Cross-tool pivots

A pivot is the act of taking a finding produced by one tool and feeding it as input to another tool. Pivots are the connective tissue that distinguishes a toolkit from a folder of utilities.

In ZeroTrace OSINT every value the toolkit knows about — IP addresses, domains, URLs, emails, usernames, hashes, phone numbers — is pivotable. Click it. The pivot menu opens. Pick the next tool. The value lands in the next tool's input field, pre-filled.

The pivot menu

Click any pivotable value in the toolkit and you see a chip with a small dropdown. The dropdown lists every other tool that takes that value type as input.

How pivots work in practice

Walk through a typical infrastructure investigation:

1. You start with a domain — example.com.
2. Run WHOIS lookup — registrar, age, nameservers, abuse contact.
3. Click the nameserver IP — pivot to ASN lookup — discovers it is hosted by a small VPS provider.
4. Click the same IP — pivot to reverse DNS — finds 14 other domains on the same IP.
5. For each of those domains, pivot to WHOIS — see if any share registrant fields.
6. Click any registrant email — pivot to password breach lookup — see if the email appears in breaches.
7. Pivot to username permutator with the email's local part — generate handle candidates.
8. Pivot to username sweep — check those handles across thirty-plus platforms.

That is eight tools in seven pivots, no copy-paste, every step pinned to the same profile with full provenance.

Pivots inside profile detail

Inside a profile, every captured value is pivotable. Click an IP entity in the Targets column and the pivot menu opens with all the IP-tool targets. The new run attaches to the same profile automatically.

This is the fastest way to deepen a profile: open the profile, click the value you want to enrich, pick a tool, run it. Repeat.

Auto-compose

Some tools compose results from other tools automatically. Examples:

• Person investigation runs username sweep, email analyzer, and breach lookup in parallel for whatever inputs you provide.
• Subdomain discovery seeds itself with results from the certificate-transparency tool, then verifies each subdomain with DNS.
• TLS inspector auto-fetches sibling hostnames from certificate-transparency logs for the leaf certificate.
• Image-metadata auto-composes a reverse-image-search builder when a photo has identifiable EXIF tags.

Auto-compose happens in the background. You see the composed results inside the same tool's output. No manual pivots required.

Pivots and the command palette

The command palette (Ctrl+K) is a kind of zero-input pivot — you do not need a value to start. Type the first letters of any tool name and the palette finds it. Open it. Paste your value. Run.

Use the palette for the first tool of an investigation. Use pivots for every tool after that.

When to pivot vs. when to use the palette

Bookmark-able pivot routes

Every pivot is a deep link. The URL of any tool page accepts a pre-fill parameter. If you want to share an exact tool-with-input link with a teammate (or open it from a saved bookmark), the URL works as expected.