EXO Framework

Le voile des prudes n'est si épais que parce qu'il y a beaucoup à cacher.

PRESENTATION

EXO is a modular Python framework designed to automate OSINT tasks and basic reconnaissance operations.

It provides a custom interactive CLI and a batch execution system, allowing both manual investigation workflows and fully automated recon pipelines.

EXO is built around a module system — each module targets a specific data source, technique or platform. Modules are classified by type and ID:

0XXX : core modules
1XXX : recon
- 17XX : databases
- 15XX : vulns
2XXX : RESERVED
3XXX : person
4XXX : company
5XXX : geoint
6XXX : transport
7XXX : files
8XXX : crypto
9XXX : misc

Modules can either be run manually through the interactive EXO CLI, or automated through the Batch functionality — making EXO suitable for both ad-hoc investigations and scheduled recon workflows.

EXO is divided into two distinct parts:

Core : The engine of the framework — handles the CLI, loaders, handlers and configuration
Modules : The available recon modules, each targeting a specific data source or technique

CURRENT MODULES

Category	Intels	Modules
Recon	Servers, domains, urls, azure tenants, buckets	20
Social	SOCMINT	9
Company	Companies, employees, jurisdictions	7
Crypto	Wallets, transactions	5
Files	Metadatas, hashes, web apparitions	5
Geo	Coordinates, addresses, cell towers	5
Misc	Data formatting	4
Transports	Flight & ships track	2
Collectors	Scrapers	2
Total modules		59

QUICKSTART

Quick domain bureauveritas.com recon with 4 modules :

STARTING EXO

(.venv) lo@notlobi:~/Projects/EXO_Framework$ python exo.py 
[INFO] AVAILABLE TOKENS : 11
[INFO] AVAILABLE PROXIES : 1
[INFO] AVAILABLE USER_AGENTS : 1
[INFO] AVAILABLE SESSIONS : 7
[INFO] AVAILABLE MODULES : 59
[SUCC] LOADED USER-AGENT (Random) : Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Edg/125.0.2535.51
[SUCC] LOADED PROXY (Random) : socks5h://127.0.0.1:9050

// Initiating EXO_Framework //

// EX0 > unset PROXY 
[SUCC] Removed global option : PROXY
// EX0 > set save true
[SUCC] Global option SAVE : True
// EX0 > set domain bureauveritas.com
[SUCC] Global option DOMAIN : bureauveritas.com

SUBDOMAIN SCAN

// EX0 > load recon.rec_mod_virustotal_subdomains 
[SUCC] Module loaded: VirusTotal Subdomains
[INFO] Description: Query VirusTotal API to gather top subdomains
[INFO] ID: 1003
// EX0 [VirusTotalSubdomain] > run
[INFO] Running VirusTotal Subdomains...
[INFO] - date : 2026-05-01
[INFO] - type : domains
[INFO] - data :
[INFO]     [1] :
[INFO]         - subdomain_name : sorbylims-pr.bureauveritas.com
[INFO]         - subdomain_ip_address : 54.170.154.241
[INFO]     [2] :
[INFO]         - subdomain_name : sorbylims-pr.bureauveritas.com
[INFO]         - subdomain_ip_address : 54.247.177.218
......
[INFO]     [121] :
[INFO]         - subdomain_name : informesmamb.bureauveritas.com
[INFO]         - subdomain_ip_address : 3.138.222.151
[INFO] - Saved to: results/virustotal_subdomains_bureauveritas.com_c32f7f0b-91ff-41f5-9b03-6440bac8efc6.json

