Skip to content

OSINT.md

Latest commit

 

History

History
306 lines (271 loc) · 11.1 KB

OSINT.md

File metadata and controls

306 lines (271 loc) · 11.1 KB
Raw

OSINT

Notes from the The Cyber Mentor OSINT course.

https://academy.tcm-sec.com/p/osint-fundamentals

Content:

Search Engine Operators

Reverse Image Searching

Identifying Geographical Locations

Discovering Email Addresses

Hunting Breached Credentials

Hunting Usernames and Accounts

Searching for People

Voter Records

Hunting Phone Numbers

Discovering Birthdates

  • Search in google:
  • "Name" intext:"birthday"
  • "Name" intext:"happy birthday" site:facebook.com

Searching for Resumes

Search in google:

  • "Name" site:linkedin.com
  • "Name" resume filetype:pdf
  • "Name" resume filetype:doc
  • "Name" resume site:dropbox.com
  • "Name" resume site:google.com
  • "Name" resume site:drive.google.com
  • "Name" resume site:scribd.com

Twitter

Facebook

  • Sowdust Github
  • IntelligenceX Facebook Search
  • In Facebook search: photos of Mark Zuckerberg - it shows photo he post and the one people tagged him
  • search for user ID in FB - View page source and search (ctrl+f) "userID" - this is needed for IntelligenceX Facebook Search

Instagram

Snapchat

Reddit

  • reddit.com/u/username
  • In Reddit search: username
  • In Reddit search: "username"
  • Use sort by
  • Analyze user's profile - check comment section there might be some sensitive information
  • In Google: "username" site:reddit.com
  • In Google: "username" site:reddit.com intext:searchedphrase

LinkedIn

  • Contact information
  • Location
  • LION - open networkers - to create a connection for fake account - A LION is a LinkedIn Open Networker – instead of connecting only with people you know, as LinkedIn recommends, LIONs connect with everybody. They'll always accept an invitation. Some even put "LION" after their name.

TIKTOK

  • Check image for reverse image
  • Search for historical data

Website

  • In Google: site:example.com name
  • BuiltWith - what the website is built in (frameworks, widgets etc)
  • Domain Dossier - checkbox service scan (passive recon)
  • DNSlytics - search for all domains which use the IP address
  • SpyOnWeb - search for IP, domain, analytics (UA)
  • Virus Total - you can find UA in the datils - Google Tag Manager
  • Visual Ping - how the website change over a time
  • Back Link Watch - looking for backlinks if the link to the website was posted somewhere else
  • View DNS
  • reddit.com/domain/example.com
  • In Google: site:example.com -www inrul:admin
  • Pentest-Tools Subdomain Finder
  • Spyse
  • crt.sh - search: %.example.com
  • Shodan
  • In Shodan: ciy:atlanta port:3389 org:choopa
  • Wayback Machine
  • In Google: search for website, click on 3 dots next to address and pick cached if the website is not available right now.
  • Wikimapia - s an online editable map - you can describe any place on Earth.

Hunting Business Information

  • Search for badge, desk, dresscode, apps on LinkedIn
  • When in LinkedIn the user's name is not visible, you can copy the user's title and do google search to find the person.
  • In Google: site:linkedin.com/in/ "* at Company Name" - search for people form a particular company
  • Open Corporates
  • AI HIT
  • Indeed - job posting

Wireless

Building an OSINT Lab

Tools

  • ExifTool
sudo apt install libimage-exiftool-perl
exiftool <img>

theHarvester -d tesla.com -b google -l 500
./breach-parse.sh @tesla.com tesla.txt
  • H8mail An email OSINT and breach hunting tool using different breach and reconnaissance services, or local breaches such as Troy Hunt's "Collection1" and the infamous "Breach Compilation" torrent.
h8mail -t shark@tesla.com -bc "/opt/breach-parse/BreachCompilation/" -sk
  • Whatsmyname
whatsmyname -u thecybermentor
  • Sherlock
sherlock thecybermentor

phoneinfoga scan -n 14082492815
phoneinfoga serve -p 8080

pip3 install --upgrade -e git+https://github.com/twintproject/twint.git@origin/master#egg=twint
pip3 install --upgrade aiohttp_socks
twint -u username
twint -u username -s WordOfInterest
  • Before you install below tools
nano ~/.bashrc

export GOPATH=$HOME/go 
export GOROOT=/usr/lib/go
export PATH=$PATH:$GOROOT/bin:$GOPATH/bin

GO111MODULE=on go get -u -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder
assetfinder tcm-sec.com

go get -u github.com/tomnomnom/assetfinder
assetfinder tcm-sec.com

go get -u github.com/tomnomnom/httprobe
cat tesla.txt | sort -u | httprobe -s -p https:443

amass enum -d tcm-sec.com

go get -u github.com/sensepost/gowitness
export GO111MODULE=on
gowitness file -f ./alive.txt -P ./pics --no-http

Frameworks

  • Recon-ng
marketplace search

marketplace install hackertarget
modules load hackertarget
options set SOURCE example.com
run
show hosts

marketplace install profiler
modules load profiler
info
options set SOURCE username
run
show profiles
  • Spiderfoot
  • sn0int
  • Maltego
  • Hunchly - 30 day trial, paid $129.99, runs only in Google Chrome

Additional Resources