helix-osint 3.3.0

  ██╗  ██╗███████╗██╗     ██╗██╗  ██╗
  ██║  ██║██╔════╝██║     ██║╚██╗██╔╝
  ███████║█████╗  ██║     ██║ ╚███╔╝
  ██╔══██║██╔══╝  ██║     ██║ ██╔██╗
  ██║  ██║███████╗███████╗██║██╔╝ ██╗
  ╚═╝  ╚═╝╚══════╝╚══════╝╚═╝╚═╝  ╚═╝

Why Helix?

Most OSINT tools answer one question: "Does this username exist on Platform X?"

Helix answers a harder one: "How do all these accounts connect to the same person?"

It extracts cross-platform links from bios, matches profile pictures by perceptual hash, infers timezone from commit patterns, discovers domains via certificate transparency, and plots every relationship as a glowing edge in a browser-based network graph — all in a single command.

python helix.py -u johndoe --wayback --crt --paste --pivot --phash

⚡ What Makes Helix Different

🔍 Intelligence Modules

Always On

• Local Heuristic Verifier — Zero-dependency false-positive engine. Scores every result across 8 signals (WAF pages, generic titles, login redirects, homepage redirects). Runs before anything else, every single scan.

Core Flags

Auto-Triggered

• GitHub Deep Recon — runs automatically when a GitHub profile is found. Extracts real emails from public commits (filters noreply), org memberships, language stats, npm packages, and infers timezone from commit timestamp distribution (requires ≥15 commits for confidence)

🕸 The Graph

The HTML output is a standalone zero-dependency interactive network — no server needed, just open in a browser.

White pulsing node     →  Username root
Amber pulsing node     →  Email root
Amber/orange nodes     →  Pivot-discovered aliases
Green solid edges      →  Bio-extracted cross-links (proven connections)
Pink dashed edges      →  Avatar hash matches (same person across accounts)
Amber dashed edges     →  Email-matched platforms
Green ring on node     →  High confidence (OG meta validated)
Blue ring on node      →  Medium confidence

Controls: drag nodes · scroll to zoom · click node to open profile · hover for tooltip (confidence, og:title, cross-link partners, bio-extracted alias details) · ⌕ search · ◌ not-found overlay · ☰ labels · ↓ SVG export · filter by confidence

🚀 Quick Start

git clone https://github.com/thalha-a9/helix.git
cd helix
pip install -r requirements.txt
python helix.py -u johndoe

📦 Installation

Required

pip install aiohttp

Optional — unlock more power

pip install curl-cffi        # WAF bypass for Twitter, Instagram, TikTok, Patreon
pip install imagehash Pillow # Perceptual avatar hash matching (--phash)
pip install holehe            # Deep email scanning 120+ platforms (--holehe)
pip install anthropic         # Claude AI verification (--ai claude)
pip install openai            # OpenRouter / NVIDIA AI verification (--ai openrouter)

Or install everything at once

pip install "helix-osint[full]"

Set GITHUB_TOKEN for 5000 req/hr on GitHub API (optional, default is 60/hr):

export GITHUB_TOKEN=ghp_yourtoken

💻 Usage

# Basic scan — opens interactive graph automatically
python helix.py -u johndoe

# Full power — all intelligence modules
python helix.py -u johndoe --wayback --crt --paste --pivot --phash

# Username + email — two root nodes, cross-matched in graph
python helix.py -u johndoe -e johndoe@gmail.com --breach --holehe

# Massive scan — 1100+ platforms
python helix.py -u johndoe --wmn --sherlock

# AI-verified scan (free — no API key cost)
python helix.py -u johndoe --ai openrouter

# Recursive pivot — auto-scan aliases up to 4 hops deep
python helix.py -u johndoe --pivot --pivot-depth 4

# Permutations — scan johndoe1, john.doe, realjohndoe, etc.
python helix.py -u johndoe --permutations

# Everything, saved to custom dir, no browser
python helix.py -u johndoe -e johndoe@gmail.com \
  --wmn --sherlock --wayback --crt --paste \
  --pivot --phash --breach --holehe \
  --ai openrouter --format all --no-browser --output ~/Desktop/report

# Check which AI providers are configured
python helix.py --providers

🤖 AI Verification

Helix has a two-layer false-positive filter:

Layer 1 — Local heuristic verifier (always on, zero cost) Scores every result across 8 signals. A single generic title (e.g. "Pinterest" instead of a username) instantly purges the result. WAF/Cloudflare pages scored separately at 80 points. Threshold: 60 for normal results, 85 for OG-validated high-confidence results.

Layer 2 — AI verifier (--ai, optional) Sends uncertain results to an LLM with a strict system prompt. Three providers:

🏗 Architecture

helix/
├── helix.py                         ← CLI entry point + orchestrator
├── pyproject.toml                   ← pip installable (helix-osint)
├── osint/
│   ├── checker.py                   ← Async engine (aiohttp + optional curl_cffi)
│   ├── platforms.py                 ← 70+ platform definitions with OG/API detection
│   ├── verifier.py                  ← Local heuristic false-positive engine
│   ├── graph.py                     ← D3.js relational graph generator
│   ├── report.py                    ← JSON / CSV / TXT exporters
│   ├── permutations.py              ← Username variation generator
│   ├── pivot.py                     ← Concurrent BFS alias pivot engine
│   ├── phash.py                     ← Perceptual avatar hash matcher
│   └── modules/
│       ├── wayback.py               ← Archive.org CDX API + archived HTML parser
│       ├── github_deep.py           ← GitHub API deep recon + timezone inference
│       ├── crt.py                   ← Certificate transparency (crt.sh)
│       └── paste.py                 ← Gist + Pastebin intelligence
│   └── adapters/
│       ├── sherlock_adapter.py      ← Sherlock data.json loader (24h cached)
│       ├── wmn_adapter.py           ← WhatsMyName loader
│       ├── holehe_adapter.py        ← holehe email scanner wrapper
│       ├── breach_adapter.py        ← XposedOrNot breach metadata
│       └── ai_verifier.py           ← Multi-provider async AI verification
└── results/                         ← Output (git-ignored)
    └── username/
        ├── username_graph.html      ← Interactive D3.js network graph
        ├── username_TIMESTAMP.json  ← Full structured report
        ├── username_TIMESTAMP.csv
        └── username_TIMESTAMP.txt

🔬 How False Positive Prevention Works

Helix uses the right detection method per platform instead of naive HTTP 200 checks:

📋 Output Formats

🤝 Contributing

Pull requests are welcome. For major changes open an issue first.

When adding a platform to platforms.py:

• Prefer og_meta or API endpoints over text_not_present
• Always test against a non-existent username first — if it returns found=True, your detection is wrong
• Add bio_extract: True + bio_patterns if the platform renders bio text server-side

⚠️ Legal & Ethics

Helix is built for security research, bug bounty reconnaissance, and OSINT education. All data sources used are publicly accessible. Always ensure you have proper authorization before running reconnaissance on any target. The author is not responsible for misuse.

📎 Related Projects

• esp32-iot-audit — ESP32 IoT security scanner
• esp-pentest-toolkit — Wireless ESP32/8266 pentest toolkit