Severity: Medium
Evidence:
README.md:128-130 says entity extraction finds domains.
CORE_ENGINE.md:586 documents the expected shape as "domains": ["example.com"].
scripts/osint.py:257-259 uses a repeated capturing group in re.findall(). With findall(), Python returns the captured group rather than the full match, so only the final repeated label fragment is returned.
Deterministic reproduction:
python3 - <<'PY'
import sys
sys.path.insert(0, 'scripts')
import osint
samples = [
'alice@example.com',
'visit https://sub.example.co.uk/path',
'plain example.com domain',
'ip 8.8.8.8 and host test.org',
]
for sample in samples:
print(sample, '=>', osint.extract_entities(sample)['domains'])
PY
Actual output:
alice@example.com => ['example.']
visit https://sub.example.co.uk/path => ['co.']
plain example.com domain => ['example.']
ip 8.8.8.8 and host test.org => ['test.']
Impact:
IOC extraction produces malformed domains, so downstream reports, STIX/MISP exports, deduplication, and investigator triage can be wrong or incomplete.
Smallest credible fix:
- Use
re.finditer() and match.group(0) or make all inner groups non-capturing.
- Strip URL schemes and paths deliberately after matching.
- Add unit tests for plain domains, URLs with paths, subdomains, email addresses, and IP addresses.
Severity: Medium
Evidence:
README.md:128-130says entity extraction finds domains.CORE_ENGINE.md:586documents the expected shape as"domains": ["example.com"].scripts/osint.py:257-259uses a repeated capturing group inre.findall(). Withfindall(), Python returns the captured group rather than the full match, so only the final repeated label fragment is returned.Deterministic reproduction:
Actual output:
Impact:
IOC extraction produces malformed domains, so downstream reports, STIX/MISP exports, deduplication, and investigator triage can be wrong or incomplete.
Smallest credible fix:
re.finditer()andmatch.group(0)or make all inner groups non-capturing.