<div align="center">

CTI Expert

Cyber Threat Intelligence & OSINT Analysis Toolkit

Transform Claude into a trained intelligence analyst — 120+ commands, 57 techniques, zero API keys required for core functionality.

<br> <p> <a href="#installation">Installation</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#demo">View Demo</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#quick-start">Quick Start</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#command-reference">Commands</a>&nbsp;&nbsp;|&nbsp;&nbsp;<a href="#contributing">Contribute</a> </p> <br> <!-- Feature Badges --> <p> <a href="https://github.com/7onez/cti-expert"><img src="https://img.shields.io/badge/version-2.11-0080ff?style=for-the-badge&logo=semver&logoColor=white" alt="Version 2.11"></a>&nbsp; <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-00c853?style=for-the-badge&logo=opensourceinitiative&logoColor=white" alt="License: MIT"></a>&nbsp; <a href="#command-reference"><img src="https://img.shields.io/badge/commands-120+-ff6d00?style=for-the-badge&logo=windowsterminal&logoColor=white" alt="120+ Commands"></a>&nbsp; <a href="#technique-catalog"><img src="https://img.shields.io/badge/techniques-57-aa00ff?style=for-the-badge&logo=hackthebox&logoColor=white" alt="57 Techniques"></a>&nbsp; <a href="#installation"><img src="https://img.shields.io/badge/API_keys-none_for_core-00bfa5?style=for-the-badge&logo=shield&logoColor=white" alt="No API Keys for Core"></a> </p> <!-- GitHub Stats --> <p> <a href="https://github.com/7onez/cti-expert/stargazers"><img src="https://img.shields.io/github/stars/7onez/cti-expert?style=flat-square&logo=github&label=Stars" alt="Stars"></a>&nbsp; <a href="https://github.com/7onez/cti-expert/network/members"><img src="https://img.shields.io/github/forks/7onez/cti-expert?style=flat-square&logo=github&label=Forks" alt="Forks"></a>&nbsp; <a href="https://github.com/7onez/cti-expert/releases"><img src="https://img.shields.io/github/downloads/7onez/cti-expert/total?style=flat-square&logo=github&label=Downloads&color=brightgreen" alt="Downloads"></a>&nbsp; <a href="https://github.com/7onez/cti-expert/issues"><img src="https://img.shields.io/github/issues/7onez/cti-expert?style=flat-square&logo=github&label=Issues" alt="Issues"></a>&nbsp; <a href="https://github.com/7onez/cti-expert/pulls"><img src="https://img.shields.io/github/issues-pr/7onez/cti-expert?style=flat-square&logo=github&label=PRs" alt="Pull Requests"></a>&nbsp; <a href="https://github.com/7onez/cti-expert/commits"><img src="https://img.shields.io/github/last-commit/7onez/cti-expert?style=flat-square&logo=github&label=Last%20Commit" alt="Last Commit"></a>&nbsp; <a href="https://github.com/7onez/cti-expert"><img src="https://img.shields.io/github/repo-size/7onez/cti-expert?style=flat-square&logo=github&label=Size" alt="Repo Size"></a>&nbsp; <a href="https://github.com/7onez/cti-expert/graphs/contributors"><img src="https://img.shields.io/github/contributors/7onez/cti-expert?style=flat-square&logo=github&label=Contributors" alt="Contributors"></a> </p> <!-- Language Selector --> <p> 🇬🇧 <a href="README.md"><b>English</b></a>&nbsp;&nbsp;·&nbsp;&nbsp;🇻🇳 <a href="README.vi.md">Tiếng Việt</a>&nbsp;&nbsp;·&nbsp;&nbsp;🇨🇳 <a href="README.zh-CN.md">中文</a> </p> <br>

_{Built by <a href="https://www.linkedin.com/in/hieu-minh-ngo-hieupc/"><b>Hieu Ngo</b></a> • <a href="mailto:hieu.ngo@chongluadao.vn">hieu.ngo@chongluadao.vn</a> • <a href="https://chongluadao.vn">chongluadao.vn</a>} <br> _{Core contributor • <a href="https://github.com/Zeroska"><b>Zeroska</b></a> • <a href="mailto:khuong.nguyen@chongluadao.vn">khuong.nguyen@chongluadao.vn</a>}

</div> <br>

---

<br>

🤝 Sponsors & Supporters

<div align="center">

CTI Expert is built in the open. These organisations back the work — with data, tooling, and hard-won investigative tradecraft.

