Tosint - Telegram OSINT Tool

Tosint (Telegram OSINT) is a Python tool to analyze a Telegram bot token and a target chat ID (group/channel) using Telegram Bot API.

It is designed for investigators, threat analysts, and security researchers who need quick visibility into Telegram entities used in phishing, malware logs, credential collection, and similar campaigns.

What Tosint Extracts

Bot Intelligence

• Bot identity: first name, username, user ID
• Bot capability signal: can_read_all_group_messages
• Bot profile metadata:
  • getMyDescription
  • getMyShortDescription
• Bot default privileges:
  • getMyDefaultAdministratorRights for groups
  • getMyDefaultAdministratorRights for channels
• Bot status in target chat: getChatMember (administrator, member, etc.)

Chat Intelligence

• Core metadata from getChat:
  • title, type, ID
  • username and active usernames
  • description (normalized to a single line)
  • visibility/policy flags (when available), such as:
    • visible history
    • hidden members
    • protected content
    • join-by-request
    • slow mode
    • auto-delete timer
  • linked chat ID
• Linked chat enrichment:
  • if linked_chat_id is available, Tosint performs a second getChat
• Invite links:
  • existing invite link (if exposed by Telegram)
  • exportChatInviteLink
  • createChatInviteLink
• Member count: getChatMemberCount

Admin Intelligence

From getChatAdministrators, Tosint prints each admin with:

• index (#1, #2, ...)
• first name / last name
• user ID
• username
• bot flag
• role/status (creator, administrator, ...)
• custom title (if present)
• granular admin permissions (can_*, plus is_anonymous)

Output Modes

Tosint supports both human-readable and JSON output.

• Default: formatted text output
• --json: JSON only on stdout (no text output)
• --json-file <path>: save JSON report to file
• --json --json-file <path>: JSON on stdout + JSON saved to file

Installation

1. Clone the repository:

git clone https://github.com/drego85/tosint.git
cd tosint

2. Install dependencies:

pip install -r requirements.txt

Usage

Interactive mode

python3 tosint.py

CLI mode

python3 tosint.py -t <TELEGRAM_BOT_TOKEN> -c <TELEGRAM_CHAT_ID>

JSON only (stdout)

python3 tosint.py -t <TELEGRAM_BOT_TOKEN> -c <TELEGRAM_CHAT_ID> --json

Save JSON report to file

python3 tosint.py -t <TELEGRAM_BOT_TOKEN> -c <TELEGRAM_CHAT_ID> --json-file /tmp/tosint_report.json

Options

• -t, --token: Telegram bot token (with or without bot prefix)
• -c, --chat_id: Telegram chat ID (e.g. -100... for channels/supergroups)
• --json: print JSON report only
• --json-file: save JSON report to chosen path

Example Text Output (obfuscated)

Analysis of token: 81XXXXXX66:AAF... and chat id: -1003XXXX075

[BOT]
Bot First Name: Example Bot
Bot Username: example_bot
Bot User ID: 81XXXXXX66
Bot Can Read Group Messages: false
Bot Short Description: @example_channel
Bot Default Administrator Rights (groups): {"can_manage_chat": false, ...}
Bot Default Administrator Rights (channels): {"can_manage_chat": false, ...}
Bot In The Chat Is An: administrator

[CHAT]
Chat Title: Example Channel
Chat Type: channel
Chat ID: -1003XXXX075
Chat Username: example_channel
Chat Active Usernames: ["example_channel"]
Chat Description: Example single-line description.
Chat Has Visible History: true
Invite Links:
  Chat Invite Link: https://t.me/+XXXXXXXXXXXX
  Chat Invite Link (exported): https://t.me/+YYYYYYYYYYYY
  Chat Invite Link (created): https://t.me/+ZZZZZZZZZZZZ
Number of users in the chat: 339

[ADMINS]
Administrators in the chat:
- #1
  First Name: Example
  Last Name: Admin
  User ID: 20XXXX39
  Username: ExampleAdmin
  Is Bot: false
  Status: administrator
  Permissions: {"can_manage_chat": true, "can_delete_messages": true, ...}

Example JSON Report (structure)

{
  "input": {
    "token": "81XXXXXX66:AAF...",
    "chat_id": "-1003XXXX075"
  },
  "bot": {
    "first_name": "Example Bot",
    "username": "example_bot",
    "user_id": 8100000000,
    "can_read_all_group_messages": false,
    "short_description": "@example_channel",
    "default_admin_rights_groups": {},
    "default_admin_rights_channels": {},
    "status_in_chat": "administrator"
  },
  "chat": {
    "id": -1003000000075,
    "title": "Example Channel",
    "type": "channel",
    "member_count": 339
  },
  "invite_links": {
    "chat_invite_link": "https://t.me/+XXXXXXXXXXXX",
    "exported": "https://t.me/+YYYYYYYYYYYY",
    "created": "https://t.me/+ZZZZZZZZZZZZ"
  },
  "admins": [
    {
      "index": 1,
      "first_name": "Example",
      "last_name": "Admin",
      "user_id": 20000039,
      "username": "ExampleAdmin",
      "is_bot": false,
      "status": "administrator",
      "custom_title": null,
      "permissions": {
        "can_manage_chat": true
      }
    }
  ],
  "errors": []
}

Operational Notes

• Some fields are returned by Telegram only when the bot has enough visibility/permissions.
• Invite-link methods are active operations (exportChatInviteLink, createChatInviteLink) and may fail based on bot role.

Contributing and Supporting the Project

There are three ways you can contribute to the development of Tosint:

1. Development Contributions:

   Please ensure that your code follows best practices and includes relevant tests.

2. Donation Support: If you find this project useful and would like to support its development, you can also make a donation via Buy Me a Coffee. Your support is greatly appreciated and helps to keep this project going!

   

3. Share the Project: Sharing Tosint with colleagues, friends, and anyone interested in OSINT helps the project grow and reach more practitioners in the community.

License

This project is licensed under the GNU General Public License v3.0.