qeeqbox/social-analyzer

API, CLI, and Web App for analyzing and finding a person's profile in 1000 social media \ websites

Social Analyzer - API, CLI, and Web App for analyzing & finding a person's profile across +1000 social media \ websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process.

The detection modules utilize a rating mechanism based on different detection techniques, which produces a rate value that starts from 0 to 100 (No-Maybe-Yes). This module is intended to have fewer false positives.

The analysis and public extracted information from this OSINT tool could help investigate profiles related to suspicious or malicious activities such as cyberbullying, cyber grooming, cyberstalking, and spreading misinformation.

This project is currently used by some law enforcement agencies in countries where resources are limited - The detection database is different than the one shared here..

So·cial Me·di·a

Websites and applications that enable users to create and share content or to participate in social networking - Oxford Dictionary

Structure

APP (Preferred!)

Standard localhost WEB APP url: http://0.0.0.0:9005/app.html

CLI

Features

• String & name analysis (Permutations and Combinations)
• Find a profile using multiple techniques (HTTPS library & Webdriver)
• Multi profile search (Used for correlation - any combination separated with "," )
• Multilayers detections (OCR, normal, advanced & special)
• Visualized profile information using Ixora (Metadata & Patterns)
• Metadata & Patterns extraction (Added from Qeeqbox OSINT project)
• Force-directed Graph for Metadata (Needs ExtractPatterns)
• Search by top ranking or by country (Alexa Ranking)
• Search by type (adult, music, etc.. - automated websites stats)
• Profiles stats and static info (Category country)
• Cross Metadata stats (Added from Qeeqbox OSINT project)
• Auto-flirtation to unnecessary output (Enable javascript etc..)
• Search engine lookup (Google API - optional)
• Custom search queries (Google API & DuckDuckGo API - optional)
• Profile screenshot, title, info, and website description
• Find name origins, name similarity & common words by language
• Find possible profile\person age (Limited analysis)
• Custom user-agent, proxy, timeout & implicit wait
• Python CLI & NodeJS CLI (limited to FindUserProfilesFast option)
• Screenshots of detected profile (The latest version of Chrome must be installed)
• Grid option for faster checking (limited to docker-compose)
• Dump logs to folder or terminal (prettified)
• Adjust finding\getting profile workers (default 15)
• Re-checking option for failed profiles
• Filter profiles by good, maybe, and bad
• Save the analysis as a JSON file
• Simplified web interface and CLI
• And, more!!

Special Detections

• Facebook (Phone number, name, or profile name)
• Gmail ([email protected])
• Google ([email protected])

Install & Run

Linux (As Node WebApp)

sudo apt-get update
#Depedning on your Linux distro, you may or may not need these 2 lines
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common
sudo add-apt-repository ppa:mozillateam/ppa -y
sudo apt-get install -y firefox-esr tesseract-ocr git nodejs npm
git clone https://github.com/qeeqbox/social-analyzer.git
cd social-analyzer
npm update
npm install
npm install loadash
npm start

Linux (As Node CLI)

sudo apt-get update
#Depedning on your Linux distro, you may or may not need these 2 lines
sudo DEBIAN_FRONTEND=noninteractive apt-get install -y software-properties-common
sudo add-apt-repository ppa:mozillateam/ppa -y
sudo apt-get install -y firefox-esr tesseract-ocr git nodejs npm
git clone https://github.com/qeeqbox/social-analyzer.git
cd social-analyzer
npm install
npm install loadash
nodejs app.js --username "johndoe"
#or
nodejs app.js --username "johndoe,janedoe" --metadata
#or
nodejs app.js --username "johndoe,janedoe" --metadata --top 100
#or
nodejs app.js --username "johndoe" --type "adult"

Linux (As python package)

sudo apt-get update
sudo apt-get install python3 python3-pip
pip3 install social-analyzer
python3 -m social-analyzer --username "johndoe"
#or
python3 -m social-analyzer --username "johndoe" --metadata
#or
python3 -m social-analyzer --username "johndoe" --metadata --top 100
#or
python3 -m social-analyzer --username "johndoe" --type "adult"
#or
python3 -m social-analyzer --username "johndoe" --websites "car" --logs --screenshots

Linux (As python script)

sudo apt-get update
sudo apt-get install git python3 python3-pip
git clone https://github.com/qeeqbox/social-analyzer
cd social-analyzer
pip3 install -r requirements.txt
python3 app.py --username "janedoe"
#or
python3 app.py --username "johndoe" --metadata
#or
python3 app.py --username "johndoe" --metadata --top 100
#or
python3 app.py --username "johndoe" --type "adult"
#or
python3 app.py --username "johndoe" --websites "car" --logs --screenshots

Importing as object (python)

#E.g. #1
from importlib import import_module
SocialAnalyzer = import_module("social-analyzer").SocialAnalyzer()
results = SocialAnalyzer.run_as_object(username="johndoe",silent=True)
print(results)

#E.g. #2
from importlib import import_module
SocialAnalyzer = import_module("social-analyzer").SocialAnalyzer()
results = SocialAnalyzer.run_as_object(username="johndoe,janedoe",silent=True,output="json",filter="good",metadata=False,timeout=10, profiles="detected")
print(results)

Linux, Windows, MacOS, Raspberry pi..