</div>

| Supporter | What they bring | In the toolkit | |-----------|-----------------|----------------| | Rexxfield | Cybercrime investigation and victim-side casework since 2008 — the real-world tradecraft the case workflow and attribution standards are modelled on | Tradecraft & methodology | | ChongLuaDao ⭐ | First-party — the project's home org. Premium VN threat intel: ~20M-URL denylist verdicts, deep AI URL analysis, IoC + data-leak/breach exposure, brand lookalikes and CVE/KEV feeds — your client talks only to CLD, which fetches the target server-side (never your egress) | /cld · /scam-check · /threat-check · /breach-deep | | Hudson Rock | Infostealer-infection intelligence — which machines leaked which credentials, and when | /breach-deep · /stealer-log | | ParanoidLab | Dark-web, Initial-Access-Broker and infostealer-log monitoring across forums, markets and private Telegram | Dark-web collection & review | | ANY.RUN | Interactive malware sandbox + TI Lookup — sandbox-observed C2 and real endpoints from packed samples | /binary · /hash-id | | ZETAlytics | Global passive DNS with rare geographic diversity — historical resolution and co-tenancy pivots | /webpivot · /cti-pivot | | IntelX | Intelligence X — paste sites, leaks, darknet and phonebook selector search | /webpivot · /email-deep | | Shodan | Internet-connected host & service intelligence — open ports, banners, tags and known CVEs, passive-first via InternetDB | /webpivot · /appliance-scan · /cert-pivot | | Censys | Internet-wide host & certificate scanning — the server-side view; every host on an exact leaf certificate (works on the free plan) | /censys · /cert-pivot | | URLScan.io | Passive website scanning — what a page served and who it talked to, captured without touching the target | /webpivot · /impersonate | | SerpApi | Search-engine + Google Ads Transparency results API — who paid to send traffic, plus multi-engine dork results | /serp · /search-pivot | | GrayHatWarfare | Open cloud-bucket & exposed-file search (S3/Azure/GCS/Spaces) — graded exposure, not a same-operator pivot | /secrets · /docleak | | Social Links | OSINT investigation platform — 1000+ methods across social media, blockchain and the dark web (SL Professional / Crimewall, Maltego transforms) | OSINT methodology & data | | Validin | DNS + certificates + favicon + response-body hashes in one graph — passive DNS, subdomain enumeration, reverse-IP and host-response hash pivots on a free community key | Native in /webpivot (domain lookup, reputation, cert & favicon hosts) · MO-neighbour source · /cti-pivot | | Netlas | Independent internet-asset index — DNS, scan responses, WHOIS and certificate collections behind one key; domains a:<origin-ip> reverses a non-CDN origin to every apex with dates | /webpivot MO-neighbour source · intel.py netlas · entitlement probe |

[!IMPORTANT] ANY.RUN lookups are read-only; detonation is gated. anyrun_lookup queries TI Lookup for hashes that have already been detonated. anyrun_submit can detonate a file or URL, but only behind a per-submission analyst confirmation (a briefing-then-confirm=true two-step), private-by-default privacy with public refused, a fail-closed plan check (the account's own /user private quota — zero is denied outright — else a prior private task, else an explicit analyst attestation to a paid plan), a post-submit privacy read-back that withdraws and flags a task that still landed public, and a harness deny unless HARNESS_ALLOW_SUBMIT=1. A public sandbox task is world-readable and irreversible; the gate is enforced by a regression test (tests/test_no_sample_submission.py), not just by convention.

_{Listing here reflects support for the project and does <b>not</b> imply affiliation, endorsement, or any verification of this tool by the organisations named. Integrations marked above are optional and key-gated — <b>every core technique still runs with zero API keys</b>. Always respect each provider's terms of service. The full list of open-source projects and free public-interest services this skill depends on is in <a href="#-acknowledgments--credits">Acknowledgments & Credits</a>.}

<br>

---

<br>

What is CTI Expert?

A Claude Code skill that transforms Claude into a trained cyber threat intelligence and open-source intelligence analyst. It runs structured intelligence collection using 120+ commands across 57 techniques — no API keys required for core functionality. To take full advantage, add your own free or paid API keys to the skill's .env — each is auto-detected and unlocks higher-tier access (e.g., Wigle, VirusTotal, URLScan.io, Shodan, Censys, SecurityTrails, WhoisXML).

[!TIP] Keyless by default, more powerful with your keys. Every core technique runs with zero API keys. Add any free or paid keys to .env (or run /apikeys set <service> <KEY>) and the skill auto-detects them, unlocking higher-tier pivots: reverse favicon→host, passive DNS, certificate search, sibling-domain discovery. A missing or bad key never breaks a run — it just degrades to a note. Setup guide: handbook/api-keys.md.

[!TIP] One skill, two layers. cti-expert is the broad collector — the wide net (/sweep, /webpivot, /subdomain, /username, /email-deep…). Built into the repo is a deep pipeline (intel_engine/) that turns raw collection into a real case: a persistent knowledge base, versioned cases, cross-case correlation, and calibrated assessment. The flow reads like a sentence — collect broadly → "seen this operator before?" → cluster → filter false positives → assess. No external setup: the backend resolves to SELF, and as of v2.9 the bundled installer (scripts/install.{sh,ps1}) provisions the deep layer automatically (or by hand: uv venv && uv pip install -r requirements.txt). Architecture: connectors/intel-backend.md.

<table> <tr> <td width="50%">

Core Capability

Multi-vector reconnaissance on any target type — person, domain, organization, username, email, IP, WiFi — with automated finding validation, exposure scoring, and structured intelligence delivery.

</td> <td width="50%">

AEAD Workflow

Acquire raw data → Enrich with pivot expansion → Assess findings → Deliver structured reports — the base bundle (Markdown + JSON + CSV + IOC bundle) always saves, then you pick a presentation report: PDF, DOCX, HTML, or all.

</td> </tr> </table> <br>

---

<br>

Demo

Full Case Investigation

<div align="center"> <img src="assets/demo-full-case.gif" alt="Full Case Demo — /case command running a complete investigation" width="800"> </div> <br>

CTI Report Generation

<div align="center"> <img src="assets/demo-cti-report.gif" alt="CTI Report Demo — Markdown + DOCX report output" width="800"> </div> <br>

Screenshots

<div align="center">

| INTSUM Report | Network Topology | Risk Assessment | |:---:|:---:|:---:| | <img src="assets/intsum.png" alt="INTSUM Report" width="280"> | <img src="assets/network-topology.png" alt="Network Topology Diagram" width="280"> | <img src="assets/risk-assessment.png" alt="Risk Assessment Score" width="280"> |

</div> <br>

---

<br>

What's New in v2.12

The release where the premium keys start pulling their weight — and the report writes itself. v2.11 shipped detectors. v2.12 turns an eight-finding audit of the paid vendors into behaviour (e