121 subdomains

SERVER SCAN WITH SHODAN

// EX0 [VirusTotalSubdomain] > load recon.rec_mod_shodan_info_domain 
[SUCC] Module loaded: Domain Scanner - Shodan
[INFO] Description: Query Shodan API to gather intels about the given domain
[INFO] ID: 1007
// EX0 [ScanDomainShodan] > run
......
[INFO]     [135] :
[INFO]         - domains :
[INFO]             [1] : bureauveritas.com
[INFO]             [2] : amazonaws.com
[INFO]         - hostnames :
[INFO]             [1] : praxis.bureauveritas.com
[INFO]             [2] : ec2-54-229-71-178.eu-west-1.compute.amazonaws.com
[INFO]         - http_host : 54.229.71.178
[INFO]         - http_location : /
[INFO]         - http_redirects :
[INFO]         - http_robots : None
[INFO]         - http_server : nginx
[INFO]         - http_status : 200
[INFO]         - http_title : Praxis IHM
[INFO]         - http_waf : AWS Elastic Load Balancer (Amazon)
[INFO]         - ip : 54.229.71.178
[INFO]         - isp : Amazon.com, Inc.
[INFO]         - location :
[INFO]             - city : Dublin
[INFO]             - region_code : L
[INFO]             - area_code : None
[INFO]             - longitude : -6.24889
[INFO]             - latitude : 53.33306
[INFO]             - country_code : IE
[INFO]             - country_name : Ireland
[INFO]         - os : None
[INFO]         - port : 443
[INFO]         - product : nginx
[INFO]         - subject : None
[INFO]         - data : HTTP/1.1 200 OK
Date: Fri, 03 Apr 2026 00:30:32 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: AWSALB=5jL6hicrzeaJVXh7pqSAzZ1nqSta10RcCtkJkO6CtFZA9pRFtfx+e+ePThDKq4zwmlCSDGgLkPmy+DlAehX/c0Te3aEyR5+mdJtnB7x8Z1V4pCvbzXSZrpExWiyI; Expires=Fri, 10 Apr 2026 00:30:32 GMT; Path=/
Set-Cookie: AWSALBCORS=5jL6hicrzeaJVXh7pqSAzZ1nqSta10RcCtkJkO6CtFZA9pRFtfx+e+ePThDKq4zwmlCSDGgLkPmy+DlAehX/c0Te3aEyR5+mdJtnB7x8Z1V4pCvbzXSZrpExWiyI; Expires=Fri, 10 Apr 2026 00:30:32 GMT; Path=/; SameSite=None; Secure
Server: nginx
Strict-Transport-Security: max-age=15768000; includeSubDomains
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src 'self' https://*.bureauveritas.com https://bv-maintenance.s3-eu-west-1.amazonaws.com/Praxis/*/maintenance.json; connect-src blob: https://*.bureauveritas.com https://*.veristar.com https://*.amazonaws.com https://bv-maintenance.s3-eu-west-1.amazonaws.com/Praxis/*/maintenance.json; img-src 'self' data: blob: https:; style-src 'self' https://*.bureauveritas.com 'unsafe-inline' ; script-src 'strict-dynamic' 'self' https://*.bureauveritas.com https://*.amazonaws.com 'nonce-b1012073b3ee557c8fc95d03cae2be8a' ; font-src https://fonts.gstatic.com https://*.bureauveritas.com 'self' data: ; worker-src 'self' blob: ; object-src 'none' ; base-uri 'self' ; style-src-attr 'unsafe-inline'; frame-ancestors 'self' https://*.bureauveritas.com


[INFO] - Saved to: results/shodan_info_domain_bureauveritas.com_69e89ae8-e150-48f9-baa0-8ce2813bcb73.json