• check this wiki for all possible installation methods
• check this wiki for integrating social-analyzer with your OSINT tools, feeds, etc...

social-analyzer --h

Required Arguments:
  --username   E.g. johndoe, john_doe or johndoe9999

Optional Arguments:
  --websites    A website or websites separated by space E.g. youtube, tiktokor tumblr
  --mode        Analysis mode E.g.fast -> FindUserProfilesFast, slow -> FindUserProfilesSlow or special -> FindUserProfilesSpecial
  --output      Show the output in the following format: json -> json outputfor integration or pretty -> prettify the output
  --options     Show the following when a profile is found: link, rate, titleor text
  --method      find -> show detected profiles, get -> show all profiles regardless detected or not, all -> combine find & get
  --filter      Filter detected profiles by good, maybe or bad, you can do combine them with comma (good,bad) or use all
  --profiles    Filter profiles by detected, unknown or failed, you can do combine them with comma (detected,failed) or use all
  --countries   select websites by country or countries separated by space as: us br ru
  --type        Select websites by type (Adult, Music etc)
  --top         select top websites as 10, 50 etc...[--websites is not needed]
  --extract     Extract profiles, urls & patterns if possible
  --metadata    Extract metadata if possible (pypi QeeqBox OSINT)
  --trim        Trim long strings
  --gui         Reserved for a gui (Not implemented)
  --cli         Reserved for a cli (Not needed)

Listing websites & detections:
  --list        List all available websites

Setting:
  --headers     Headers as dict
  --logs_dir    Change logs directory
  --timeout     Change timeout between each request
  --silent      Disable output to screen

Open Shell

Resources

• DuckDuckGo API, Google API, NodeJS, bootstrap, selectize, jQuery, Wikipedia, font-awesome, selenium-webdriver & tesseract.js
• Let me know if I missed a reference or resource!

Disclaimer\Notes

• Download this project from GitHub and treat it as a security project
• If you want your website to be excluded from this project list, please reach out to me
• This tool is meant to be used locally, not as a service (It does not have any Access Control)
• For issues related to modules that end with -private or under the private group , reach out directly to me (do not open an issue on GitHub)

Other Projects

social-analyzer's Issues

Wrong command at README

At https://github.com/qeeqbox/social-analyzer#linux-as-python-script the last line should be:

python3 app.py --username "johndoe" --metadata --top 100

New one

removed

package folder social-analyzer missing?

README.md contains the following instructions:

git clone https://github.com/qeeqbox/social-analyzer
cd social-analyzer

However, the folder social-analyzer seems to be missing.

Is this intended?
And is there a way to pull that missing folder?

Installer fails on Fedora 29

[xxx@mac-pro-1-1 social-analyzer]$ sudo  dnf install -y tesseract

[xxx@mac-pro-1-1 social-analyzer]$ npm install
npm WARN [email protected] No repository field.
npm WARN [email protected] license should be a valid SPDX license expression

audited 170 packages in 1.74s

9 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

[xxx@mac-pro-1-1 social-analyzer]$ npm start

> [email protected] start /home/josevnz/social-analyzer
> node server.js

internal/modules/cjs/loader.js:628
  throw e;
  ^

Error: No valid exports main found for '/home/josevnz/social-analyzer/node_modules/klona'
    at resolveExportsTarget (internal/modules/cjs/loader.js:625:9)
    at applyExports (internal/modules/cjs/loader.js:502:14)
    at resolveExports (internal/modules/cjs/loader.js:551:12)
    at Function.Module._findPath (internal/modules/cjs/loader.js:657:22)
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:960:27)
    at Function.Module._load (internal/modules/cjs/loader.js:855:27)
    at Module.require (internal/modules/cjs/loader.js:1033:19)
    at require (internal/modules/cjs/helpers.js:72:18)
    at Object.<anonymous> (/home/josevnz/social-analyzer/node_modules/sanitize-html/index.js:3:19)
    at Module._compile (internal/modules/cjs/loader.js:1144:30) {
  code: 'MODULE_NOT_FOUND'
}
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! [email protected] start: `node server.js`
npm ERR! Exit status 1
npm ERR! 
npm ERR! Failed at the [email protected] start script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/josevnz/.npm/_logs/2020-12-24T19_05_42_315Z-debug.log

