Listen to this Post
Introduction:
Open Source Intelligence (OSINT) has evolved from manual social media searches to automated, AI‑driven platforms that map digital footprints across hundreds of services. The newly released tool deepkrak3n takes this further by offering a fully local, privacy‑preserving OSINT engine that scans over 200 platforms by username or email, builds relationship graphs, and applies machine learning for risk scoring – all without external data storage.
Learning Objectives:
- Install and configure deepkrak3n on Linux and Windows for offline OSINT investigations.
- Perform username and email enumeration across 200+ social networks, forums, and professional sites.
- Interpret AI‑generated summaries and risk analyses to assess digital exposure.
You Should Know
1. Installing deepkrak3n – Local OSINT Engine Setup
deepkrak3n is a Python‑based tool that runs entirely on your machine. Follow this step‑by‑step guide to get it operational.
Step 1 – Clone the repository
Open a terminal (Linux/macOS) or Command Prompt/PowerShell (Windows) and run:
git clone https://github.com/fchr80/deepkrak3n.git cd deepkrak3n
Step 2 – Create a virtual environment (recommended)
- Linux/macOS:
python3 -m venv venv source venv/bin/activate
- Windows:
python -m venv venv venv\Scripts\activate
Step 3 – Install dependencies
pip install -r requirements.txt
If no `requirements.txt` exists, manually install common OSINT libraries:
`pip install requests beautifulsoup4 aiohttp pandas matplotlib networkx`
Step 4 – Run the initial configuration
The tool may ask for API keys (e.g., for AI services) or create a local database. Launch the main script:
python deepkrak3n.py --init
This generates configuration files and verifies connectivity to supported platforms.
Troubleshooting Windows:
If you encounter SSL certificate errors, update `certifi` and run:
pip install --upgrade certifi
2. Username Enumeration – Scanning Across Platforms
deepkrak3n’s core function is to discover where a given username exists online. The tool uses a combination of HTTP requests, API scraping, and pattern matching.
Basic username search:
python deepkrak3n.py -u "johndoe" --output json
– `-u` specifies the username
– `–output json` saves results in structured format
Real‑time output example:
The tool returns a table with columns: Platform, URL, Status (active/inactive), Last Activity (if available), and AI‑assessed Risk Level (Low/Medium/High).
Step‑by‑step interpretation:
- The tool sends a GET request to `https://twitter.com/johndoe` (and 199+ similar endpoints).
- It analyzes HTTP response codes (200 = found, 404 = not found, 403/429 = blocked/rate‑limited).
- For platforms with public APIs (e.g., GitHub, Reddit), it parses JSON responses to extract profile metadata.
- Results are cached locally to avoid duplicate requests.
Windows command alternative:
python deepkrak3n.py -u "janedoe" --format csv
3. Email‑Based Profiling – From Address to Identity
Using an email address as the starting point, deepkrak3n performs reverse lookups and checks if that email is associated with any public profiles.
Command:
python deepkrak3n.py -e "[email protected]" --deep-scan
The `–deep-scan` flag enables search through paste sites, data breach dumps (offline only – no external exfiltration), and forum registrations.
How it works internally:
- The tool normalises the email (lowercase, remove dots if Gmail).
- It generates possible usernames from the local part (e.g.,
user,user_example). - Each generated username is run through the same 200+ platform check.
- Email‑specific services like Gravatar, Canva, and Trello are queried via their public endpoints.
Privacy note: All breach data used must be legally obtained. deepkrak3n does not phone home; you can feed it your own offline breach corpus.
Linux command to extract unique results:
cat results/email_scan.json | jq '.[] | .platform, .risk'
4. AI‑Powered Summary and Risk Analysis
deepkrak3n includes a local AI module (using a lightweight transformer model or calling a local LLM via Ollama) to generate natural language summaries and risk scores.
Generating a report:
python deepkrak3n.py -u "sec_test" --ai-summary --risk-score
The AI evaluates:
- Account consistency – Do profiles share the same bio/avatar across platforms?
- Exposure breadth – Number of active accounts and sensitive platforms (e.g., dating sites, professional networks).
- Potential PII leaks – Phone numbers, addresses, or employer info found in bios.
Example AI output:
“The username ‘sec_test’ is active on 47 platforms, including GitHub (public repos), LinkedIn (job history visible), and a gaming forum where the user disclosed their birth year. Risk score: 78/100 – High exposure. Recommendation: Limit profile visibility on LinkedIn and remove DOB from forums.”
