Local-first browser extension for SOC, DFIR, and CTI analysts.
Aperture detects indicators of compromise in the browser, orchestrates pivots to public OSINT sites, and keeps cases, history, and playbooks on-device. Core use requires no API keys, no accounts, and no telemetry.
| Version | 4.5.0 (Manifest V3) |
| Browsers | Firefox 140+ · Chrome / Chromium |
| Firefox Add-ons | addons.mozilla.org/…/soc-osint-extension |
| Chrome Web Store | chromewebstore.google.com/…/hpbeikjdpgemejlekddlaphdlaemjhgb |
| License | MIT |
| Formerly | SOC OSINT Search |
Dashboard triage overview (demo data for illustration)
Most OSINT “extensions” are thin wrappers around cloud APIs. Aperture is built as an investigation companion:
- Parse and classify IoCs locally
- Open public tool UIs only when you choose
- Capture work into cases and playbooks without sending data to a vendor
- Stay readable for store review and forks — no build step, no bundler, plain HTML/CSS/JS
Optional Labs features are a Coming soon roadmap and cannot be turned on yet.
- Popup launcher — open the workbench; toggle on-page detect and disable the current site
- Dashboard workbench — triage inbox, bulk extract, cases, playbooks, relationship graph, offline packs, Labs (coming soon)
- Playbooks — ordered multi-tool workflows; share codes (
APX|…); delay / concurrency / skip-private-IP options - Cases — indicators, verdicts, tags, notes, timeline, session capture, JSON / Markdown / CSV export
- On-page detect (opt-in) — highlight IoCs; anchored pivot card with verdicts, tools, clipboard packs, related IoCs; disable per domain (e.g. Splunk, CrowdStrike) from the popup or Workbench Settings
- Context menu — right-click selection → playbooks and services
- Command palette — ⌘/Ctrl+K on extension pages; Ctrl+Shift+K / Ctrl+Shift+O browser commands
- Themes — System, Dark or Light for every Aperture surface; page highlights adapt to the site you are reading
- Language — Settings → Appearance; System plus English, Spanish, Portuguese (Portugal / Brasil), French, German, Russian, Simplified and Traditional Chinese. Store name/description follow the browser language.
IPv4/IPv6, domains, URLs, emails, MD5/SHA-1/SHA-256, CVEs, BTC, ASNs, plus ETH, ATT&CK technique IDs, JA3/JARM-style labels, file paths, onion addresses, Telegram/Discord links, and additional Labs/wave-2 types.
VirusTotal, AbuseIPDB, URLScan, Shodan, Censys, AlienVault OTX, IBM X-Force Exchange, MalwareBazaar, GreyNoise, Spur, Have I Been Pwned, crt.sh, RDAP, Wayback Machine, URLhaus, ThreatFox, NVD, CWE, BGP HE, MITRE ATT&CK.
Install from Firefox Browser Add-ons, or load temporarily:
about:debugging→ This Firefox → Load Temporary Add-on- Select
extension/manifest.json
Install from the Chrome Web Store, or load unpacked:
chrome://extensions→ enable Developer mode- Load unpacked → select the
extension/folder
- Parsing and enrichment run on-device
- Network use is limited to tabs you open to public OSINT sites
- On-page highlights are off by default
- Firefox
data_collection_permissions: none - Host access (
<all_urls>) supports context-menu selection and optional page highlights
This project is intentionally zero-build so reviewers and contributors can read shipped files as-is.
