Tweet

Cyber Detective

6 Sep, 14 tweets, 9 min read

From this thread thread you will learn about 12 key #OSINT-services for gathering information about a website.

I'll show them with an example of most famous russian search engine "yandex.ru" and it's subdomains.

Step #1

Collect basic information about domain

IP address lookup, whois records, dns records, ping, traceroute, NSlookup.

centralops.net

Step 2

Find out what technology was used to create the site: frameworks, #javascript libraries, analytics and tracking tools, widgets, payment systems, content delivery networks etc.

builtwith.com

Step 3

Get a list of sites belonging to the same owner (having the same Yandex.Metrika and Google Analytics counter numbers, as well as other common identifiers)

builtwith.com/relationships/

Find sites with the same Facebook App ID

analyzeid.com

Step 4

Map subdomains.

dnsdumpster.com/#domainmap

Step 5

Looking for email addresses associated with the domain or subdomains

hunter.io/search/

or

snov.io/email-finder

Step 6

Collect data on search engine rankings and approximate traffic.

alexa.com/siteinfo/
similarweb.com

Step 7

Download documents (PDF, docx, xlsx, pptx) from the site and analyze their metadata. This way you can find the names of the organization's employees, user names in the system and emails.

github.com/laramies/metag…

Step 8

Use Google Dorks to look for database dumps, office documents, log files, and potentially vulnerable pages.

dorks.faisalahmed.me

Step 9

Calculate a website fingerprint for searching it in Shodan, Censys, BinaryEdge, Onyphe and others "hackers" search engines.

mmhdan.herokuapp.com

Step 10

Looking for old versions of the site in archives and caches of search engines (sometimes in this way you can find addresses and contact information of the owners, which are currently already hidden from the site).

cipher387.github.io/quickcacheanda…

Step 11

Partially automate the process of finding important data in the archives. Download archive copies of pages from web.archive.org with Waybackpack
github.com/jsvine/wayback…
Search it for phone numbers, emails and nicknames using Grep for OSINT
github.com/cipher387/grep…

https://twitter.com/cyb_detective/status/1432966600852901890

Step 12

Find out the approximate geographical location of the site

iplocation.net/ip-lookup

(There is a separate 12-step thread about gathering information about a place)

https://twitter.com/cyb_detective/status/1432966600852901890

@cyb_detective

This short thread is over.

But there are dozens of times more tools for gathering information about domains. In my OSINT-collection there are already more than 60 of them:

cipher387.github.io/osint_stuff_to…

Follow @cyb_detective to learn about new tools every day.

• • •

Missing some Tweet in this thread? You can try to force a refresh

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @cyb_detective

Cyber Detective

@cyb_detective

16 Sep

Tools for gathering information about YOUTUBE videos and channels.

Thread 🧵🧵🧵 12 tweets

#osint #socmint #youtube

(1/12)🧵

mattw.io/youtube-metada…

Submint a link to video and get it metada:
Snippet (the exact date and time of publication, description, thumbnails links)
Statistics
Geolocation
Status
Content details

(also it's possible to get channel and playlist metadata)

(2/12)🧵

tools.digitalmethods.net/netvizz/youtub…

Submit a video id (you can find it here commentpicker.com/youtube-video-…) and download comments to it as a table (html file).

Read 14 tweets

Cyber Detective

@cyb_detective

13 Sep

SQL dumps (database dumps) for #OSINT

Super short practical course.

Thread🧵🧵🧵

(12 tweets)

#sql #mysql #phpmyadmin

@GoogleHacking

(1/12)

In @GoogleHacking (exploit-db.com/google-hacking…) there are 176 dorks for searching SQL dumps, which may contain any confidential information.

Simple ex (pic 2):

ivanov ext:sql site:github.com

This query search all sql-files, which contain "ivanov" in #Github

(2/12)

Sometimes in this way it's possible find databases with information about orders, customers or employees. Inattentively, site owners forget to close them from indexing in robot.txt.

Such SQL-dumps may contain names, surnames, dates of birth, addresses, phone numbers.

Read 14 tweets

Cyber Detective

@cyb_detective

10 Sep

twitter.com/i/lists/143622…

Today I began assembling a list that will include single programmers and small teams that develop tools for #OSINT

twitter.com/i/lists/143622…

In this thread I will tell you which of these people are working on which project (please subscribe to them and put stars on #Github) 🧵

@jsvine

1-5 (of 21)

@jsvine waybackpack github.com/jsvine/wayback…

@soxoj Maigret github.com/soxoj/maigret

@megadose Holehe github.com/megadose/holehe

@ninoseki MMHDAN, Mihari and others github.com/ninoseki/

@jhy Jsoup github.com/jhy/jsoup

@tenacioustek

6-10 (of 21)
@tenacioustek Harpoon github.com/Te-k/harpoon

@zhenyanghua MeasureTool-GoogleMaps-V3 github.com/zhenyanghua/Me…

@aykutsarach Github-Rater github.com/AykutSarac/git…

@skylens_app App.skylens.io

@kumarshashwat_ Orion github.com/Araekiel/orion

Read 8 tweets

Cyber Detective

@cyb_detective

9 Sep

Trying to identify a country from a photo

Part 1. 12 basic tricks for outdoor photos

Thread 🧵

Step 1

The first thing to do is to break the photo up into fragments so that you can examine each one individually.

The fastest way to do this is to use online tools. For example:

iloveimg.com/crop-image

(If you have a Mac, just press Command+Shift+4)

Step 2

Now look for interesting fragments in Google or Yandex

(by the way, Yandex has a built-in cropping)

It happens that the country can be identified by the model of public transport. If the photo shows "PAZ 4234", it is most likely Russia (but maybe other CIS countries).

Read 15 tweets

Cyber Detective

@cyb_detective

8 Sep

15 steps to gather information about a company.

Suitable for Fortune 500 corporations as well as the restaurant down the street.

Thread 🧵🧵🧵

#osint #corpint

@opencorporates

Step 1

Gathering basic information (adress of registration, number of employes, market capitalization etc) in global business registries

opencorporates.com
craft.co

@opencorporates @Craftdotco

Step 2

Check the details of the company in the official registry of the country in which it is registered (it can often be found on the website of the federal tax inspectorate)

cipher387.github.io/corporative_re… (63 countries)

Read 19 tweets

Cyber Detective

@cyb_detective

7 Sep

@pamfoundation

In this thread you will learn about 9 key services for FACE identification by photo.

I will show them using a photo of Pamela Anderson (@pamfoundation) taken in the early 90s as an example.

#osint #socmint

№1

yandex.ru/images/

The first thing you should do is just try searching for the file in the Yandex.Images service. In my opinion, this is the best service in the world for reverse image search.
Sometimes it is quite enough to answer the question, "Who is this?
#yandex

№2

search4faces.com/vk01/index.html

Now it's possible to try to search for a person's profile in the Russian social network VK ( 1,109,563,766 faces in database).

But this method doesn't work very well with known personalities...

#VK

Read 12 tweets

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Share this page!

Cyber Detective

Try unrolling a thread yourself!

More from @cyb_detective

Cyber Detective

Cyber Detective

Cyber Detective

Cyber Detective

Cyber Detective

Cyber Detective

Did Thread Reader help you today?

Like this author's thread?