OSINT WhatsApp Intelligence

What it is

WhatsApp-OSINT, a Python CLI from GitHub user kinghacker0, wrapped around RapidAPI's "WhatsApp OSINT API." Feed it a phone number in international format and it queries six endpoints for publicly exposed WhatsApp metadata. Hackers-Arise walks the install on Kali and demonstrates each menu option against a live number.

How it works

The tool is a front-end to a paid third-party API — it does no querying of WhatsApp itself, so results are only as good as the RapidAPI provider. Menu option 1 takes the number; other options pull profile image (business only), custom status, business verification, connected-device count, "full OSINT," and privacy (public/private).

What to do

Install and run:

git clone https://github.com/kinghacker0/WhatsApp-OSINT
cd WhatsApp-OSINT
python3 -m venv myvenv
source myvenv/bin/activate
pip3 install -r requirements.txt
cp .env.example .env

Then subscribe to the API at https://rapidapi.com/inutil-inutil-default/api/whatsapp-osint, put the dashboard key into .env (replacing your_api_key_here), and launch:

python3 whatsapp-osint.py

The Basic tier gives a limited number of free requests/month — enough for testing.

What you actually get

Concrete signal the summary flags as "metadata" but the page pins down:

• Business verification returns the verified/company name plus the tooling tier — smb means the free Small/Medium Business app; if they're on the WhatsApp Business Platform it reports API operation instead.
• Device info returns a count of devices linked to the account.
• Privacy returns only a public/private flag.
• Status returns the custom status string or "No custom status."

Caveats

Two endpoints underdeliver in the author's own testing:

• The profile image query errors out for non-business accounts ("images are only available for business accounts").
• The "full OSINT" option returned nothing but "API maintenance" messages during testing — treat it as non-functional for now.

Because everything routes through one RapidAPI provider, endpoint reliability and the maintenance failures are outside your control; verify each endpoint still returns data before relying on it in an investigation.