Next

CLI on Windows

How to run as CLI on Windows?

auto title changing to 4216a373-84c1-436d-b8fd-f5c3a627e181

Hi

Probiv po soc setjam

hanging

it keeps hanging at google Gmail facebook and other random sites

auto title changing to acb06fb8-ee12-4082-8266-f699888a8002

auto title changing to 985dd6d8-b716-4ff7-a9c7-2583f4ce0c18

Question regarding installation

Why do the install instructions say that one should install firefox esr from a ppa instead of just using regular firefox from the normal distribution mirrors?

Install

error

nothing has changed still no results, what's wrong?

npm start

[email protected] start
node server.js

Server started at http://localhost:9005/app.html
Driver Session Issue
Total time 320
(node:10846) UnhandledPromiseRejectionWarning: WebDriverError: Process unexpectedly closed with status 1
at Object.throwDecodedError (/home/osint/social-analyzer/node_modules/selenium-webdriver/lib/error.js:550:15)
at parseHttpResponse (/home/osint/social-analyzer/node_modules/selenium-webdriver/lib/http.js:565:13)
at Executor.execute (/home/osint/social-analyzer/node_modules/selenium-webdriver/lib/http.js:491:26)
at processTicksAndRejections (internal/process/task_queues.js:97:5)
(node:10846) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 1)
(node:10846) [DEP0018] DeprecationWarning: Unhandled promise rejections are deprecated. In the future, promise rejections that are not handled will terminate the Node.js process with a non-zero exit code.
Driver Session Issue
Total time 249
(node:10846) UnhandledPromiseRejectionWarning: WebDriverError: Process unexpectedly closed with status 1
at Object.throwDecodedError (/home/osint/social-analyzer/node_modules/selenium-webdriver/lib/error.js:550:15)
at parseHttpResponse (/home/osint/social-analyzer/node_modules/selenium-webdriver/lib/http.js:565:13)
at Executor.execute (/home/osint/social-analyzer/node_modules/selenium-webdriver/lib/http.js:491:26)
at processTicksAndRejections (internal/process/task_queues.js:97:5)
(node:10846) UnhandledPromiseRejectionWarning: Unhandled promise rejection. This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). To terminate the node process on unhandled promise rejection, use the CLI flag --unhandled-rejections=strict (see https://nodejs.org/api/cli.html#cli_unhandled_rejections_mode). (rejection id: 3)

Ssm

auto title changing to 56f9560d-04d8-42b5-9cf6-1ead470df198

😖😭😃

Docker-compose install instructions outdated

Issue

When working this week on your project, I saw that docker-compose download and install command with curl is pointing to an outdated version of docker-compose.

Where

The issue is located in the project wiki here: https://github.com/qeeqbox/social-analyzer/wiki/install#docker-compose

What's need to be changed?

According to the official documentation, the line:

sudo curl -L "https://github.com/docker/compose/releases/download/1.26.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

Should be replaced by:

sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose

Additional changes for docker-compose

Since you've accepted and merged my pull request, why not add the following?

# By default (2 CPU cores)
docker-compose -f docker-compose.yml up --build

# Using all available CPU cores
echo "CPU_CORES=`nproc`" > .env ; docker-compose -f docker-compose.yml up --build

# Using only some CPU cores (if more than 4)
echo "CPU_CORES=4" > .env ; docker-compose -f docker-compose.yml up --build

This would make the docker-compose install instructions from this:

sudo apt-get update
sudo apt-get install -y docker.io git curl
sudo curl -L "https://github.com/docker/compose/releases/download/1.26.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
git clone https://github.com/qeeqbox/social-analyzer.git
cd social-analyzer
docker-compose -f docker-compose.yml up --build

To that:

# Install updates, docker-compose and project
sudo apt-get update
sudo apt-get install -y docker.io git curl
sudo curl -L "https://github.com/docker/compose/releases/download/1.29.2/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
git clone https://github.com/qeeqbox/social-analyzer.git
cd social-analyzer

# Default deployment (2 CPU cores)
docker-compose -f docker-compose.yml up --build

# Deploy and use all available CPU cores
echo "CPU_CORES=`nproc`" > .env ; docker-compose -f docker-compose.yml up --build

# Deploy and use only some CPU cores (if more than 4)
echo "CPU_CORES=4" > .env ; docker-compose -f docker-compose.yml up --build

Note: My pull request has been deployed with docker-compose version 1.29.2 which is the latest release from the 1.x.x branch as of writing.