135 servers scanned

BUCKET SEARCH

// EX0 [ScanDomainShodan] > load recon.rec_mod_bucket_search 
[SUCC] Module loaded: Buckets Search
[INFO] Description: Query GrayHatWarfare API to search buckets linked to a keyword
[INFO] ID: 1702
// EX0 [BucketSearch] > set KEYWORD bureauveritas.com
[SUCC] Option KEYWORD : bureauveritas.com
// EX0 [BucketSearch] > run
[INFO] Running Buckets Search...
[INFO] - date : 2026-05-01
[INFO] - type : files
[INFO] - data :
[INFO]     - query :
[INFO]         - keywords : bureauveritas com
[INFO]         - regexp : False
[INFO]         - noautocorrect : False
[INFO]         - buckets :
[INFO]         - excludedBuckets :
[INFO]         - extensions :
[INFO]         - stopExtensions :
[INFO]         - fullPath : False
[INFO]         - lastModifiedFrom : None
[INFO]         - lastModifiedTo : None
[INFO]         - sizeFrom : None
[INFO]         - sizeTo : None
[INFO]         - order : 
[INFO]         - direction : 
[INFO]         - limit : 1000
[INFO]         - pagingMode : offset
[INFO]         - start : 0
[INFO]         - searchAfter : None
[INFO]         - scrollId : None
[INFO]     - meta :
[INFO]         - results : 2
[INFO]     - files :
[INFO]         [1] :
[INFO]             - id : 296788489
[INFO]             - bucket : mqcdn.blob.core.windows.net
[INFO]             - bucketId : 12032
[INFO]             - filename : cl_bureauveritas.com.png
[INFO]             - fullPath : cdn/companyLogos/cl_bureauveritas.com.png
[INFO]             - url : https://mqcdn.blob.core.windows.net/cdn/companyLogos/cl_bureauveritas.com.png
[INFO]             - size : 99820
[INFO]             - type : azure
[INFO]             - lastModified : 1754933941
[INFO]             - container : cdn
[INFO]         [2] :
[INFO]             - id : 2015737081
[INFO]             - bucket : ydccdn.blob.core.windows.net
[INFO]             - bucketId : 69793
[INFO]             - filename : bureauveritas.com.ico
[INFO]             - fullPath : img/bureauveritas.com.ico
[INFO]             - url : https://ydccdn.blob.core.windows.net/img/bureauveritas.com.ico
[INFO]             - size : 33310
[INFO]             - type : azure
[INFO]             - lastModified : 1635293532
[INFO]             - container : img
[INFO] - Saved to: results/bucket_search_4266ec89-c11f-45f0-9396-e888e3703435.json

2 bucket links

EMPLOYEES DATA

// EX0 [BucketSearch] > load company.com_mod_domain_scraper_hunter 
[SUCC] Module loaded: Domain scraper - Hunter
[INFO] Description: Query HunterIO API and try to gather found emails, persons, social medias, used technologies and more, linked to a domain
[INFO] ID: 4003
// EX0 [DomainScraperHunter] > run
[INFO] Running Domain scraper - Hunter...
[INFO] - date : 2026-05-01
[INFO] - type : social
[INFO] - data :
[INFO]     - data :
[INFO]         - domain : bureauveritas.com
[INFO]         - disposable : False
[INFO]         - webmail : False
[INFO]         - accept_all : True
[INFO]         - pattern : {first}.{last}
[INFO]         - organization : Bureau Veritas
[INFO]         - linked_domains :
[INFO]         - emails :
[INFO]             [1] :
[INFO]                 - value : richard.pinto@bureauveritas.com
[INFO]                 - type : personal
[INFO]                 - confidence : 94
[INFO]                 - sources :
[INFO]                     [1] :
[INFO]                         - domain : linkedin.com
[INFO]                         - uri : https://www.google.com/search?q=site:linkedin.com%20richard%20pinto%20bureauveritas
[INFO]                         - extracted_on : 2025-02-27
[INFO]                         - last_seen_on : 2026-03-27
[INFO]                         - still_on_page : True
[INFO]                 - first_name : Richard
[INFO]                 - last_name : Pinto
[INFO]                 - position : Sales Executive
[INFO]                 - position_raw : sales & marketng executive
[INFO]                 - seniority : executive
[INFO]                 - department : sales
[INFO]                 - linkedin : https://www.linkedin.com/in/richard-pinto-2966ab22
[INFO]                 - twitter : None
[INFO]                 - phone_number : None
[INFO]                 - verification :
[INFO]                     - date : 2026-04-10
[INFO]                     - status : accept_all
......
[INFO]             [10] :
[INFO]                 - value : antonio.caro@bureauveritas.com
[INFO]                 - type : personal
[INFO]                 - confidence : 94
[INFO]                 - sources :
[INFO]                     [1] :
[INFO]                         - domain : linkedin.com
[INFO]                         - uri : https://www.google.com/search?q=site:linkedin.com%20antonio%20caro%20bureauveritas
[INFO]                         - extracted_on : 2025-01-14
[INFO]                         - last_seen_on : 2026-04-09
[INFO]                         - still_on_page : True
[INFO]                 - first_name : Antonio
[INFO]                 - last_name : Caro
[INFO]                 - position : Chief Analyst
[INFO]                 - position_raw : Chief Analyst
[INFO]                 - seniority : None
[INFO]                 - department : executive
[INFO]                 - linkedin : https://www.linkedin.com/in/antonio-dominguez-caro-8aa5b61a5
[INFO]                 - twitter : None
[INFO]                 - phone_number : None
[INFO]                 - verification :
[INFO]                     - date : 2026-04-30
[INFO]                     - status : accept_all
[INFO]     - meta :
[INFO]         - results : 2422
[INFO]         - limit : 10
[INFO]         - offset : 0
[INFO]         - params :
[INFO]             - domain : bureauveritas.com
[INFO]             - company : None
[INFO]             - type : None
[INFO]             - seniority : None
[INFO]             - department : None
[INFO] - Saved to: results/hunter_domain_scraper_bureauveritas.com_b014577c-664d-47fc-80ec-67f00b51ac10.json

