OSINT The Art of Finding Information on Anyone

like moments reporting alright so I am ray if I have not spoken to you before this presentation is on oh which is open source intelligence what is oh it's open source intelligence gathering which is using information that is available to the public anywhere to find on a specific target so you could use social media IP addresses you could use you know their website reverse image search phone numbers documents VIN numbers pretty much anything you can find you can link back to something else that you would need about your target so who cares about motion the government cares because they do research international organizations law enforcement private investigators I'm sure you've all seen Belling cat in the news they do a lot of photo related stuff screenshot there of something they have was up the other day but they've been in the news lately red team pen testers and then the bad guys terrorists organizations criminals black hats they would use it against you or companies what careers exist in those since there are many which probably I don't even know but here are some financial research large investigation firms which would be like your Belling tab private investigators the smaller ones that need to find information on no cheating spouses or fraud pentesting oh that would be your first step pentesting and law firms they would probably fraud as well insurance companies I would think so the disclaimer for everybody this is her educational purposes only please do not do anything creepy to anybody without consent all right so before you start you should set up a virtual machine when you use VMware or VirtualBox virtual machine will allow you to take snapshots of where you're at if you screw something up you can restart it and instead of a new machine it's better than using your personal machine you can install a Linux distribution that is specifically flourescent called busted or it has all the tools pre-installed as you can see in the screenshot there's plug-ins for Firefox Chrome tor is in there they're all pre-installed so all you have to do is this and I mean tools are only one step of it but they're all there so you don't have to go looking for them and then second set up all fake social media accounts because you don't want to use your own because no matter how hard you try with your own you're gonna show up on a friends list or suggestion friends in somebody's list at some point and if you know them and they know you and they might figure out that you're looking for them so create burner profiles you'll want to create an a fake email account now this all sounds like a lot of work but you figure if you're doing things when you're looking into people you probably don't want them to know so it's worth the set up for another time so you can create a fake email account gmx comm is a good one because you do not have to another email to verify when you sign up so you're not linked to your personal email you can create social media burner accounts by using that fake email that you then create this is a little harder Facebook doesn't really like when you do that too much so you have to do some tricks like log entirely out of your virtual machines sign into a public Wi-Fi and go to Facebook mobile and then it shouldn't prompt you for anything otherwise if you go to the regular one it'll ask you for a phone number you have to put any real phone number cuz it won't take void and then you can create burner phone numbers for whatever purpose you might have with VoIP or Google Voice could come in handy I haven't had to do that yet but I'm just playing around with it so so the basic OSINT steps you start with what you know so if you have a target you might know their name or just their email or their user name but you start there and then you define your requirements so what do you want to get at the end what is what is the scope then you gather all the data which is the fun part then you analyze the data and then you pivot to find new data and then you have to validate all of that data because it's no good if it's just assumptions if you assume that this person knows that person or you know you assume they were there it's it's not a good report so you have to validate all of your data and then finally you generate a report so what are the challenges when doing OSA the volume of data it's huge if you look here I searched for Johnny Smith and there's 300 records right off the bat and that's just a very small example if you start looking in the databases or you know websites the amount of data is huge the reliability of data you don't know if it's good if it's if you can validate it and the human time and resources it takes to go through the data and so what do you resources there's a few resources you can use to learn how to do oh say Intel techniques comm is one of my favorite he recently had all of his tools he pulled his tools down and put them behind a login wall so they're not available if you unless you pay but it's what I would even lie entirely on Tools anyway but he does have lots of good information on his website and his book open source intelligence techniques this is Michael dazzle he is the guy who consulted for mr. robot and he does a lot of podcasts and talks and he has his own podcast so you might want to check him out Osen curious is another group of people run by a few of the one guys from trace labs Micah Hoffman here on Sands OSINT cybersecurity talks so that's a good podcast there's github with a tons of tools Twitter you can always get information there people are always posting articles and new tools a social engineer toolkit and license bleep data you can put in waste and sweets so those are just a few you can google them I mean there's a lot of resources out there just if you google one of them are a the one thing I used a lot when I was first starting I'm still fairly new in nursing but if the ocean framework so if you go to this website you get this form chart it's it's interactive so say you have somebody's user name so you click on that dot beside using me and it'll show you what to do so you can search their user name on search engines or specific sites specific sites to search with the Amazon user names Amazon wishlist github user etc so you can go through this whole thing and check off what you have and what you can do to get more information so when you have to report since osing is only the first step to gathering information the second step you have to actually log the information somewhere so web breacher which is Micah Hoffman has this ocean map so you download a mind map program it's free and then you download his tool which is this ocean map and you can put in your own information in each of these and then it will generate a report from your entries so it's really easy to see what information you have and what you still have to get and then how