository root (or wherever you saved the script), make it executable and run it:
chmod +x scripts/tlosint-tools.sh
./scripts/tlosint-tools.sh

Optional tools (opt-in)

Two tools are not installed by default and are enabled with an environment variable. Use sudo -E so the variable survives into the script:

# ArchiveBox — omitted by default because it pulls a large dependency tree
# plus its own Chromium, which noticeably grows the VM image.
TLOSINT_INSTALL_ARCHIVEBOX=1 sudo -E ./scripts/tlosint-tools.sh

# twscrape — omitted by default pending a Trace Labs terms-of-service review.
# It works by driving logged-in X/Twitter accounts; see docs/TOOLING_POLICY.md.
TLOSINT_ENABLE_TWSCRAPE=1 sudo -E ./scripts/tlosint-tools.sh

Or install both optional tools at the same time with:

TLOSINT_INSTALL_ARCHIVEBOX=1 TLOSINT_ENABLE_TWSCRAPE=1 sudo -E ./scripts/tlosint-tools.sh

Resources

Reporting

Browsers

Browser Extensions

Capture & Archiving

Data Analysis

Domains

Downloaders

Email

Frameworks

Phone Numbers

Social Media

Usernames

Investigator OPSEC

  • mat2 (metadata removal)
  • shred (secure file deletion; from coreutils)

Other Tools

Configuration Settings

Firefox

  • Delete cookies/history on shutdown
  • Block geo tracking
  • Block mic/camera detection
  • Block Firefox tracking
  • Preload OSINT Bookmarks

Contributing

PRs are welcome; please target the dev branch and read CONTRIBUTING.md. This project is licensed under GPL-3.0.

📈 近 7 天 Star 趋势

每日新增 Star（柱）与累计 Star（线）· 数据来自 GitHub

🏆 排名变化趋势

在各榜单中的排名历史（数字越小越靠前）

📋 历史上榜记录

每次快照的详细数据
日期 榜单 排名 周期新增 总 STAR