10 employees contacts and roles

By manually executing 4 modules, we gathered :

121 subdomains
135 scanned servers
2 bucket links
10 employees contacts and roles

BATCH

Now let's automate this, by creating a batch :

(.venv) lo@notlobilaptop:~/Projects/EXO_Framework$ cat batches/custom_batch.json

{
    "_comment": "comment: batches can be used to periodically run modules, or to create complex analysis workflows",
    "_filter": "comment: for clarity, batches logs will always start with the flag '[BATCH] -'",
    "modules": [
        {
            "mod_name": "recon.rec_mod_virustotal_subdomains",
            "mod_options": {
                "domain": "bureauveritas.com",
                "token_virustotal": "7847exxxxxxxxxxxxxxxxxxxx",
                "max_subdomains": 40,
                "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0",
                "proxy": "",
                "save": true
            }
        },
        {
            "mod_name": "recon.rec_mod_shodan_info_domain",
            "mod_options": {
                "domain": "bureauveritas.com",
                "token_shodan": "zLGxxxxxxxxxxxxxxx",
                "save": true
            }
        },
        {
            "mod_name": "recon.rec_mod_bucket_search",
            "mod_options": {
                "keyword": "bureauveritas.com",
                "token_grayhatwarfare": "7ds3Axxxxxxxxxxxxxxx",
                "user-agent": "OWL-Agent/1.0",
                "proxy": "",
                "save": true
            }
        },
        {
            "mod_name": "company.com_mod_domain_scaper_hunter",
            "mod_options": {
                "domain": "bureauveritas.com",
                "token_hunter.io": "174xxxxxxxxxxxxxxxxxxxxxxxx",
                "user-agent": "OWL-Agent/1.0",
                "proxy": "",
                "save": true
            }
        }
    ]
}

Running the batch :

python exo.py -b batches/custom_batch.json -s /data/reports

All the generated reports will be transferred to the /data/reports directory

DATA VISUALIZATION

Raw JSON reports are good, but being able to interact with their content is better.

