klyrek-osint

Optional integrations with free, keyless public intelligence sources. Deliberately not wired into klyrek crawl's default pipeline — querying third-party services about a target (even passively) is a separate decision from crawling the target directly, so this stays an opt-in library rather than something that fires on every scan.

• certificate_transparency — query_crtsh(domain) queries crt.sh for every certificate ever issued for *.domain, returning the unique hostnames found. This is passive: it queries a public CT log, not the target's own infrastructure, so it doesn't go through klyrek-http's AuthorizationScope the way a direct request to the target would. Often finds far more subdomains than DNS brute-forcing (klyrek-assets), since it covers any subdomain that ever had a certificate issued, not just a wordlist guess.
• whois — whois_lookup(domain) is a minimal WHOIS client using the standard two-step IANA-referral pattern over a raw socket (no python-whois dependency): ask whois.iana.org which registrar server owns the TLD, then query that server directly.
• cve_lookup — search_cves(keyword) queries the public NVD REST API (no key required, just rate-limited) for known CVEs matching a technology name/version — e.g. feed it something klyrek-tech fingerprinted. cve_to_finding(record) converts a result into a klyrek_core.models.Finding so it composes with the rest of the ecosystem.

from klyrek_osint.certificate_transparency import query_crtsh
from klyrek_osint.cve_lookup import cve_to_finding, search_cves
from klyrek_osint.whois import whois_lookup

subdomains = query_crtsh("target.com")
record = whois_lookup("target.com")
findings = [cve_to_finding(c) for c in search_cves("nginx 1.18.0")]