<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# OSINT Collection — API Reference

## DNS Tools

```bash
# dig queries
dig example.com A +short
dig example.com MX +short
dig example.com NS +short
dig example.com TXT +short
dig example.com ANY +noall +answer
dig -x 8.8.8.8 +short  # Reverse DNS

# DNS zone transfer attempt
dig axfr @ns1.example.com example.com

# DNSRecon
dnsrecon -d example.com -t std
dnsrecon -d example.com -t brt -D subdomains.txt

# Subfinder
subfinder -d example.com -silent
subfinder -d example.com -o subdomains.txt

# Amass passive
amass enum -passive -d example.com
```

## Certificate Transparency

```bash
# crt.sh API
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sort -u

# certspotter
curl -s "https://api.certspotter.com/v1/issuances?domain=example.com&include_subdomains=true" | jq '.[].dns_names[]'
```

## WHOIS

```bash
# Standard WHOIS
whois example.com
whois 8.8.8.8

# RDAP (modern WHOIS replacement)
curl -s "https://rdap.org/domain/example.com" | jq '.entities[].vcardArray'
```

## Shodan API

```python
import shodan

api = shodan.Shodan('YOUR_API_KEY')

# Host lookup
host = api.host('8.8.8.8')
print(host['ports'], host['vulns'])

# Search
results = api.search('apache port:443 country:US')
for result in results['matches']:
    print(result['ip_str'], result['port'])

# DNS resolve
dns = api.dns.resolve(['example.com'])

# Exploits search
exploits = api.exploits.search('apache 2.4')
```

```bash
# Shodan CLI
shodan host 8.8.8.8
shodan search "apache country:US" --limit 10
shodan count "port:22 country:US"
shodan domain example.com
```

## VirusTotal API

```bash
# Domain report
curl -s "https://www.virustotal.com/api/v3/domains/example.com" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes.last_dns_records'

# IP report
curl -s "https://www.virustotal.com/api/v3/ip_addresses/8.8.8.8" \
  -H "x-apikey: $VT_API_KEY" | jq '.data.attributes'
```

## Python Libraries

```python
# dnspython
import dns.resolver
answers = dns.resolver.resolve('example.com', 'A')

# python-whois
import whois
w = whois.whois('example.com')
print(w.registrar, w.creation_date)

# requests for APIs
import requests
resp = requests.get('https://crt.sh/?q=%.example.com&output=json')
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | Collection completed successfully |
| 1 | Partial results (some sources failed) |
| 2 | Collection failed or target not found |
