OSINT Techniques

OSINT Techniques#

Tradecraft the operator runs during open-source target development. Each technique answers a specific information gap, account hunting, imagery, location, persona creation.

Gap analysis#

Take stock of initial information and apply four simple questions to identify what to do next.

  1. What do I know?

  2. What does this mean?

  3. (So) What do I need to know?

  4. How do I find out?

Password reset hunting#

Lack of standardization in password-reset functions surfaces partial telephone numbers and emails of target accounts.

  • Facebook, alternative contact methods on the reset screen, asterisks matching email length.

  • Google, ask for the last password remembered; the next screen reveals a redacted recovery phone number with the last 2 digits.

  • Twitter, redacted email on file showing the first 2 characters of the username and the first letter of the email domain.

  • Yahoo, redacted alternate email if on file. Accurate character count, first character, and last 2 chars of username along with full domain.

  • Microsoft, redacted phone number with last 2 digits.

  • Pinterest, displays a user’s profile and a redacted email address without an accurate character count.

  • Instagram, LinkedIn, Foursquare, automatically initiates a reset and emails the user. Avoid.

Reverse image searching#

  • Crop to the object of interest before uploading.

  • Increase resolution even if it becomes more pixelated.

  • Best engines in order, Yandex, Bing, Google, TinEye.

URLs.

  • Yandex Images, http://images.yandex.com/

  • Bing Visual Search, https://www.bing.com/visualsearch

  • Google Images, https://images.google.com/

  • TinEye, https://tineye.com/

Recent satellite imagery#

  • Google Earth, browse https://earth.google.com/web/@30.12736717,35.69560812,-1530.56420216a,14967606.11368418d,35y,-0h,0t,0r/data=CiQSIhIgOGQ2YmFjYjU2ZDIzMTFlOThiNTM2YjMzNGRiYmRhYTYA.

  • Mapbox Live, browse https://api.mapbox.com/styles/v1/mapbox/satellite-v9.html?title=true&access_token=pk.eyJ1Ijoi....

Photo approximate time#

If location is known, use the sun position.

  • http://www.suncalc.net

  • https://www.suncalc.org

Telegram groups by location#

  1. Use a mobile phone or Android emulator.

  2. Download a GPS spoofer.

  3. Spoof location to target.

  4. Open Telegram.

  5. Three dots, Contacts, Add people nearby.

Twitter accounts by email#

  1. Sign in to Gmail, open Contacts.

  2. Add target email.

  3. Sign in to Twitter.

  4. Download GoodTwitter add-on.

  5. Privacy settings, Find friends, upload Gmail contacts.

Tweets based on location#

  1. Find location in Google Maps.

  2. Right click, “What’s here?”

  3. Click on GPS coordinates, copy them.

  4. twitter.com/search, use geocode:LAT,LONG,0.1km.

Spoof browser location (Chrome)#

  1. Open dev tools (F12).

  2. Console tab.

  3. Press ESC to reveal the console drawer.

  4. Click “Sensors”.

  5. Select / fill in coordinates.

Note, IP address may still reveal location.

TikTok profile JSON#

https://tiktok.com/node/share/user/@{username}?isUniqueId=true
# replace {username}

For 1080x1080 format, open the TikTok profile, dev tools (F12), Network tab, refresh (F5), select XHR, double-click api/user/detail/, open “AvatarLarger” link.

Fictional account creation#

Autogenerate fictional personas.

  • This Person Does Not Exist, https://thispersondoesnotexist.com/

  • This Resume Does Not Exist, https://thisresumedoesnotexist.com/

  • This Rental Does Not Exist, https://thisrentaldoesnotexist.com/

  • Fake Name Bio Generator, https://www.fakenamegenerator.com/

  • Random User Generator, https://randomuser.me/

  • Fake User Generator, https://uinames.com/

  • Dating Profile Generator, https://www.dating-profile-generator.org.uk/

  • Fake Persona Generator, https://www.elfqrin.com/fakeid.php

  • International Random Name Generator, https://www.behindthename.com/random/

References#

Contents