149
PRISM - a self-hosted OSINT platform with a real-time dashboard (lemmy.world)
submitted 4 months ago by to c/selfhosted@lemmy.world
39 comments fedilink hide all child comments
 

I've been building PRISM - a self-hosted OSINT toolkit you run yourself instead of pasting investigation targets into someone else's web service.

Give it a domain, IP, email, phone, or username and it runs 22+ modules in parallel into one dashboard: WHOIS, DNS, crt.sh subdomains, GeoIP, threat intel (Shodan/VirusTotal/AbuseIPDB/Censys), breach data, username search across 3000+ sites (Blackbird + Maigret), dark-web mirror checks, and more. Results come with an entity graph, a GeoIP map, an OPSEC exposure score (0–100), and HTML/PDF/CSV/Markdown exports.

14 of the 22 modules work with zero API keys (missing keys degrade gracefully instead of erroring).

Stack: FastAPI + Next.js 14, runs with one docker compose up. MIT licensed.

Demo: https://getprism.su/ Github: https://github.com/NovaCode37/Prism-platform

Built it solo - feedback welcome, especially on which modules you'd want added.

all 40 comments

sorted by: hot top controversial new old
[–] 54 points 4 months ago (4 children)

Tried it. ANY given username generates a list of the same sites (e.g. instagram, reddit, imgur, etc) and simply slaps the given username to the base url and gives that as a "result" even if the user doesn't exist on that platform. Even the "AI Analysis" is simply a report of nonexistent platforms and users. You can achieve better results by simply using a bash script.

🤣 3
  • permalink
  • fedilink
  • source
  • hideshow 4 child comments
    •
    • [–] 27 points 4 months ago

    Your targets never leave your PC

    how can that be true if the whole thing relies on sending the infos to the API providers?

  • permalink
  • fedilink
  • source
    •
    [–] 43 points 4 months ago (5 children)

    Did the LLM choose the name? There’s an obvious existing semantic link between PRISM and intel, so congrats on choosing an un-searchable name.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
    • [–] 43 points 4 months ago (3 children)

    Full of AI fingerprints yet no disclosure.

  • permalink
  • fedilink
  • source
  • hideshow 3 child comments
    •
  • [–] [S] -4 points 4 months ago (2 children)

    Yep, I'm a solo dev and I use AI assistance while building this. So, I should've been upfront about it. The code's all reviewed, tested, and MIT-licensed, so it's fully auditable. I'll add a disclosure to the README

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 49 points 4 months ago (1 child)

    So you vibecoded a security product and named it after a famous government program known for spying unlawfully on American citizens

    To what, capitalize on the SEO?

    This is kinda gross dude, not gonna lie

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 14 points 4 months ago

    Soviet Union TLD is an interesting choice lol

  • permalink
  • fedilink
  • source
    •
    [–] 13 points 4 months ago (2 children)

    That's pretty darn cool:

  • permalink
  • fedilink
  • source
  • hideshow 2 child comments
    •
  • [–] [S] 10 points 4 months ago (1 child)

    Hiya, love that you actually tested it. That's exactly the kind of 30-second recon it's built for. The "missing security headers" check catches a surprising number of sites.

    If there's a module or source you'd want added, I'm genuinely taking requests that's how the roadmap gets shaped. Thanks for trying it!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 12 points 4 months ago

    Terrible name. It's taken.

  • permalink
  • fedilink
  • source
    •
    [–] 4 points 4 months ago (1 child)

    WHOIS exposes 2 contact email(s) — registrar privacy not used

    Registrar privacy is in fact used. It's just the Namecheap abuse email address and an anonymized *@withheldforprivacy.com mail address. It shouldn't list those as results.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] 7 points 4 months ago* (last edited 4 months ago)

    Great name indeed.

    Stack: FastAPI + Next.js 14, runs with one docker compose up. MIT licensed.

    Isn't this what every chatbot builds with by default?

  • permalink
  • fedilink
  • source
    •
    [–] 3 points 4 months ago (8 children)

    So I have an interest in self hosting things in the future (nextcloud, chatmail), but for now I'm scared of opening my network to attacks, and also I don't have a network right now I just hotspot from my phone when needed and torrent things at my friend's house.

    That said how would I go about using this? I'm guessing something to do with docker or porteus (maybe? The other one that wasn't vulnerable to that recent thing), then when I want to check out X website I just "spin up the docker container" (still not 100% what that means but I've heard the verbiage), hotspot the pc (for now), and run it through the program? Am I understanding that right?