Warning

Docker has recently released the compose plugin as docker-compose V2 and compose-switch to smoothly handle the transition from the version 1.x.x (docker-compose) to the version 2.x.x (docker compose).

So, maybe it would be useful to say that this project has been tested and works on V1 (docker-compose) but probably not with V2 (docker compose) or needs additional testing to be documented.

I was unsure myself which version I would use knowing that the currently documented version 1.26.2 was outdated and so wanted to use the latest one and then I saw that a V2 where out but was working differently and was no longer a single binary but now a docker plugin and docker-switch should be used to handle the transition.

Comments

I wanted to create a pull request along this issue but I could not find any edit links in the Wiki 😅

Jump across e-mails/addresses/linked accounts

This will allow us to search a person using different usernames across different platforms.

Sub

Add Qvault dev profiles

I can open a PR to add Qvault developer profiles if you think it would be a good fit. Let me know :)

error

no results, but the profil exists https://www.facebook.com/jan.bor.7169/

can you help?

/usr/bin/python3: No module named social-analyzer

/usr/bin/python3: No module named social-analyzer

Question: What’s the likelihood it will be detected as a bot (and blacklisted)?

I don’t see it addressed in the README, but I think it’s an important consideration.

Will users see much more captchas if they run this from their home/work IP? Will some sites block the users from doing queries, and if so: what happens to those results?

websites

Hi, is there a way to search for all the possible websites instead of just the ones you have to input? For example, instead of --websites "instagram facebook youtube" and so on, is there a way to just say --websites "all"?

Filter out low confidence results by default

According to my tests, most of the results returned with confidence scores below 60 percent either point to non-existent users or are useless.

Social

Just a o see if I can accomplish a project

Slow mode failure on Ubuntu 20.04

All detections fail on Ubuntu 20.04 using the Python 3-PIP version of the software.
Tested for my own accounts and returned no results.

[Request] Sherlock Integration

Can you integrate with sherlock to extract even more information about a profile but with in one console, thanks.
https://github.com/sherlock-project/sherlock

hackerone profiles not detected

I've tested on my own profile, and stefanofinding's profile, but nothing came up. I'm using the tags FindUserProfilesSlow, ShowUserProfilesSlow, FindUserProfilesSpecial on the web interface.
Selected "hackerone" on advanced options. No google API, no proxy, and default user-agent string.

I tested it beforehand with my github profile and it did detect that one.

auto title changing to 14da612d-2469-4f14-9abd-5b3f2ada9998

auto title changing to 532ac053-1254-4897-aba6-20665426fc5f

auto title changing to 5bff0b4b-5696-4b98-8726-a54c1b0e2f59

[edited -> Kali Linux install & run] too confusing

installed this on kali linux
it was too confusing
as i could not find CLI or URL Mentioned is not opening

please do a guided setup for Kali Linux

help appreciated

kudos to you effort making life easier

Fix error 'SE_EVENT_BUS_HOST not set, exiting!'

During some testing sessions, I had some hard times to figure why the screenshot feature was not working as expected. After few hours of debugging, I've found the culprit 😅

web-automation_firefox | SE_EVENT_BUS_HOST not set, exiting!
web-automation_firefox | 2021-12-04 01:54:01,992 INFO exited: selenium-node (exit status 1; not expected)

I then did some research and found that the defined variables was not correct anymore, certainly due to version changes since last time the docker-compose.yml has been created and/or updated.

I've already created a pull request that contains the fix and resolution proofs here: #75

Heroku fails

Server started at http://localhost:9005/app.html
2020-12-28T09:17:45.841182+00:00 heroku[web.1]: Error R10 (Boot timeout) -> Web process failed to bind to $PORT within 60 seconds of launch
2020-12-28T09:17:45.863001+00:00 heroku[web.1]: Stopping process with SIGKILL
2020-12-28T09:17:45.953722+00:00 heroku[web.1]: Process exited with status 137
2020-12-28T09:17:45.999542+00:00 heroku[web.1]: State changed from starting to crashed
2020-12-28T09:18:39.390728+00:00 heroku[router]: at=error code=H10 desc="App crashed" method=GET path="/" host=shrouded-citadel-37315.herokuapp.com request_id=-6b6f--af76 fwd="" dyno= connect= service= status=503 bytes= protocol=https

searching for any name will always return positive results from all websites queried - [Please read the documentation!]

