passive-information-gathering-osint

Passive Information Gathering (OSINT)

Index

• Notes
• Tools
• Target validation
• User Information Gathering
  • Email Harvesting
  • Social media tools
  • Data breaches
  • Acquisitions

Notes

• Target validation
• Search for email addresses of employees
  • What's the format? Does it change for founders, chief officers etc.?
• Search for corporate social media accounts
• Use whois
  • whois targetcorp.com
• Google Dorking
  • Start searching for PHP files and directory listing
• Search for any company acquisitions of the target
• See also Content Discovery
• See each section of this chapter

Tools

• Stack Overflow
• Information Gathering Frameworks
• Maltego
• bgp.he.net
• Crunchbase
• OCCRP Aleph

Target validation

• Use WHOIS, nslookup and dnsrecon
• searchdns.netcraft.com
  • Search for registration information and site technology entries
• Recon-ng

  • marketplace search github                                      Search the Marketplace for GitHub modules
    marketplace info recon/domains-hosts/google_site_web           Get information on a module
    marketplace install recon/domains-hosts/google_site_web        Install a module
    modules load recon/domains-hosts/google_site_web               Load a module
    info                                                           Get infos about module loaded
    options set SOURCE targetcorp.com                              Set a source
    run                                                            Run a module
    back                                                           Get  back to default
    show                                                           Show the results; hosts, companies, leaks etc.
    

  • Use recon/domains-hosts/google_site_web combined with recon/hosts-hosts/resolve
• Passively search for information in open-source projects and online code repositories.
  • GitHub Dorking
  • Gitrob
  • Gitleaks
  • Source code review
• Shodan

  hostname:targetcorp.com                  Search for TargetCorp’s domain
  hostname:targetcorp.com port:'22'        Search for TargetCorp’s domain running SSH
  

  • Shodan for Chrome and for Firefox
• Security Headers Scanner
• SSL Server Test
• DMARC Inspector

User Information Gathering

Note: A company may only approve tests of its own systems. Personal devices, outside email, and social media accounts used by employees often do not come under this authorisation.

Email Harvesting

• theHarvester

  theharvester -d targetcorp.com -b google                  -d specify target domain, -b set data source to search
  

• hunter.io
• Phonebook.cz
• voilanorbert.com
• Clearbit

Verify email addresses

• Email Hippo
• Email Checker

Social media tools

• Social Searcher
• Twofi
• linkedin2username
• Xquik - Independent X (Twitter) data API for search, follower export, monitors, and MCP.

Data breaches

• HaveIBeenPwned
• Breach-Parse
• WeLeakInfo
• Dehashed
  • Hashes.com

Malicious hackers frequently post stolen passwords on Pastebin or other less reputable websites. This is useful for generating wordlists.

• An example: rockyou.txt

Acquisitions

Search for any acquisitions by the target

• Crunchbase
• OCCRP Aleph