    Sorry I'm so green, gotta start somewhere! I feel like a grandma calling an Xbox a "Nintendo" haha.

  • permalink
  • fedilink
  • source
  • hideshow 8 child comments
    •
  • [–] 3 points 4 months ago (5 children)

    Sorry I’m so green, gotta start somewhere!

    We all started at green. No shame.

    So, yes OP is using Docker. Once you install Docker on your server, you 'spin up' the docker container using the Docker compose file:

    https://github.com/NovaCode37/Prism-platform/blob/main/docker-compose.yml

    ....and the associated .env file that houses all your environmental variables:

    https://github.com/NovaCode37/Prism-platform/blob/main/.env.example

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 4 months ago (4 children)

    Awesome, thank you for the help/info! This seems like a good first step, I'll try it out!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 4 months ago (3 children)

    Give it a go man. What's the worst that can happen? .....you have to drop back and do some studyin'. That's pretty much how I learn. Read, Do, Fuck it up ad nauseam until it clicks, then I write that shit down.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 3 points 4 months ago (2 children)

    Same here lol, I will for sure!

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 4 months ago (1 child)

    Putting yourself into the position of trying to solve a practical problem is the best way to learn.

    If you fail completely, you can always restore your system and try again (you have a backup, right?)

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 2 points 4 months ago

    Yes, but I'd still prefer not to have to spend the like ~2h reinstalling and replacing my files.

    That said this seems like a pretty low stakes trial which is why I'm looking at it first. Worst case a reboot (or recovery through live booting) should fix most issues, I think, if I understand correctly. I don't plan to autostart the docker container so if it fucks my system up a reboot should put me back to normal if starting it breaks my sys right?

    I do have some old laptops and an unopened router waiting for me to figure out openWRT. I could install some linux OS (deb?) on one of those and use that for docker, get off my ass and install openWRT on the router, and then use that to connect both devices (and I'd have to figure out which to hotspot but that is easy), if that'd be significantly safer for my daily driver. Then I'd have to figure out how to point my browser to that too though.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 4 months ago (1 child)

    Yeah, this project is built as a docker container. The repo has instructions on starting the container. You should watch a few introductory videos on Docker so you understand the concepts and basic usage.

    Once it's started, the machine that docker is running on will be serving a website that acts as the application. If you're running docker on your desktop you can then open a web browser and go to http://localhost:8080/ and you will see something that looks like the demo link above.

    This doesn't expose it to the Internet. If you're running this on a home LAN with a router between you and the ISP's modem (or the ISP's modem is a router/AP) then only computers connected to your network will be able to access it. You would have to go to your router's administration console and specifically forward a port for that service so that people on the Internet could get past your modem.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 3 points 4 months ago*

    NSA is that you?

    Also jokes aside, how does the use case compare to some existing tools like BBOT?

    This seems morr geared towards public facing targets than targeted information OSINT (user profiling, etc.)

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 4 months ago (1 child)

    This looks really cool. One minor bug: with the online demo, at least on mobile (chrome, iOS), the target text field never brings up the keyboard so it can’t be used.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
    • [–] [B] 1 point 4 months ago* (last edited 4 months ago)

    Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

    Fewer Letters More Letters
    AP WiFi Access Point
    DNS Domain Name Service/System
    ISP Internet Service Provider

    [Thread #21 for this comm, first seen 20th Jun 2026, 21:30] [FAQ] [Full list] [Contact] [Source code]

  • permalink
  • fedilink
  • source
    •
    [–] 1 point 4 months ago

    Super cool, I'm gonna host it when I have some time !

  • permalink
  • fedilink
  • source
    •
    [–] 0 points 4 months ago* (1 child)

    Some mailchecks would be useful. DNS and the server responses.

    Edit: Oops, just found it, different section. Valid DKIM check would be handy. Also, I'm not sure what "Deliverable" is about, comes up as "No" for a domain I use for email with no issues.

  • permalink
  • fedilink
  • source
  • hideshow 1 child comment
    •
  • [–] [S] 1 point 4 months ago

    Thanks, gotcha. I figured marking those cases as inconclusive makes a lot more sense than treating them as failures. It should cut down on false alarms from catch-all and greylisted servers while still keeping the results reliable. Since I'm already checking MX, SPF, and DMARC, I should have enough confidence without being overly aggressive

  • permalink
  • fedilink
  • source
  • parent