M

MABU_

authenticate to continue

no admin account exists yet. run python setup.py on the server first.

M
MABU_ root@mabu:~$ research-platform
core
lookup modules
admin
checking api...
--:--:--
MABU v3.0 :: CASE MGMT + CORRELATION

$ overview_

100% LOCAL // ZERO EXTERNAL CALLS

> welcome.txt

MABU is a personal, locally-hosted OSINT research platform for organizing publicly available digital footprint data. Email checks, Discord snowflake analysis, username enumeration, network/IP tooling, hash & encoding utilities, case timelines, and encrypted vault storage — all running on your own machine.

[!] NOTICE: All data stays on 127.0.0.1. Nothing is transmitted externally. Only document information you have lawful, legitimate access to.

> vault --stats

– .mabu files
– unique tags
– tracked IDs

> quick_actions

> module_manifest.log

  • [research] structured OSINT documentation form → encrypted .mabu vault entry
  • [vault] browse / search all encrypted case files
  • [reader] decrypt & render .mabu files, export JSON
  • [timeline] chronological case view + shared-identifier relationship graph
  • [email] format validation, domain classification, manual platform tracker
  • [username] cross-platform handle tracker, permutation generator, direct-check links
  • [discord] snowflake → timestamp decoder, account-age calc, bit-layout reference
  • [network/ip] IPv4/IPv6 classification, CIDR calculator, port reference table
  • [hash & encode] MD5/SHA1/SHA256, Base64, URL encode, JWT decoder

> email --analyze

valid_format–
local_part–
domain–
domain_type–
mx_resolves–
disposable_heuristic–

> platform_tracker.db

Log platforms manually confirmed via the platform's own signup/reset check. No automated third-party querying.

platformstatus

> username --target

Generates direct search-URLs per platform (opens manually, no auto-querying) and tracks confirmed/unconfirmed status locally.

platformlinkstatus

> permutation_engine

Generates common username variants for a first/last name or base handle — useful for building a search list.


            

> observed_handles.log

Manually-confirmed usernames/handles tied to this investigation, with source.

usernamesource

> snowflake --decode

timestamp_utc–
object_age–
worker_id–
process_id–
increment–
unix_ms–

> snowflake_structure.h

64-bit integer encoding a timestamp + internal identifiers, relative to Discord Epoch (2015-01-01T00:00:00.000Z).

Bit layout (64 bits total):

 63                                22 21    17 16    12 11         0
| timestamp (42 bits, ms since epoch) | worker | process | increment |

DISCORD_EPOCH = 1420070400000  // unix ms

timestamp  = (snowflake >> 22) + DISCORD_EPOCH
worker_id  = (snowflake & 0x3E0000) >> 17
process_id = (snowflake & 0x1F000)  >> 12
increment  =  snowflake & 0xFFF

> ip --classify

version–
valid–
scope–
binary–
hex–
reverse_dns_ptr–

> cidr --calc

network_address–
broadcast_address–
subnet_mask–
usable_hosts–
first_host–
last_host–

> ports.ref

Common port reference table (educational).

portprotocolservice

> hash --generate

MD5–
SHA-1–
SHA-256–
SHA-512–

> base64 / url --codec

> jwt --decode

header


              

payload


              

> case --new

Document only publicly available information you have lawful access to. Creates a new case (with this as its first entry) in the local vault. Add more entries to the same case later from the Vault tab.

[!] possible matchthis identifier appears in existing case(s)

> vault --list

titlestatusentriesupdatedinvestigatortags

> case_detail:

add new entry

> correlate --scan

Scans every decryptable case in the vault and auto-links cases sharing an email, username, IP, phone, or name. Clusters below represent likely-same-person groups.

> correlation_graph.svg

> whois --lookup

> dns --lookup

> handle --check-live

Sends a real HTTP request to each platform's own profile URL (same as visiting it in a browser) to check whether the page exists. No third-party aggregators are queried.

platformurllikely existsdetail

> phone --lookup

Local parsing via libphonenumber — no external API. Region/carrier data comes from bundled offline databases.

> breach --check

checking configuration...

> image --metadata

Extracts EXIF data (camera info, timestamps, embedded GPS coordinates) from an image file, entirely locally — nothing is uploaded anywhere else.

> reader --decrypt

> stdout

nothing decrypted yet.

> timeline --render

Chronological view of all vault entries (decryptable with the default key). Passphrase-protected files appear locked and are excluded from the relationship graph.

> relationship_graph.svg

Cases are linked when they share an email, username, IP, or name. Hover a node for details.

> users --list

usernameroleactivecreated

> audit_log.jsonl

timeactoractiondetail