LOADING N0PERM…
Comprehensive technical manual, architectural specifications, intelligence provider mechanics, and operational procedures for N0PERM RECON v1.4.0.
N0PERM RECON is a professional, modular desktop cyber reconnaissance and open-source intelligence (OSINT) suite engineered for authorized security auditors, penetration testers, defensive engineers, and threat researchers. Built on PySide6 (Qt 6.12+ ABI) with an offline-first SQLite WAL persistence layer, the application delivers surgical digital footprinting without exposing search targets or investigation dossiers to third-party telemetry.
100% local persistence at %LOCALAPPDATA% with zero external telemetry.
Blocks RFC 1918, loopback, and cloud metadata (169.254.169.254) by policy.
Bounded concurrency with cooperative CancellationToken support.
N0PERM RECON is distributed as a self-contained, turnkey Windows executable package compiled via Inno Setup. No runtime dependencies, Python interpreters, or developer tools are required on the host system.
N0PERM-RECON-Setup.exe (58.9 MB).Get-FileHash -Algorithm SHA256 .\N0PERM-RECON-Setup.exeN0PERM-RECON-Setup.exe.%LOCALAPPDATA%\Programs\N0PERM RECON or Administrative Machine-Wide install).Upon first execution, the engine automatically initializes the SQLite database at %LOCALAPPDATA%\N0PERM_OSINT\cases.db, executes versioned migrations (001 through 004), and configures WAL journaling. Upgrading existing installations strictly preserves all saved cases and findings without data loss.
The desktop client has been calibrated for enterprise workstations and field laptops running Windows 64-bit architectures:
The Identity Intelligence workbench executes multi-platform digital footprint verification across major developer platforms, social networks, and public technical registries via asynchronous IdentityInvestigationWorker threads.
Each platform adapter performs HTTP HEAD/GET probes using realistic user-agent rotations, validates status codes, inspects response payloads for profile-absent markers, and yields one of four deterministic states:
The presence of an identical username across disparate platforms is a candidate correlation, not definitive legal proof of singular human identity. N0PERM RECON assigns low initial confidence ratings to username sightings and requires analysts to corroborate findings with secondary vectors (e.g. PGP keys, commit email addresses, or self-reported links) before marking evidence as confirmed.
The Advanced Search engine orchestrates multi-provider keyword reconnaissance across open public search engines, documentation indexes, and technical repositories through the GeneralSearchWorker.
site:, filetype:, inurl:, intitle:).utm_*, session IDs) and deduplicates results across disparate search providers in memory.Provides deep technical reconnaissance of open public software repositories, organization accounts, and commit histories via official REST endpoints.
Ideal for lightweight lookups and individual profile verification without configuring credentials.
Unlocks high-volume code search, commit history auditing, and organization-wide repository enumeration.
If configured, personal access tokens are stored strictly in the local user profile settings (%LOCALAPPDATA%\N0PERM_OSINT\config.json). Tokens are never shared, logged, or exported. The workbench tracks live X-RateLimit-Remaining and X-RateLimit-Reset HTTP response headers in real time.
Performs authoritative domain registration queries, passive subdomain discovery, and historical infrastructure analysis:
Provides comprehensive network layer intelligence for IPv4 and IPv6 addresses:
Distinguishes public internet-routable addresses from private RFC 1918 subnets, loopback, link-local, carrier-grade NAT (100.64.0.0/10), and multicast blocks.
Performs authoritative in-addr.arpa and ip6.arpa PTR record lookups to resolve canonical hostnames and CDN routing endpoints.
Identifies Autonomous System Numbers (ASN), AS Name, organization, and BGP routing prefixes via authoritative Regional Internet Registry (RIR) databases.
Provides country, region, and ISP estimates with explicit accuracy disclaimers noting that IP geolocation does not indicate exact physical coordinates.
Direct protocol validation inspecting DNS infrastructure and live cryptographic handshakes:
Queries record types: A, AAAA, CNAME, MX, NS, TXT, CAA, and SOA. Inspects DNSKEY and RRSIG records for DNSSEC cryptographic chain validation.
Establishes a direct TLS socket handshake on port 443 to retrieve Subject Common Name (CN), Issuer CA, Subject Alternative Names (SANs), validity window, expiration countdown, and SHA-256 peer certificate fingerprint.
Follows up to 5 HTTP/HTTPS redirects with per-hop SSRF validation. Evaluates OWASP defense headers: HSTS (Strict-Transport-Security), Content-Security-Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Referrer-Policy.
N0PERM RECON organizes all observations under structured case dossiers with full provenance and chain-of-custody logging:
Serializes observed entities into standard STIX 2.1 JSON bundles containing SCOs (Domain, IP, URL), SDOs (Indicator, Identity), and SROs (Relationship).
Generates publication-ready intelligence reports via ReportLab with executive summary, methodology, finding tables, provenance attribution, and legal disclaimers.
Mitigates CSV spreadsheet injection by prepending apostrophes (') to cells starting with =, +, -, or @.
Forensic local ingestion of .txt, .log, .csv, and .json documents (up to 10 MB) with SHA-256 file hashing.
Privacy is an architectural invariant of N0PERM RECON. The software adheres to strict defensive design standards:
Zero investigation targets, query terms, API tokens, or saved cases are ever transmitted to N0PERM servers or external clouds. All database operations take place strictly within the user's local SQLite database at %LOCALAPPDATA%\N0PERM_OSINT\cases.db.
The network layer resolves target hostnames and re-validates the resulting IP addresses before opening sockets. Requests targeting internal RFC 1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), carrier-grade NAT, or cloud metadata endpoints are rejected unconditionally.
Application log streams written to %LOCALAPPDATA%\N0PERM_OSINT\logs\ automatically pass through regex filters that redact bearer tokens, API keys, and sensitive authorization headers before flush.
Cause: Host DNS resolver is unreachable or target TLD is invalid.
Remedy: Navigate to Settings in N0PERM RECON and configure custom upstream DNS servers (e.g. 1.1.1.1 or 8.8.8.8).
Cause: Target domain resolves to a private IP, loopback, or cloud metadata endpoint.
Remedy: This is an intentional security guardrail. To audit internal lab environments, adjust the destination policy under Settings > Defensive Security Controls.
Cause: Exceeded the 60 requests/hour unauthenticated public quota.
Remedy: Add a free GitHub personal access token under Settings > API Credentials to raise your limit to 5,000 requests/hour.
Cause: Another instance of the application is running or holding an exclusive write lock.
Remedy: Ensure only one instance of N0PERM-RECON.exe is running via Windows Task Manager.
N0PERM-RECON-Setup.exe) with automated migration checks.N0PERM RECON is built with strict adherence to defensive security engineering. Users of the software must operate within lawful boundaries and respect all applicable computer crime and data privacy statutes (including GDPR, the Computer Fraud and Abuse Act, and local electronic crime laws).