Toolbox
What's on the desk.Honest notes, not a matrix.
An AI doesn't have a workflow. We do — and we argue about which tool to reach for. Every entry says where it wins and when to skip it.
The tool follows the question
A registry lookup and a reverse-image search answer different things. The desk picks by what needs proving, not by what is open in a tab.
Every tool has a failure mode
Each entry below says when to skip it. That line matters more than the verdict — it is where most wasted hours live.
Nothing here is bundled
These are external instruments we reach for, listed because they are useful. The console is where their findings end up.
The instruments, one by one.
Ordered by how often they come off the shelf. The verdict is ours; the limits are the tool's.
01
Maltego / graph stackRelationship mapping
Keep for court-ready entity graphs — ugly but defensible.
- Reach for it when
- Multi-hop pivots (email → domain → WHOIS → nameserver).
- Skip when
- One-shot email checks — overkill and slow.
02
Hudson Rock (via BreachHub)Infostealer & session intel
First stop for domain or login exposure in stealer logs.
- Reach for it when
- Corporate domain assessments, compromised session hunting.
- Skip when
- When you need live social graph — it won't give you that.
03
holehe / recovery flowsAccount existence & partials
Noisy alone. Gold when you manually filter false positives.
- Reach for it when
- Building a sock-puppet map from one email seed.
- Skip when
- Publishing results without verification — recovery hints lie.
04
SunCalc + map tilesVisual GEOINT
Beats any 'AI geolocate this' button if you do the math.
- Reach for it when
- Shadows, roof angles, solar panel orientation in photos.
- Skip when
- Indoor scenes or night shots without fixed light sources.
05
Inquire consoleParallel module orchestration
We built it because chaining 12 tabs breaks OPSEC and focus.
- Reach for it when
- Structured output per identifier type with audit trail.
- Skip when
- Replacing human judgment on ambiguous hits.
06
Telegram OSINT bots (generic)Quick lookups
Fine for triage. We don't trust them for client deliverables.
- Reach for it when
- Personal recon, time-boxed sanity checks.
- Skip when
- Anything that needs chain-of-custody or reproducible methodology.
The desk is where the tools stop and the case starts.
Every finding still needs a source, a timestamp and a place in the same thread.