Trace Labs OSINT VM - Apple Silicon

Overview

The repository includes a recipe file to build an OSINT focused VM that runs on Apple Silicon. This is based on the great work done on the Kali Linux live-build-config (https://gitlab.com/kalilinux/build-scripts/live-build-config/-/tree/master).

Download

You can download the latest M1 compatible ISO at: https://tracelabs.org/osint-vm

Installing from ISO

You will need to select "Advanced Install Options" from the main menu then "Text Installer" then "Install"

Building the ISO on your machine

Setup

This build will need to be done on a machine with an Apple chip (M1,M2,M3). You will need to have Docker installed and running on your machine as well. This step is not necessary. You can just download the ISO file directly if you would like.

git clone https://github.com/tracelabs/Trace-Labs-VM-M1-Mac-Build.git
cd Trace-Labs-VM-M1-Build
./build-in-container.sh

If the build process is successful, a .iso file will be created in the images directory. The .iso file can be used for live boot or to install as a virtual machine using the hypervisor of your choice.

Applications

The majority of OSINT tools no longer come pre-packaged with the VM. There is an option to download them via a script on the desktop though. This keeps the size of the release small enough to build and host on Github. If you want to install the tools in the script then:

• Open a terminal
• Navigate to the Desktop folder
• Execute the install script with ./install-tools.sh

Obsidian

• Note taking app Obsidian comes bundled with the VM. There is an icon on the desktop to launch Obisidian or you can run the appimage located in the home directory. We've already set up a vault for you called "TL Vault" that lives on the Desktop. The first time you run Obsidian open that vault folder. The default theme is the Trace Labs theme.

Resources

• Trace Labs OSINT Field Manual
• Trace Labs CTF Contestant Guide

Note Taking

• Obsidian
• TJ Null's OSINT Joplin template

Browsers

• Firefox ESR

Data Analysis

• DumpsterDiver
• Exifprobe
• Stegosuite

Domains

• Domainfy (OSRFramework)
• Sublist3r

Downloaders

• Browse Mirrored Websites
• Metagoofil
• WebHTTrack Website Copier
• Youtube-DL

Email

• Checkfy (OSRFramework)
• Infoga
• Mailfy (OSRFramework)
• theHarvester
• h8mail

Frameworks

• Little Brother (Archived)
• OSRFramework
• sn0int
• Spiderfoot
• Maltego
• OnionSearch

Phone Numbers

• Phonefy (OSRFramework)
• PhoneInfoga

Social Media

• Instaloader
• Twint (Archived)
• Searchfy (OSRFramework)
• Tiktok Scraper
• Twayback
• Stweet

Usernames

• Alias Generator (OSRFramework)
• Usufy (OSRFramework)

Other Tools

• Photon
• Sherlock
• Shodan
• Joplin

Configuration Settings

Firefox

• Delete cookies/history on shutdown
• Block geo tracking
• Block mic/camera detection
• Block Firefox tracking
• Preload OSINT Bookmarks

Contributing

Are you interested in the VM development? Join us on Discord in #osint-vm channel.

PRs are welcome. We ask that you PR in to the Dev branch.