Same steps as Chrome/Firefox “load unpacked / temporary add-on” above. Edit a file, reload the extension.
| Path | Purpose |
|---|---|
extension/ |
Extension runtime — load this folder as the unpacked add-on |
docs/ |
Guides, store checklists, release notes |
test/ |
Detection corpus and manual test pages |
preview/ |
README / social-preview demo dashboard (not shipped) |
design/ |
Design prototypes (not shipped) |
scripts/ |
Packaging (scripts/package.sh) |
.github/ |
Social preview asset |
| Surface | Files |
|---|---|
| Manifest | extension/manifest.json |
| Background | extension/background.js, extension/ioc-utils.js |
| Popup | extension/popup.html |
| Dashboard | extension/dashboard.html |
| On-page | extension/content.js, extension/content.css |
| Shared UI | extension/aperture.css, extension/indicator-card.js, extension/palette.js, extension/i18n.js, extension/locales/, extension/_locales/, extension/fonts/ |
| Offline packs / flags / IDB | extension/aperture-packs.js, aperture-features.js, aperture-store.js |
| DevTools (coming soon) | extension/devtools.html |
./scripts/package.sh
# or: ./package-for-firefox.sh
# → aperture-osint-v4.5.0.zip (extension runtime only)# Detection corpus
open test/test-ioc-utils.html
# In-app language catalogs (or: node test/test-i18n.js)
open test/test-i18n.html
# Manual checklist
# docs/TESTING_GUIDE.md
# Dashboard screenshot fixture (demo data)
python3 -m http.server 8765 --bind 127.0.0.1
# → http://127.0.0.1:8765/preview/dashboard-preview.htmlCommon fork points:
- New OSINT site — add URL template in
extension/background.js(serviceUrls) and map it inIOCUtils.toolsFor() - New IoC type — extend detection in
extension/ioc-utils.jsand cover it intest/test-ioc-utils.js - New playbook — create in the UI or import an
APX|…share code - Offline packs — regenerate compact ATT&CK / LOLBAS / GTFOBins indexes with
python3 scripts/generate-offline-packs.py - Labs / experimental behaviour — dashboard Labs is coming soon; do not ship no-op flags as working switches
Keep the privacy model: network only on explicit user action; keys never in storage.sync; experimental features default off.
| Version | Notes |
|---|---|
| 4.5.0 | Store _locales; Traditional Chinese; Portuguese (Portugal / Brasil) |
| 4.4.0 | In-app language settings (en, es, pt, fr, de, ru, zh-Hans) |
| 4.3.1 | Open link on domain IoCs; CWE pivot; GreyNoise/RDAP URLs; ThreatCrowd removed |
| 4.3.0 | Full offline pack indexes; Labs / STIX / case playbook / DevTools marked coming soon |
| 4.2.3 | Feedback to GitHub Discussions from Settings, overview, and the palette |
| 4.2.2 | Light theme uses IBM Plex; stronger text contrast in both themes |
| 4.2.1 | Light theme; ordered playbook editor; workbench live refresh; side panel removed |
| 4.2.0 | One shared indicator card; anchored pivot popovers; popup as launcher; playbook defaults per IoC type |
| 4.1.0 | Per-domain on-page disable; workbench/pivot UI polish |
| 4.0.3 | Full IPv6 detect, forum/code IoC highlights, dashboard favicon |
| 4.0.2 | Fix migration crash that broke pivot tool opens (normalize is not defined) |
| 4.0.1 | Popup workbench/services fixes; Open link on pivot; scheme-less URL highlights |
| 4.0.0 | Workbench expansion: cases/inbox depth, session capture, graph, offline packs, Labs, broader detection |
| 3.1.x | Detection accuracy, playbook delete, always-refang |
| 3.0.0 | Aperture rebrand, MV3, playbooks, cases, palette |
Issues and pull requests are welcome.
- Fork the repository and create a focused branch
- Prefer small, reviewable diffs that match existing vanilla JS style
- Add or extend tests in
test/test-ioc-utils.jswhen changing detection - Do not add a bundler, telemetry, or mandatory cloud dependency without discussion
If you are adapting Aperture for an organisation (MISP, OpenCTI, custom tools), keep org-specific connectors behind explicit opt-in flags.
This extension requests broad host access for optional page highlights. Treat loaded code as trusted. Report security issues privately via GitHub Security Advisories on this repository when available, or open a minimal issue without exploit detail.
MIT — © 2025–2026 Aperture / petstuk contributors.