# OSINT

## Sock Puppets

Creating an Effective Sock Puppet for OSINT Investigations Introduction

{% embed url="https://jakecreps.com/2018/11/02/sock-puppets/" %}

The Art Of The Sock

{% embed url="https://www.secjuice.com/the-art-of-the-sock-osint-humint/" %}

Reddit My process for setting up anonymous sockpuppet accounts

{% embed url="https://www.reddit.com/r/OSINT/comments/dp70jr/my_process_for_setting_up_anonymous_sockpuppet/" %}

Fake Name Generator

{% embed url="https://www.fakenamegenerator.com/" %}

This Person Does not Exist

{% embed url="https://www.thispersondoesnotexist.com/" %}

Privacy.com&#x20;

{% embed url="https://privacy.com/" %}

## Email OSINT

Hunter.io

{% embed url="https://hunter.io/" %}

Phonebook.cz

{% embed url="https://phonebook.cz/" %}

VoilaNorbert

{% embed url="https://www.voilanorbert.com/" %}

Email-Hippo

{% embed url="https://tools.verifyemailaddress.io/" %}

Email-Checker

{% embed url="https://email-checker.net/validate" %}

Clearbit-Connect

{% embed url="https://chrome.google.com/webstore/detail/clearbit-connect-supercha/pmnhcgfcafcnkbengdcanjablaabjplo?hl=en" %}

## Password OSINT

PWDQuery

{% embed url="https://pwdquery.xyz/" %}

h8mail

{% embed url="https://github.com/khast3x/h8mail" %}

Breachdirectory

{% embed url="https://breachdirectory.org/index.html" %}

Dehashed

{% embed url="https://dehashed.com/" %}

WeLeakInfo

{% embed url="https://weleakinfo.to/v2/" %}

LeakCheck

{% embed url="https://leakcheck.io/" %}

SnusBase

{% embed url="https://snusbase.com/" %}

Scylla.sh

{% embed url="https://scylla.sh/" %}

Have I Been Pwned

{% embed url="https://haveibeenpwned.com/" %}

## Breached Credentials

<pre class="language-bash"><code class="lang-bash"><strong># https://github.com/hmaverickadams/breach-parse
</strong><strong>bash breach-parse.sh @company.com company.com "BreachCompilation/"
</strong></code></pre>

## Image OSINT

Google Image Search

{% embed url="https://images.google.com" %}

Yandex

{% embed url="https://yandex.com/" %}

TinEye

{% embed url="https://tineye.com/" %}

Jeffreys Image Metadata Viewer

{% embed url="http://exif.regex.info/exif.cgi" %}

GeoGuessr

{% embed url="https://www.geoguessr.com" %}

GeoGuessr The Top Tips Tricks and Techniques

{% embed url="https://somerandomstuff1.wordpress.com/2019/02/08/geoguessr-the-top-tips-tricks-and-techniques/" %}

## Username OSINT

NameChk

{% embed url="https://namechk.com/" %}

WhatsMyName

{% embed url="https://whatsmyname.app/" %}

NameCheckup

{% embed url="https://namecheckup.com/" %}

## People OSINT

WhitePages

{% embed url="https://www.whitepages.com/" %}

TruePeopleSearch

{% embed url="https://www.truepeoplesearch.com/" %}

FastPeopleSearch

{% embed url="https://www.fastpeoplesearch.com/" %}

FastBackgroundCheck

{% embed url="https://www.fastbackgroundcheck.com/" %}

WebMii

{% embed url="https://webmii.com/" %}

PeekYou

{% embed url="https://peekyou.com/" %}

411

{% embed url="https://www.411.com/" %}

Spokeo

{% embed url="https://www.spokeo.com/" %}

ThatsThem

{% embed url="https://thatsthem.com/" %}

Voter-Records

{% embed url="https://voterrecords.com" %}

TrueCaller

{% embed url="https://www.truecaller.com/" %}

Caller-ID-Test

{% embed url="https://calleridtest.com/" %}

Infobel

{% embed url="https://www.infobel.com/" %}

## Social Media OSINT

```
# Twitter
from:username since:2019/03/01 until:2019/04/01
to:username
@username
geocode:$geo_code,10km
```