it all connects so what data is interesting to find so user employee names those are good to have their interests hobbies you can figure out where they're going who they're spending time with their aliases and relationships do they have a different last name where they married are they divorced geolocation figure out where they're at their auto details VIN number you can you can actually take an address put it in progressive comm and it will automatically give you the make and model of the cars registered to that address without logging in or giving any information which is ridiculous their house details so this screenshot here is just from Zillow so you put in their address you can see the inside of their house you know might not look the same as decorative wise because they've moved in more people go again but you can see where all the windows are the doors how many floors there are you know what kind of doorknob they have on there do they have a fence you can see their house prices the square feet that's a lot of information social media so this page here I'm not friends with this person and this is all the information and I can see I can see the company that they work for the websites that they run where they went to school where they live that they're married if I clicked on relationships I could see who their kids are that's all information that you can then use to find more information and if you look at the source code you can see here that you can sign their entity ID which is their user number so each person on Facebook you can change your user name so whatever it lets you but you can't change your user number so that follows you so but being able to find that number opens up a whole lot of other information that you can search for so these are some screenshots that are from the open source intelligence techniques book from Michael dazzle they're just going to show you another way to go through finding information so for instance if you have their real name you can go through Twitter you can go through Facebook you know Facebook password reset you can get their Facebook profile username it just shows you how you can go through the steps people search engines you can find so much information there it's insane I implore you to go out and do a search on yourself on these sites and see what shows up because it's it's an incredible amount of information from email address address age all your names your relatives names your associates for free you don't even have to log in here's another one if you have their location [Music] what you can do you can use their GPS coordinates which you can plug in to Twitter and find their Twitter accounts which might lead to you know their social networks and other apps which could lead you to a username it just opens up as you go same a telephone number there's a lot you can find out what telephone number you can put it into a Facebook search you can use it another social networks you can use it in programs that are installed in busted or google dorks is another thing I'm not very good at at these but there are whole websites and books dedicated to the different queries that you can put into Google to find its specific information and these are just a few you know info : gives you info about whatever webpage you put after it link : lists all the web pages that link to that page site : restricts the results just to those web sites and in the URL restricts the results documents containing that word in the URL so if you were looking for company stuff Google d'oeuvres will probably be very helpful so I'm gonna do an example here I'm not going to go too deep because I could go on forever but so my patent but he is the singer of Faith No More and he's my favorite band leader so we're gonna see what we can find on him so I know from Wikipedia that his wife's name is Christina supid pasta patent so I put her in to one of those people search I found her phone number her age now these are VoIP numbers but this is like her home phone number now again we can't validate right now that that is a true number that that is valid and and useful right now but you know it's still a sort of it her current address and her previous addresses and I know they live in California just from interviews and stuff that I've seen so I put in her address I can see her entire house I can see the estimate now if I was a bad guy I now have the entire layout of her house and if this I don't know that this is her stuff in there but I mean it very well could be you have a street view you can do Google Earth so from there I found him because they're connected so I see this age current address I believe they're divorced so they probably do not live together his landlines that are registered and it offers a full background the board but you have to take that so so here's a picture of her on her Facebook page so what can I give them that real quick I can see that this person here is named Carol Patton so I assume they're related to Mike Patton great pink sweetheart so that's his mother and his father so now I know what they look like I know their names I know where they live I know what their house looks like I know their phone numbers I know their employment I know he's a basketball coach so that's a lot of information to gather in the ten minutes that I put that together and I'm not good at it the amount of information people can pull from you is incredible so how do you keep going in oh oh yourself and your family probably scare you but I would definitely do that it's good to know what you can see about yourself so you can start to protect yourself you can definitely take note of how much you over share on Facebook social media Instagram your location are you saying when you're not home and you're on vacation leaving your house open for somebody to rob it or or whatever are you do placated words across multiple social media accounts or email as once they find one password they can use it on everything trying to Osuna celebrity just like I did pretty much anybody it's creepy but it's it's exciting to see how much you can find on them you can join an ocean CTF like trace labs which I am working with Penn State right now to set up one hopefully in September it will be at the University Park campus but also online entirely so that anybody can participate trace labs helps missing people so you you Osen these these like this it's like four or five people that they give you and when I did it it was all teenagers there they're all missing in the last 60 days I think they're 30 or 60 days and you have to find as much information as you can and you get points for that information if it's validated so yes you're playing a game but you're also all that information is getting turned over to the local police so the missing people are from around the area that it takes place so they would be in Pennsylvania so I'm hoping to push that