Thread by @nixintel

THREAD: This evening's disturbances at #Paris Gare de Lyon show the importance of acting quickly to gather real-time #OSINT information.

There are lots of resources for doing this, but Snapchat Map is one of the most useful:

map.snapchat.com

2) Snapchat Map displays near-live time videos that are all geotagged and which can be accessed without the Snapchat app via a web browser.

Here's #Paris about 20 mins ago. Hotspots indicate a lot of uploads:

3) The videos are only visible for a short while before being removed from the map. The need to geotag the videos and their short lifespan makes them slightly less susceptible to being faked than on some other platforms.

Click on a hotspot to start viewing videos from that area:

4) What if you want to download and preserve one of these videos? Simply press F12 in your browser to enter developer mode. Select "Network" and then you can see the requests for all the videos. They are served in mp4 format.

5) To view the video you want, right click on the link in the console and choose "open in new tab". You can view the video in isolation in a new tab and then just right click and "save as" to download it.

6) We can also exploit this technique to remove some of the overlays that block the view of some Snapchat videos.

For example in this video, the "Paris" sticker gets in the way a little:

7) But when we look at the network requests in the developer console, we can see that the overlay is not an integral part of the video file. It is a separate PNG file that is served with the video, but which is not part of it.

8) So we just need to look in the console and find the mp4 file requested along with the overlay sticker, and we will find that the mp4 is available to view *without* the overlay. This is much clearer and easier to work with.

Quick demo of the technique:

9) HT to @dutch_osintguy and @trbrtc who first discussed this possiblity with me last year. I still haven't got round to finishing the blog post about it, so this thread will have to do for now 😁

@dutch_osintguy @trbrtc 10) Here's the Snapchat video link with the overlay removed: s.sc-cdn.net/3icGoQbIlN6CNr… (no idea how long this link will be available for)

@dutch_osintguy @trbrtc 11) If you're interested about grabbing live time OSINT information while it's still available, I wrote a couple of blogs about it last year:
nixintel.info/osint/the-attr… and
nixintel.info/osint/quiztime…

@dutch_osintguy @trbrtc 12) Here's the original thread from last September. A whole 6 months ago and the technique still works!

https://twitter.com/trbrtc/status/1177580517262352384