Twitter-Advanced-Search

{% embed url="https://twitter.com/search-advanced" %}

Social Bearing

{% embed url="https://socialbearing.com/" %}

Twitonomy

{% embed url="https://www.twitonomy.com/" %}

Sleeping Time

{% embed url="http://sleepingtime.org/" %}

Mention Mapp

{% embed url="https://mentionmapp.com/" %}

Tweetbeaver

{% embed url="https://tweetbeaver.com/" %}

SpoonBill

{% embed url="http://spoonbill.io/" %}

Tinfoleak

{% embed url="https://tinfoleak.com/" %}

TweetDeck

{% embed url="https://tweetdeck.com/" %}

Sowdust

{% embed url="https://sowdust.github.io/fb-search/" %}

Intelx-Facebook-Search

{% embed url="https://intelx.io/tools?tab=facebook" %}

Wopita

{% embed url="https://wopita.com/" %}

Code-of-a-Ninja

{% embed url="https://codeofaninja.com/tools/find-instagram-user-id/" %}

InstaDP

{% embed url="https://www.instadp.com/" %}

ImgInn

{% embed url="https://imginn.com/" %}

Snap-Map

{% embed url="https://map.snapchat.com/" %}

## Website OSINT

BuiltWith

{% embed url="https://builtwith.com/" %}

Domain-Dossier

{% embed url="https://centralops.net/co/" %}

DNSlytics-Reverse-IP

{% embed url="https://dnslytics.com/reverse-ip" %}

SpyOnWeb

{% embed url="https://spyonweb.com/" %}

VirusTotal

{% embed url="https://www.virustotal.com/" %}

Visual-Ping

{% embed url="https://visualping.io/" %}

Back Link Watch

{% embed url="http://backlinkwatch.com/index.php" %}

viewdns.info

{% embed url="https://viewdns.info/" %}

Pentest Tools Subdomain Finder

{% embed url="https://pentest-tools.com/information-gathering/find-subdomains-of-domain" %}

