OSINT

Sub-Category Description
OSINT - Beware. Your data is out there. Two part presentation on OSINT and privacy awareness
OSINT Notes on OSINT
Book Link to OSINT Handbook 2020
Trainings Trainings on OSINT
Shodan Notes on Shodan
TraceLabs CTF Introductory notes to TraceLabs CTF
TraceLabs Guide - Hacktoria Small guide to do an OSINT Investigation
Hacktoria Hacktoria's Challenges Write-ups
TryHackMe OSINT Challenges TryHackMe OSINT Challenges Write-ups

Table of contents


Starting point


OSINT Bookmarks


External Resource


Tools list


Resources


Videos


Solved OSINT Challenges


Book

  • OSINT Handbook 2020 - link

  • OSINT Handbook 2020 (local) - link


Tracelabs CTF


Challenges


Local IP

  • http://ipinfo.io/ip

VMs


Search Engines


Google Dorks

Operators

  • filetype: search your results based on the file extension

  • cache: This operator allows you to view cached version of the web page.

  • allinurl: This operator restricts results to pages containing all the query terms specified in the URL.

  • inurl: This operator restricts the results to pages containing the word specified in the URL

  • allintitle: This operator restricts results to pages containing all the query terms specified in the title.

  • inanchor: This operator restricts results to pages containing the query terms specified in the anchor text on links to the page.

  • allinanchor: This operator restricts results to pages containing all query terms specified in the anchor text on links to the page.

  • link: This operator searches websites or pages that contain links to the specified website or page.

  • related: This operator displays websites that are similar or related to the URL specified.

  • info: This operator finds information for the specified web page.

  • location: This operator finds information for a specific location.

  • 42 Advanced Operators - https://ahrefs.com/blog/google-advanced-search-operators/


Dorks

  • recibo vencimento ext:pdf

  • indexof site:pt

  • inurl:admin site:pt

  • password

  • hackedby


Image Solve


Video Search Engines


Image Search Engines


Image Tools


Geolocation Recon

Maps

Street View

Satelite

Misc tools


Geolocation Recon tips and tricks

3 word location


Google Alerts


Brands


Portugal


Find people


Social Networking Recon


Social Media

  • Friends and followers

  • Media (pictures, videos, audio)

  • Posts/Comments

  • Phone numbers/ Dates / Schedules

  • Likes / Dislikes


Security questions

  • What was your childhood nickname?

  • What is the first school you attended?

  • What was your first pets name?

  • What street did you grow up on?

  • What's the ciry where your parents met?

  • What was the city you where born in?

  • What's the name of your oldest cousin?


Facebook


Twitter


Instagram


Username OSINT


Personal Information


Bitcoin


Job Board Recon


Search Code


Deep/Dark Web Recon


Access


Sites


Onion sites


Metadata Recon


Email Tracking


Website Information


Public Network Footprinting

Network Range


Autonomous System Numbers


WHOIS and DNS


DNS Zone Transfer


Reverse DNS Lookup


Traceroute


Sub-Domain Enumeration

More Info - https://hover.blog/whats-a-domain-name-subdomain-top-level-domain/


Recon-ng


Maltego


Other Footprinting Tools


Wifi


WaybackMachine


Canary Tokens


Shodan, Censys, and Thingful


Shodan Guide


Shodan Dorks

  • Remote desktop country:pt city:"Braga"

  • winrest port:5901 country:pt

  • smb contabilidade country:pt

  • smb series country:pt


Website cloner


Password OSINT


Temporary Email


VPN

Always check everything is working correctly by confirming - https://mylocation.org/


DNS Leak


Sock Puppets


Sock Puppets Tutorials


Scams


Browser OSINT


Browser Plugin


Firefox


Chrome


Search Engines List

  1. Dehashed—View leaked credentials.
  2. SecurityTrails—Extensive DNS data.
  3. DorkSearch—Really fast Google dorking.
  4. ExploitDB—Archive of various exploits.
  5. ZoomEye—Gather information about targets.
  6. Pulsedive—Search for threat intelligence.
  7. GrayHatWarfare—Search public S3 buckets.
  8. PolySwarm—Scan files and URLs for threats.
  9. Fofa—Search for various threat intelligence.
  10. LeakIX—Search publicly indexed information.
  11. DNSDumpster—Search for DNS records quickly.
  12. FullHunt—Search and discovery attack surfaces.
  13. AlienVault—Extensive threat intelligence feed.
  14. ONYPHE—Collects cyber-threat intelligence data.
  15. Grep App—Search across a half million git repos.
  16. URL Scan—Free service to scan and analyse websites.
  17. Vulners—Search vulnerabilities in a large database.
  18. WayBackMachine—View content from deleted websites.
  19. Shodan—Search for devices connected to the internet.
  20. Netlas—Search and monitor internet connected assets.
  21. CRT sh—Search for certs that have been logged by CT.
  22. Wigle—Database of wireless networks, with statistics.
  23. PublicWWW—Marketing and affiliate marketing research.
  24. Binary Edge—Scans the internet for threat intelligence.
  25. GreyNoise—Search for devices connected to the internet.
  26. Hunter—Search for email addresses belonging to a website.
  27. Censys—Assessing attack surface for internet connected devices.
  28. IntelligenceX—Search Tor, I2P, data leaks, domains, and emails.
  29. Packet Storm Security—Browse latest vulnerabilities and exploits.
  30. SearchCode—Search 75 billion lines of code from 40 million projects.