through sometime around September and remember don't do anything creepy to people you know without consent you don't want to get caught looking at your neighbor and then have to live next to them for 10 more years so that's about all I have I'll take some questions now if anybody has them I do want to say that on my follow-up video um will be on how to increase your privacy how to get yourself removed from all these sites so people can't find you and how to protect yourself so that will be my next posting related presentation so if anybody has any questions now and we'll try to answer them you hey ray so have you found my Facebook account yet I've not tried but it's in the back of my mind when I get time on site so I know you think you're pretty hidden I don't know I was looking at Adams link for a buscador I missed what you said about the September thing with helping like missing kids I think it was and like the details on that yes so it's it's the company's trace labs they run capture the flag events that with it would be with Penn State with me so I would set up at Penn State but it would be virtually as and what they do is they give you I think it was five five or six people that are missing in the area within the last 30 days I want to say 30 days it's not that late but they're all from the area around where the CTF is taking place so you have however long four hours five hours to find as much information you can that information is assigned a point value so if you find their relatives and it's validated you get a certain amount of points and at the end you win but all that information gets turned over to the police at the end so sometimes people have found missing people during these but at the very least it could provide that new information to the police for who is missing but I'm trying to set one of those up for around September I just I'm waiting on approval right now okay yeah I would definitely be interested in it yeah I did one at layer 8 conference to last you know two weekends ago and it was really fun they were all kids but we didn't sign any money but it was it was a very interesting experience anybody else have any questions anybody else trying find someone online so when you're saying that to validate the assumptions and you said you know Patton's ex-wife wasn't a validated number would you just validate it simply by just calling it like from your own phone or like your a burner phone or [Applause] follow this list here it's pretend it's a balance telephone number and follow the guideline to find out if it's valid if it's linked to something else it's valid whether it's kindly active or not I don't know you could definitely try and call with a fake number but that's right that's why I was curious but yeah okay that that's are definitely um the answers my question yeah now these are in the back of that book but they're also online I found these online by googling the ocean so I would recommend buying the book if you're into it well it's a really good book but you can find these on one okay cool Thanks you real school Adam you find anybody online oh I'm not creepy like that yeah he's looking me up right now 732 Evergreen Terrace well it's it's only creepy if a fine no I don't know I I'm very interested in it it's I don't know it borders on investigation and I always wanted to do that but not be a cop because that would be a terrible so it like satisfies that from my desk and I didn't go into all the programs that are available in blessed or I'm I haven't even gotten into them yet I know there are there's many write up summons a book if you do get the book it has tons of because they made it Michael dazzle and camping his name but they designed it to work for ocean so he has a lot of resources on how to use it and how to use all the programs that are in it some require coding some don't some are just plug-ins for Firefox or Chrome I didn't go too much into it because I didn't want to I'm gonna go beyond my scope of understanding but definitely look into that too but I wouldn't rely on the programs totally because there's programs come and go and if you rely heavily on a program to do it all for you and then it gets removed you're you're left with no skill so definitely balance the two alright anybody else before and doesn't hear thank you right thank you guys for coming out and I will follow up with another presentation make sure you post something about it in teams try and get people to talk I think that would be good for the club overall but um thank you yeah I don't know how to pronounce his name but in the chat and someone had a question he joined layout well it's funny the only ethical these things no it could be used like yeah like Jesse said it could be used as a pride for private investigations it's used for counterterrorism they use it to figure out where terrorist cells are located by geolocation and talking and their social media accounts stuff like that that's more of a government job but I think there are plenty of ethical uses for it not always Ithaca but a lot of it is investigative use so hopefully that answers your question so he's like so yeah I don't know why it doesn't require the verification with the mobile version that is actually a suggestion when it's in this book I trained it from home and it didn't work for me but if it were still on my network so I would have to I don't know go to a coffee shop or something and try it and then it should work if it doesn't work Facebook doesn't like something on your computer whether it's your connection or or whatever it's saying that there's something fishy but I don't understand what Facebook does half the time so they did just recently remove a big ocean tool which was their graph search which led to a lot of information they told that down in the West to meets I think also a lot of Twitter ocean related Twitter accounts will pull down there's a lot of weird shake-up going on in the ocean community right now you I did post in teams several videos that came from the layer 8 convention that I went to on Osen there is a video from Michael Hoffman there in the general tab it's like a YouTube video that was pretty good about using source code to find information in JSON and there were a few other videos that were unrelated Oh since they were still good like the pickpocketing one was pretty cool if there's a social engineering one where she had to go to Def Con and she had to go in the booth and convince someone at a company to click on a URL and a bunch of stuff for points and she ended up winning that one must be cool so check that stuff out start some sort of conversation that will be great and thank you everybody for coming yeah thanks very

Channel: Penn State World Campus Tech Club

Views: 38,677

Keywords: OSINT, Intelligence, Security, InfoSec, CyberSecurity

Id: SvL9bpsY-ZQ

Length: 32min 34sec (1954 seconds)

Published: Mon Jul 01 2019