Modern messaging platforms prioritize end-to-end encryption to protect message contents and call audio. However, the transport layer often behaves differently during direct voice or video connections. The open-source project chat-apps-osint is a Python-based utility designed to capture peer metadata generated during calls across services like WhatsApp, Signal, and Telegram.

Rather than attempting to break cryptographic protocols, the tool focuses on network-level observations. When messaging applications establish direct media streams between endpoints, network artifacts such as peer IP addresses and transport metadata can become visible at the local interface. This project offers a specialized approach for network analysts and security researchers studying how chat applications handle direct connections versus relayed traffic.

Key capabilities

Based on the project's repository and operational scope, the tool concentrates on a few distinct functions:

  • Cross-platform chat targeting: Designed to capture call metadata across major encrypted messaging ecosystems, explicitly noting WhatsApp, Signal, and Telegram.
  • Peer-metadata extraction: Focuses on network endpoint data and connection attributes established during live call negotiation rather than message payload inspection.
  • Consent-focused utility: The repository explicitly restricts use cases to authorized audits and consensual testing environments.
  • Lightweight Python implementation: Built as a specialized script rather than a bulky framework, keeping the operational footprint minimal.

Under the hood

To understand how chat-apps-osint functions, one must examine how VoIP protocols operate in modern encrypted messengers. Most contemporary chat platforms rely on WebRTC, custom RTP/SRTP implementations, or proprietary signaling servers to coordinate calls. Initial call signaling almost always travels through central application servers to locate the recipient and negotiate session parameters.

Once signaling concludes, the applications attempt to establish the most efficient media path. If network address translation (NAT) traversal succeeds via STUN/TURN protocols, the applications may switch from a server-relayed connection to a direct peer-to-peer (P2P) stream. In a direct P2P state, packets travel straight between the caller and recipient to reduce latency and server load.

At this stage, network-level metadata—specifically the external IP address and port mapping of the remote peer—is transmitted across the local network interface. Written in Python, chat-apps-osint monitors packet activity and filters for the specific protocol signatures associated with these call setups. By isolating the network handshakes and STUN/TURN exchange packets, the script extracts identifiable network metadata without touching the encrypted audio or video payload.

The repository remains deliberately lean. Rather than offering a graphical interface or heavy daemon architecture, the codebase serves as an operational proof-of-concept for metadata exposure during live calling sessions.

Who it fits / Who it doesn't

The tool fits security researchers, penetration testers, and digital forensics professionals analyzing application privacy postures. If you are conducting authorized security evaluations or verifying whether an application's "always relay calls" privacy setting actually prevents IP leakage, this tool provides a targeted testing mechanism. It also serves as a practical reference for students studying network protocol analysis and VoIP mechanics.

It is not built for passive monitoring, automated enterprise compliance, or general-purpose packet analysis. Because the repository provides sparse documentation and currently holds a modest 65 stars on GitHub, users must be comfortable reading Python source code to understand its exact runtime arguments, dependencies, and packet capture requirements. Furthermore, anyone expecting an automated OSINT lookup tool or identity scraper will find this project unsuitable; it only captures active, real-time connection data during live calls.

Setup, briefly

Running chat-apps-osint requires a functional Python environment alongside administrative or root privileges to capture raw network packets from local interfaces. Because repository configuration parameters and packet capture dependencies can change, refer directly to the chat-apps-osint repository for the exact execution commands and environment prerequisites.

Network metadata in modern communication

The boundary between encrypted content and identifiable metadata remains a primary focus in communications security. While tools like Wireshark or tcpdump can capture the same underlying network traffic, chat-apps-osint strips away general packet noise to highlight the specific IP leakage risks associated with peer-to-peer call handshakes. For researchers tracking how different messengers manage peer isolation, the project offers a focused look at real-time transport exposure, and you can inspect the source directly on GitHub.