01_OSINT.md

Instructor: Tino Sokic

Sock Puppet Account

• The Robin Sage Story
• Fake profile picture (thispersondoesnotexist, generated.photos)
• Fake email (fastmail.com)
• Clean machine
• Burner Phone number
• IP Location

Google Hacking Examples:

NOTE: Always make sure to add the operator at the start and then start with the search term

• "hacking" - show websites that must contain the word 'hacking' (verbatim)
• -<operator> - exclude the result that is pointed by the operator or also can be a search term
• inurl:ftp -inurl:(http|https) "password" - url must contain the word 'ftp' and exclude the word http or https and must contain the text 'password' in that website
• -eccouncil "codered" - url must contain the word 'codered' and exclude the word 'eccouncil'
• filetype:pdf "password" - filetype should be 'pdf ' and the website should contain the text 'password'
• site:linkedin.com "Manager at Toyota" - site should contain the word 'linkedin.com' and website must contain the word 'Manager at Toyota'
• site:pastebin.com "login" - site should contain the word 'pastebin.com' and website must contain the word 'login'
• site:instagram.com "OSINT" - site should contain the word 'instagram.com' and website must contain the word 'OSINT'

---

Search FTP servers:

• SearchFTPs
• MMNT

---

Social Media Intelligence:

• Facebook:

  • osintcurio.us
  • plessas.net
  • inteltechniques.com

• Twitter:

  • Advanced Twitter Search
  • allmytweets.net
  • foller.me
  • omnisci.com
  • sleepingtime.org

• Linkedin

  • Usually Linkedin doesn't allow even the public profiles of a person to be viewed without signing in so: we can copy the profile link and goto Google Mobile Friendly Web Test Page and paste the link. Then click HTML and copy to clipboard and goto Code Beautify and paste the HTML code over there giving us the webcontent without sigining in

  • Advanced Search (OR, NOT, "exact search term", (combine search terms) )

---

Email Addresses:

• Reverse Email Searches:

  • beenverified.com
  • behind.email
  • infotracer.com

• Email Search Engines:

  • trumail.io
  • verify-email
  • tools.verifyemailaddress.io

• Email Formats:

  • email-format
  • hunter.io

• Compromised Approach:

  • haveibeenpwned
  • dehashed

---

Usernames:

• Username Search Engine:

  • checkusernames.com
  • knowem
  • usersearch
  • namevine
  • social-searcher

• Compromised (same as this)

---

Images:

• Search Engine Approach:

  • Google Images
  • Bing Images

• Reverse Image Search:

  • tineye

• Image Exif Data:

  • exif

• Manipulation:

  • photo-forensics

---

IP Addresses & DNS:

• IP Location Tools:

  • iplocation.net
  • ipfingerprints.com
  • ip2location.com
  • ipinfo

• DNS Tools:

  • viewdns

---

IoT Devices:

NOTE: Make sure to register an account for the following search engine to use all features

• Shodan.io

  • Advanced Search Example: country:HR port:53

• censys.io

---

Utilities:

• Sublist3r
• theHarvester
• Recon-ng
• Spiderfoot
• Maltego

---

Online Breach Data & Leaks Resources:

• haveibeenpwned
• leakpeek
• intelx
• ghostproject
• dehashed
• weleakinfo