Spyse

{% embed url="https://spyse.com/" %}

crt.sh

{% embed url="https://crt.sh/" %}

Shodan

{% embed url="https://shodan.io" %}

Wayback Machine

{% embed url="https://web.archive.org/" %}

## Business OSINT

AI-HIT

{% embed url="https://www.aihitdata.com/" %}

Open Corporates

{% embed url="https://opencorporates.com/" %}

## Wireless OSINT

WiGLE

{% embed url="https://wigle.net/" %}

## Working with OSINT Tools

#### Linux Tools

```
theHarvester -d tesla.com -b all
recon-ng
```

h8mail

{% embed url="https://github.com/khast3x/h8mail" %}

breach-parse

{% embed url="https://github.com/hmaverickadams/breach-parse" %}

Twint

{% embed url="https://github.com/twintproject/twint" %}

Subfinder

{% embed url="https://github.com/projectdiscovery/subfinder" %}

Assetfinder

{% embed url="https://github.com/tomnomnom/assetfinder" %}

httprobe

{% embed url="https://github.com/tomnomnom/httprobe" %}

Amass

{% embed url="https://github.com/OWASP/Amass" %}

GoWitness

{% embed url="https://github.com/sensepost/gowitness/wiki/Installation" %}

Hunchly

{% embed url="https://hunch.ly/" %}

## OSINT Automation Foundations

```bash
#!/bin/bash

domain=$1
RED="\033[1;31m"
RESET="\033[0m"

info_path=$domain/info
subdomain_path=$domain/subdomains
screenshot_path=$domain/screenshots

if [ ! -d "$domain" ];then
    mkdir $domain
fi

if [ ! -d "$info_path" ];then
    mkdir $info_path
fi

if [ ! -d "$subdomain_path" ];then
    mkdir $subdomain_path
fi

if [ ! -d "$screenshot_path" ];then
    mkdir $screenshot_path
fi

echo -e "${RED} [+] Checkin' who it is...${RESET}"
whois $1 > $info_path/whois.txt

echo -e "${RED} [+] Launching subfinder...${RESET}"
subfinder -d $domain > $subdomain_path/found.txt

echo -e "${RED} [+] Running assetfinder...${RESET}"
assetfinder $domain | grep $domain >> $subdomain_path/found.txt

#echo -e "${RED} [+] Running Amass. This could take a while...${RESET}"
#amass enum -d $domain >> $subdomain_path/found.txt

echo -e "${RED} [+] Checking what's alive...${RESET}"
cat $subdomain_path/found.txt | grep $domain | sort -u | httprobe -prefer-https | grep https | sed 's/https\?:\/\///' | tee -a $subdomain_path/alive.txt

echo -e "${RED} [+] Taking dem screenshotz...${RESET}"
gowitness file -f $subdomain_path/alive.txt -P $screenshot_path/ --no-http
```

## OSINT Flowcharts



<div><figure><img src="https://3869391553-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDMM6SCLTDlo5fkDXCdeU%2Fuploads%2FEX459FvWYIIK29W6F8yV%2Fosint-6.jpg?alt=media&#x26;token=7a9ac306-0449-472a-b4e1-1c581c831f3e" alt=""><figcaption></figcaption></figure> <figure><img src="https://3869391553-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDMM6SCLTDlo5fkDXCdeU%2Fuploads%2FHlBu3BAB2tdE85S57b9O%2Fosint-5.jpg?alt=media&#x26;token=9e986970-a661-4967-bd95-97f1a67dfc78" alt=""><figcaption></figcaption></figure> <figure><img src="https://3869391553-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDMM6SCLTDlo5fkDXCdeU%2Fuploads%2F6EfifaPLa3EFMJpxxQMQ%2Fosint-4.jpg?alt=media&#x26;token=2a321d5a-7a54-4864-b817-7e6bfbcfff08" alt=""><figcaption></figcaption></figure> <figure><img src="https://3869391553-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDMM6SCLTDlo5fkDXCdeU%2Fuploads%2FNaRR6EUD8tdunBhlOp2u%2Fosint-3.jpg?alt=media&#x26;token=50610a2b-8e0b-4adc-a9d9-6de7d12ed541" alt=""><figcaption></figcaption></figure> <figure><img src="https://3869391553-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDMM6SCLTDlo5fkDXCdeU%2Fuploads%2FE66yvNRGHQOVyJI8Vwii%2Fosint-2.jpg?alt=media&#x26;token=b307b940-2185-41cc-8471-55ea272994fd" alt=""><figcaption></figcaption></figure> <figure><img src="https://3869391553-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FDMM6SCLTDlo5fkDXCdeU%2Fuploads%2FFRsChQVfYN2ZtBx5Y0yp%2Fosint-1.jpg?alt=media&#x26;token=aacfbefe-ec8d-452f-b8b5-0d1039f1faf7" alt=""><figcaption></figcaption></figure></div>

## Search Engine OSINT

```
site:github.com
Term1 AND Term2
Term1 OR Term2
Term1 * Term3
site:tesla.com password filetype:pdf
site:tesla.com -www -shop
filetype:pdf  inurl:file  intext:password
```

Google Advanced Search

{% embed url="https://www.google.com/advanced_search" %}

Google Search Guide

{% embed url="http://www.googleguide.com/print/adv_op_ref.pdf" %}

Yandex&#x20;

{% embed url="https://yandex.com/" %}

DuckDuckGo

{% embed url="https://duckduckgo.com/" %}