for example, run the following query in which the name is "xxxxxxxxxxxxxxxxxxxxxxx":

python3 -m social-analyzer --cli --mode "fast" --username "xxxxxxxxxxxxxxxxxxxxxx" --websites "all" --output "pretty"

will result in this:

> 
link     : https://mixcloud.com/xxxxxxxxxxxxxxxxxxxxxx
title    : Mixcloud
language : unavailable
type     : Audio Streaming
-----------------------
link     : https://nightbot.tv/t/xxxxxxxxxxxxxxxxxxxxxx/commands
title    : Nightbot
language : unavailable
type     : unavailable
....
....
edit
....
....
-----------------------
[failed] 7 Profile[s]
-----------------------
link     : https://codeberg.com/xxxxxxxxxxxxxxxxxxxxxx
-----------------------
link     : https://forum.igromania.ru/member.php?username=xxxxxxxxxxxxxxxxxxxxxx
-----------------------
link     : https://leetcode.com/xxxxxxxxxxxxxxxxxxxxxx
-----------------------
link     : https://pling.com/u/xxxxxxxxxxxxxxxxxxxxxx
-----------------------
link     : https://plug.dj/@/xxxxxxxxxxxxxxxxxxxxxx
-----------------------
link     : https://uid.me/xxxxxxxxxxxxxxxxxxxxxx
-----------------------
link     : https://xxxxxxxxxxxxxxxxxxxxxx.wix.com

> 

Google API Key and Duck Duck Go API

I cannot seem to get the google key and the CS key to work, most likely I'm doing it wrong..what is the correct way to generate those keys from the console.
How do you enable the duck duck go api search option ?

.

auto title changing to 8c37a5cd-08f9-499e-8539-e9b2fe503a9f

auto title changing to 61dbc622-d413-474a-bfd9-02406601f242

Temp log files generated

Hello, I've been using social analyzer programatically and it looks like, after a couple of days running 24/7, it's generated about 2TB of data in the /tmp directory. Do you know any way to avoid logs being generated automatically by the program?

auto title changing to 01265c5f-7b8f-4155-b660-5935339f7073

Social media

hidy

auto title changing to a392fc7e-12cc-4010-ab43-bd8b48283406

TimeoutError: Connection refused (os error 111)

I tried the docker container but I get a bunch of unhandled errors:

Driver Session Issue
 --- Uncaught Rejection ---
  TimeoutError: Connection refused (os error 111)
  
  - error.js:550 Object.throwDecodedError
    [app]/[selenium-webdriver]/lib/error.js:550:15
  
  - http.js:565 parseHttpResponse
    [app]/[selenium-webdriver]/lib/http.js:565:13
  
  - http.js:491 Executor.execute
    [app]/[selenium-webdriver]/lib/http.js:491:26
  
  - runMicrotasks
  
  - task_queues.js:93 processTicksAndRejections
    internal/process/task_queues.js:93:5

Perhaps they should be properly handled

Shared Detections for URLs?

When a service is open-source and can be self-hosted, this often leads to it being self-hosted on many different domains.

Examples are like:

• Mastodon
  • https://fosstodon.org/@{username}
  • https://mastodon.cloud/@{username}
  • https://mastodon.social/@{username}
  • https://mastodon.technology/@{username}
  • https://mastodon.xyz/@{username}
  • https://mstdn.io/@{username}
• Discourse
  • https://ask.fedoraproject.org/u/{username}
  • https://community.signalusers.org/u/{username}
  • https://community.cloudflare.com/u/{username}
  • https://community.bitwarden.com/u/{username}/summary
  • https://discourse.wicg.io/u/{username}/summary
  • https://discuss.atom.io/u/{username}/summary
  • https://forum.leasehackr.com/u/{username}/summary
  • https://discuss.elastic.co/u/{username}
  • https://forum.sublimetext.com/u/{username}
  • https://forums.whonix.org/u/{username}
• GitLab
  • https://gitlab.com/{username}
  • https://gitlab.gnome.org/{username}
• Weblate
  • https://hosted.weblate.org/user/{username}/
• MediaWiki
  • https://wikipedia.org/wiki/User:{username}

Only including links that exist in the repository.

Most Mastodon instances can share detections for example, same with all Discourse instances.
The only time this may not be the case is if a particular service is using a very outdated version of the software which then it may have to be separated.

It might help reduce the maintenance effort and total size of sites.json, by adding a way that many domains can share the same detections rather than writing/copying the same detections multiple times?

auto title changing to 9cf757be-9a47-42ab-88ff-e40803286937

Costumer email services and reply's as a automated email or message reply

• - How can i create a html email address or account for auto reply or costumer service section of company???

Find name