(.venv) lo@notlobi:~/Projects/EXO_Framework$ python json_visualizer.py 
Dash is running on http://127.0.0.1:8050/

 * Serving Flask app 'json_visualizer'
 * Debug mode: off
WARNING: This is a development server. Do not use it in a production deployment. Use a production WSGI server instead.
 * Running on http://127.0.0.1:8050

You now have a web dashboard, with a fully interactive node graph (with different available layouts) and a world map where geo markers automatically extracted from report coordinates are marked

SETUP

Install the EX0_Framework :

git clone https://github.com/NotLoBi/EXO_Framework

Quick install & setup for those who do not want to read all of that:

Requirements:

cd EXO_Framework
python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt

# Facultative, but used by Sherlock and web scrapers
playwright install-deps

API keys setup:

# Edit core/tokens.yml
vim core/tokens.yml

Proxies setup (facultative, defaut to socks5h://127.0.0.1:9050)

# Note that socks proxies might break some modules (bot protections)
vim core/proxies.yml

No proxy:
```
proxies:
- url: 
    - ""
```

Tokens setup:

mv core/tokens-template.yml core/tokens.yml

# Configure your tokens
vim core/tokens.yml

Run the framework:
```
python exo.py
```

Commands:

Default CLI Commands
====================
help  history  macro  shell  shortcuts

Environment and CLI Configuration Commands
==========================================
initiate  save  set  show  unset

Modules Commands
================
back  load  loot  modules  run

Terminal Commands
=================
exit  quit

REQUIREMENTS

Create a Python virtual environment (recommended:)

cd EXO_Framework
python3 -m venv .venv
source .venv/bin/activate

Install Python requirements:

pip install -r requirements.txt

Install Playwright:

IMPORTANT : Playwright installation is facultative, as it is used for search-engine scrapers and for the 'Sherlock' module.

playwright install-deps

Playwright might not work on your computer/server, depending on its architecture. Please refer to Playwright documentation.

CORE SETTINGS

Full core settings documentation: 0_Core_Configuration.md

All core settings are available at: core/<repo>

Please note that the following core scripts should NOT be edited:

core/handlers/*.py
core/loaders/*.py
core/scrapers/*.py
core/cli.py

API Keys:

EXO modules will mainly use free API tools to gather intels.

A lot of modules will query online platforms using APIs that will require tokens.

EXO will try to load one random token per platform from the list at launch.

To set your tokens :

Replace the template :

mv core/tokens-template.yml core/tokens.yml

Tokens can be configured (add/edit/remove) at : core/tokens.yml

To add one or multiple tokens, add one or multiple lines in the YML file for the desired platform, following this format :

tokens:
    - "token-XXXXXXX1"
    - "token-XXXXXXX2"

Realistic example :

api_keys:
    - provider: hunter.io
      tokens: 
        - my-token
        
    - provider: mxtoolbox
      tokens:
        - XXXXXXX-token-1-XXXXXXX
        - XXXXXXX-token-2-XXXXXXX

User-Agents:

EXO by-default already integrates user-agents.

To avoid rate-limits and stay stealthy, EXO will try to load one random user-agent from the list at launch.

To set user-agents:

Edit core/user_agents.yml
To add one or multiple user-agents, add one or multiple lines in the YML file, following this format :

user_agents:
  - name: 
    - "Mozilla/5.0 (Windows NT 10.0; WOW64)"
  - name: 
    - "My Custom User Agent"

Proxies:

IMPORTANT: Please note that using socks5(h) proxies can lead to failures. Please refer to 0_Core_Configuration.md for advanced configuration.

Default proxy is set to socks5://127.0.0.1:9050

You can use proxies to avoid censorship, stay stealthy or query onion sites.

EXO will try to load one random proxy from the list at launch.

To set proxies:

Edit core/proxies.yml
Simply add a line to the file, following this format :

proxies:
  - url: 
    - "socks5://127.0.0.1:9050"
    - "http://my.super.proxy:9123"  -> Add your proxy here

No proxy:

proxies:
  - url: 
    - ""

Dorks:

EXO by-default already integrates dorks.

As EXO already integrates dorks, please refer to 0_Core_Configuration.md for advanced configuration.

