OZZI: IOC Search

About

Gives a popup that will allow you to search via a single input either IP address, file HASH, URL, or port number across multiple free use OSINT platforms. It opens the results as new tabs in the background.

=======
Usage
=======

Highlight an IOC on a webpage, right-click, select "Search OZZI for '<highlighted text>'.
* Select Preferred Sites to search your chosen OSINT sites
* Select All Sites to search all OSINT sites
* Select IP,IPV6,HASH,URL,PORT to search a specific site for that type of IOC

--OR--

1. Launch extension - click icon or keyboard shortcut: Ctrl + Shift + F
2. Type or paste the IOC:
     a. IP address (IPv4 or IPv6)
     b. File HASH (MD5, SHA1, or SHA256)
     c. URL (including defanged URLs)
     d. Port Number
3. Hit Enter or click Search
4. The extension should launch relevant OSINT sources in background tabs, depending on your input type. 

=======
Setup
=======
You now have the option to select the OSINT sites you would like to search for each IOC type.
NOTE: You will have to select OSINT sites you want to use before the extension will start giving you results. 

1. Launch the extension and click the gear icon next to the search button.
2. Check the OSINT sites you would like to use.
3. You can also select which theme you would like to use for the extension.
4. Hit save at the bottom when done selecting. You should get a message that your settings have been saved. 

=======
Credit
=======
Icon/Logo
Created by Anna Bączkowska

OSINT Sources - IP
============
VirusTotal - IPv4 ONLY
Scamalytics
AbuseIPDB
IBM X-Force
ISC SANS
Cisco Talos
AlienVault
ARIN
Shodan - IPv4 ONLY
Threatminer - IPv4 ONLY
Pulsedive

OSINT Sources - HASH
==============
VirusTotal
Hybrid Analysis
IBM X-Force
Cisco Talos - SHA256 ONLY
AlienVault
Threatminer
URLHaus - MD5 and SHA256 ONLY

OSINT Sources - URL
==============
VirusTotal
Norton SafeWeb
Sucuri
IBM X-Force
Cisco Talos
AlienVault
Shodan
URLHaus
Pulsedive

OSINT Sources - PORT
==============
Speedguide
IANA
ISC SANS