The release of the Snoop 1.4.2 project has been published, developing a forensic OSINT tool that searches for user accounts in public data (open source intelligence). The program analyzes various websites, forums, and social networks for the presence of a specified username, enabling identification of sites housing the user with the indicated nick. The project is based on research work in the field of public data scraping. Builds have been prepared for Linux and Windows.
The code is written in Python and is distributed under a license that restricts its use to personal purposes only. The project is a branch of the Sherlock project codebase, which is provided under the MIT license (the fork was created due to the inability to expand the website database).
Snoop has been included in the Russian Unified Register of Russian Programs for Electronic Computers and Databases with the declared code 26.30.11.16: "Software that ensures the performance of established actions during operational search activities:: No7012 order 07.10.2020 No515". Currently, Snoop tracks the presence of users across 4752 internet resources in the full version and on the most popular resources in the Demo version.
Key Changes:
- The search database has been expanded to 4752 sites.
- The calculation of the "bad_raw" value during the search for multiple "username" entries from the CLI or when launched with the ‘—userlist/-u’ option has been corrected.
- In the Windows version, optimization of working with HTTP libraries has been conducted, which in some cases accelerated searches by 20-25%.
- The efficiency of repeated requests during unsuccessful connection attempts has been improved.
- The algorithm for speeding up searches on weak single-core and powerful multi-core systems with GNU/Linux has been optimized. Limits on CPU resource utilization during manual search overclocking have been modified: for GNU/Linux and Android/Termux — the threshold has been raised, for Windows — the threshold has been lowered. VPS The software operation in ‘—save-page/-S’ mode (searching and saving local HTML pages) has been accelerated.
- Safe release of resources has been sped up during interruptions on systems with GNU/Linux and Android/Termux (interrupting via Ctrl+c now takes less than 1 second).
- In the Android/Termux version, a notification about disk unavailability has been added along with a prompt to automatically fix the access error to the directory “/storage/emulated/0/snoop/*” (if the user missed certain steps when installing from the source code).
- The lower threshold for triggering Bad_raw alerts has been changed from 2.5% to 2%.
- The lower threshold for triggering Bad_raw alerts has been changed from 2.5% to 2%.
- A "floating" bad_zone parameter has been added to CLI and CSV reports, indicating locations where connection errors are most frequent.
- The text report has improved column formatting, reversed the data for "Address | Resource," and added a "Geo" parameter. The HTML report has enhanced visualization for country breakdowns. In the CSV report, the "username" column has been replaced with the string "Nick," and a tracking parameter for sites with the status: "stuck" has been added.
- The functions for cache deletion, software updates, and database checks have been looped. In case of an incorrect choice/typo, instead of exiting the program, it prompts for re-entry with a hint.
- CLI now includes an alert and recommendation on how to fix/improve the utility's performance if a user compiled Snoop from source but did not follow the instructions noted in the documentation (for instance, if deprecated HTTP-library versions and Python are being used).
- In the 'snoop info' block, the 'Recommended pool' section, and the option '--version/-v', calculations for system resource requirements for the software's normal operation have been added.
- Aggressive repository compression has been performed. A complete backup of the history has been preserved. Users updating Snoop from the source code must re-run 'git clone'.
Source: opennet.ru