USAGE

EXO integrates two usage methods :

CLI: The standard method, full interaction with the Framework
Batches: Used to execute one or multiple modules without direct interaction with the CLI - 1_Batches.md

CLI

Initiate the CLI:

python exo.py

Overview:

When initiating, EXO will read its configuration and user variables

[INFO] AVAILABLE TOKENS : 11
[INFO] AVAILABLE PROXIES : 1
[INFO] AVAILABLE USER_AGENTS : 1
[INFO] AVAILABLE SESSIONS : 7
[INFO] AVAILABLE MODULES : 59
[SUCC] LOADED USER-AGENT (Random) : Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Vivaldi/6.7.3329.35
[SUCC] LOADED PROXY (Random) : socks5h://127.0.0.1:9050

// Initiating EXO_Framework //

// EX0 >

Commands:

While using the CLI, the help command will show the list of available commands :

Default CLI Commands
====================
help  history  macro  shell  shortcuts

Environment and CLI Configuration Commands
==========================================
initiate  save  set  show  unset

Modules Commands
================
back  load  loot  modules  run

Terminal Commands
=================
exit  quit

Usage example:

Show current loaded vars

// EX0 > show
[INFO] TOKEN_HUNTER.IO : 076axxxxxxxxxxxxxx
[INFO] PROXY : socks5h://127.0.0.1:9050
[INFO] USER-AGENT : Mozilla/5.0 (...)

Show all modules

// EX0 > modules
[INFO] COMPANY:
[DATA]   - company.com_mod_company_person_info
[DATA]   - (...)
[INFO] CORE:
[DATA]   - core.clear_scraper_collector
[DATA]   - (...)
[INFO] CRYPTO:
[DATA]   - crypto.cry_mod_btc_wallet_balance_lookup
[DATA]   - (...)
[INFO] FILES:
[DATA]   - files.files_mod_docx_meta
[DATA]   - (...)
[INFO] GEO:
[DATA]   - geo.geo_mod_address
[DATA]   - (...)
[INFO] MISC:
[DATA]   - misc.misc_mod_json_union
[DATA]   - (...)
[INFO] RECON:
[DATA]   - recon.rec_mod_azure_realm
[DATA]   - (...)
[INFO] SOCIAL:
[DATA]   - social.soc_mod_database_leaklookup
[DATA]   - (...)
[INFO] TRANSPORT:
[DATA]   - transport.tra_mod_flight_track
[DATA]   - (...)

Load 'rec_mod_azure_realm' module

// EX0 > load recon.rec_mod_azure_realm 
[SUCC] Module loaded: Azure Realm
[INFO] Description: Search for information about an Azure Realm from a domain.
[INFO] ID: 1014

Show module option

// EX0 [AzureRealm] > show options 
[INFO] Options for module Azure Realm

Name              Required  Description                             Value                    
─────────────────────────────────────────────────────────────────────────────────────────────
DOMAIN            yes       The target domain to query              None                     

USER-AGENT        no        User-agent used for query               Mozilla/5.0 (...)

PROXY             no        Proxy used for query                    socks5h://127.0.0.1:9050 

SAVE              no        Save results to JSON                    False

Set the target DOMAIN and run the module

// EX0 [AzureRealm] > set DOMAIN microsoft.com
[SUCC] Option DOMAIN : microsoft.com
// EX0 [AzureRealm] > run
[INFO] Running Azure Realm...
[INFO] - NameSpaceType : Managed
[INFO] - Login : microsoft.com
[INFO] - (...)

BATCH

Overview:

Batch can be used to automate complex or repetitive recon tasks

Full batches documentation : 1_Batches.md

{
    "_comment": "comment: batches can be used to periodically run modules, or to create complex analysis workflows",
    "_filter": "comment: for clarity, batches logs will always start with the flag '[BATCH] -'",
    "modules": [
        {
            "mod_name": "recon.rec_mod_azure_realm",
            "mod_options": {
                "domain": "microsoft.com",
                "user-agent": "OWL-Agent/1.0",
                "proxy": "socks5h://127.0.0.1:9050",
                "save": true
            }
        },
        {
            "mod_name": "recon.rec_mod_virustotal_subdomains",
            "mod_options": {
                "domain": "microsoft.com",
                "token_virustotal": "7847exxxxxxxxxxxxxxxxxxxx",
                "max_subdomains": 40,
                "user-agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0",
                "proxy": "",
                "save": true
            }
        }
    ]
}

Usage

Run a batch batches/my_batch.json

python exo.py -b batches/my_batch.json

Run a batch batches/my_batch.json and copy the saved results to a directory /data/saved_reports

python exo.py -b batches/my_batch.json -s /data/saved_reports

DATA VISUALIZATION

DASH

EXO integrates a built-in data visualization dashboard, designed to load and explore JSON reports generated by EXO modules.

