OSINT cluster research: infrastructure discovery and attack-surface mapping #178

New issue

Open

opened 2026-08-29 10:28:07 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-08-29 10:28:07 +00:00

Owner

Goal

Deeply research infrastructure-focused OSINT and asset-discovery tooling, starting with OWASP Amass and comparable discovery techniques, and extract the capability model StarIntel needs.

Architecture rule

Treat this as an Infrastructure Domain Server capability cluster. Do not duplicate DNS, certificate, ASN, WHOIS, subdomain, service, or relationship logic inside Identity or other domains.

Required feature enumeration

For Amass and any directly comparable tool retained in scope, verify:

passive OSINT source collection
active enumeration modes
DNS resolution and brute-force/mutation behavior
subdomain discovery
certificate-transparency discovery
ASN / netblock / IP relationship discovery
graph-based asset relationships
recursive discovery and pivot rules
source attribution
confidence/validation of discovered assets
asset database/model
event/observation history
incremental runs and change detection
configuration and source credentials
rate limiting/concurrency
scope controls and exclusion rules
output/export formats
integration boundaries

StarIntel target

Research a coherent Infrastructure Domain Server with capability families such as discovery, resolution, topology/correlation, and change observation rather than provider-specific actors.

Prefer a shared typed asset/observation model with provenance preserved per discovery source.

Implementation preference

StarLang first; extend StarLang where required; Common Lisp next; Python only as a last resort.

Output gate

Stage findings in roam/internal/OSINT-TOOLS-LEDGER.org and this issue only until explicit instruction to add ARARD/ARADR research.

## Goal Deeply research infrastructure-focused OSINT and asset-discovery tooling, starting with OWASP Amass and comparable discovery techniques, and extract the capability model StarIntel needs. ## Architecture rule Treat this as an **Infrastructure Domain Server** capability cluster. Do not duplicate DNS, certificate, ASN, WHOIS, subdomain, service, or relationship logic inside Identity or other domains. ## Required feature enumeration For Amass and any directly comparable tool retained in scope, verify: - passive OSINT source collection - active enumeration modes - DNS resolution and brute-force/mutation behavior - subdomain discovery - certificate-transparency discovery - ASN / netblock / IP relationship discovery - graph-based asset relationships - recursive discovery and pivot rules - source attribution - confidence/validation of discovered assets - asset database/model - event/observation history - incremental runs and change detection - configuration and source credentials - rate limiting/concurrency - scope controls and exclusion rules - output/export formats - integration boundaries ## StarIntel target Research a coherent Infrastructure Domain Server with capability families such as discovery, resolution, topology/correlation, and change observation rather than provider-specific actors. Prefer a shared typed asset/observation model with provenance preserved per discovery source. ## Implementation preference StarLang first; extend StarLang where required; Common Lisp next; Python only as a last resort. ## Output gate Stage findings in `roam/internal/OSINT-TOOLS-LEDGER.org` and this issue only until explicit instruction to add ARARD/ARADR research.

nsaspy referenced this issue

2026-08-29 10:28:13 +00:00

ADADR: StarIntel OAuth authorization-code provider for Bixby user accounts #144