Customising the AI model:
Edit `config/ai_settings.json` to point to a local Ollama endpoint:
{
"model": "llama3.2",
"endpoint": "http://localhost:11434",
"temperature": 0.2
}
5. Relationship Mapping – Visualising Account Connections
One of deepkrak3n’s standout features is graph‑based relationship mapping. It links accounts through shared emails, usernames, profile links, and cross‑platform interactions.
Generate a relationship graph:
python deepkrak3n.py -u "target_user" --build-graph --visualize
This creates a `graph.gml` file and opens an interactive HTML visualisation.
Step‑by‑step to interpret the graph:
1. Nodes represent platforms or individual profiles.
2. Edges represent connections:
- Email link – same email used on two platforms.
- Bio URL – a profile contains a link to another profile.
- Username similarity – algorithmic matching of handle variants.
- Centrality scores highlight the most connected profile (often the primary identity).
Export for further analysis:
python deepkrak3n.py -u "target_user" --build-graph --export csv
You can then import the CSV into Maltego or Gephi for advanced visualisation.
Windows users: If graph visualisation fails, ensure you have `graphviz` installed:
choco install graphviz or download from graphviz.org
6. Ethical Hacking and Counter‑OSINT Techniques
Understanding deepkrak3n is crucial for both reconnaissance and defence. Organisations should test their own digital footprint to reduce attack surfaces.
Defensive command – scan your own brand:
python deepkrak3n.py -u "yourcompany" --output report.html
Hardening against OSINT:
- Use different usernames across critical vs. casual platforms.
- Disable profile indexing on LinkedIn and Facebook.
- For email addresses, use aliases (e.g.,
[email protected]) to make pattern detection harder.
Automated counter‑measure script (Linux bash):
!/bin/bash Check if any employee email appears in breach data using deepkrak3n batch mode for email in $(cat employee_emails.txt); do python deepkrak3n.py -e "$email" --quick | grep -q "Found" && echo "$email exposed" done
Cloud hardening note: If deepkrak3n is run in a cloud environment (e.g., AWS EC2), ensure you use rotating IPs via proxies to avoid rate‑limiting. Configure `config/proxies.txt` with a list of SOCKS5 proxies.
7. Extending deepkrak3n – Adding Custom Platforms
The tool is modular; you can add your own platform modules.
Step 1 – Create a new module file
`modules/custom_site.py`:
from core.base import PlatformModule
class CustomSite(PlatformModule):
def check_username(self, username):
url = f"https://example.com/user/{username}"
response = self.session.get(url)
return response.status_code == 200
Step 2 – Register the module
Edit `config/platforms.json` and add:
{
"name": "ExampleSite",
"module": "custom_site",
"url_pattern": "https://example.com/user/{username}"
}
Step 3 – Test your module
python deepkrak3n.py -u "testuser" --only-platforms ExampleSite
Windows users: Use `–only-platforms` to speed up scans when testing new modules.
What Undercode Say
- Key Takeaway 1: deepkrak3n democratises advanced OSINT by packaging multi‑platform enumeration, AI risk scoring, and graph analysis into a single, local‑first tool – no cloud subscription required.
- Key Takeaway 2: The rise of AI‑augmented OSINT means digital footprints are no longer just “findable” but automatically correlated and risk‑assessed, forcing both individuals and enterprises to adopt proactive identity management.
Analysis: While deepkrak3n is marketed for educational and research purposes, its capabilities blur the line between legitimate investigation and potential stalking. The tool’s local nature reduces third‑party risk but also removes oversight – users must strictly adhere to their jurisdiction’s privacy laws. From a defensive perspective, red teams can now simulate realistic adversary OSINT in hours instead of days. We anticipate that platforms will respond with stricter rate limiting, CAPTCHA proliferation, and API changes, leading to an arms race between OSINT tool maintainers and social media anti‑scraping measures.
Prediction
Within 18 months, AI‑driven OSINT platforms like deepkrak3n will become standard components of penetration testing and incident response toolkits. However, legislative bodies (e.g., EU’s DSA, US’s proposed OSINT regulation) will likely mandate that such tools implement built‑in consent checks and anonymisation of collected data. The cat‑and‑mouse game will shift toward real‑time identity federation protocols (e.g., Solid Pods) that give users granular control over what can be discovered. Meanwhile, attackers will weaponise these tools to automate spear‑phishing target selection – making employee OSINT hygiene training as critical as patch management.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Mariosantella Osint – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