Install dependencies:

pip install dash dash-cytoscape plotly

Launch the dashboard:

python visualization/app.py
# → http://localhost:8050

Features :

Node graph:
- Interactive relationship graph, auto-built from any EXO JSON report
- Nodes are color-coded by data type (ip, domain, email, geo, crypto...)
- Multiple layout algorithms available: (force-directed, hierarchical, circular...)
Interactive map:
- Geo markers automatically extracted from report coordinates
JSON viewer:
- Raw report inspector, updated on node click
Import:
- Load one or multiple JSON reports via drag & drop
Add element:
- Manually add custom nodes to the graph

Supported data types:

Node colors are resolved automatically from EXO report field names :

Color	Types
🔴 `#FF0008`	`geo`, `transports`
🟠 `#FF5722`	`email`, `phones`, `social`, `certificates`
🟣 `#D102CA`	`crypto`
🔵 `#00C8FF`	`url`, `files`
🟢 `#039E94`	`ip`, `server`, `domains`
🟡 `#FFD500`	`organization`
⚫ `#8202DE`	`databases`, `vulnerabilities`

Dashboard configuration is available at: core/config/graph.json

XMIND

It is possible to export Markdown data to XMIND and create custom mindmaps

You can use a builtin misc module to export your JSON report to Markdown

Using the EXO CLI

// EX0 > load misc.misc_mod_markdown_convert 
(...)
// EX0 [MarkdownConversion] > set SOURCE results/<your_report>.json
(...)
// EX0 [MarkdownConversion] > run

The Markdown report will have the same name as the JSON report and will be available in the results directory

To export the Markdown report in XMIND:

Create a new MindMap map
File > Import > Markdown

I then recommend using the 'Logic Chart' layout: - Format > Map > Logic Chart

MODULE CREATION

EXO comes with premade modules, covering different scopes, but it might not be enough for everyone.

EXO modules are small Python classes that implement a single OSINT task (API query, scraper, parser, etc.).

Users can create their own modules to match their needs.

Full module creation documentation : 2_Module_Creation.md

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Repository files navigation

EXO Framework

PRESENTATION

CURRENT MODULES

QUICKSTART

STARTING EXO

SUBDOMAIN SCAN

SERVER SCAN WITH SHODAN

BUCKET SEARCH

EMPLOYEES DATA

BATCH

DATA VISUALIZATION

SETUP

REQUIREMENTS

CORE SETTINGS

USAGE

CLI

BATCH

DATA VISUALIZATION

DASH

XMIND

MODULE CREATION

About

Uh oh!

Contributors

Uh oh!

Languages

Name		Name	Last commit message	Last commit date
Latest commit History 2 Commits
batches		batches
core		core
manual		manual
modules		modules
results		results
.gitignore		.gitignore
LICENSE		LICENSE
README.md		README.md
exo.py		exo.py
json_visualizer.py		json_visualizer.py
requirements.txt		requirements.txt

Folders and files

Latest commit

History

Repository files navigation

EXO Framework

PRESENTATION

CURRENT MODULES

QUICKSTART

STARTING EXO

SUBDOMAIN SCAN

SERVER SCAN WITH SHODAN

BUCKET SEARCH

EMPLOYEES DATA

BATCH

DATA VISUALIZATION

SETUP

REQUIREMENTS

CORE SETTINGS

USAGE

CLI

BATCH

DATA VISUALIZATION

DASH

XMIND

MODULE CREATION

About

Topics

Resources

License

Uh oh!

Stars

Watchers

Forks

Contributors

Uh oh!

Languages