Let's start with the easiest and fastest option. Use NAMINT from @seint_pl.
It will generate possible name variants and links to search for them in various search engines (+ possible emails and document search + social media accounts)
If the options suggested by NAMINT do not bring results (or your goal is to collect the MAXIMUM info), then you need a list of all possible nicknames based on the first and last name.
Here's a guide on how to do it from @Sox0j:
When compiling a list of possible name variants do not forget that any, even the simplest name (eg John) can be derived from dozens of different names and have a dozen more diminutive variants
If you've done well in the past stages, you have a long list of nickname variations based on first/last names.
github.com/soxoj/marple automate the search (it automatically prepends the inurl: operator to the query and collects links to the results in a text file)
🧵(6/15)
You can also use the above list together with tools to verify the existence of accounts with a certain nickname in social networks.
There are many of them: Sherlock, Maigret, BlackBird, Nexfil... Take your pick.
Once you have a list of emails, you need to sort out the non-existent ones. To do this, there are dozens of online services to check one by one and dozens of APIs to automate this process.
It is also worth looking at accounts in various social networks, which are registered to email addresses from the list. You can do this with the well-known tool Holehe from @palenath.
Keep in mind that almost any command line tool can be run automatically many times in a row for a whole list of arguments (in our case name variants) using the XARGS utility.
If you are looking for a person from Russia, Ukraine and other former Soviet countries, try Telegram #osint bots (based on data from leaks)
This is not exactly a legal method and these bots are blocked all the time. Up-to-date links can be found at @HowToFind_bot
🧵(14/15)
Using the methods described above, you are sure to find social media accounts belonging to the target person.
The tools for collecting account data for each specific social network can be found in my collection of tools for #osint:
Also, when searching for information about a person by first and last name, you may have to deal with Google. Read this thread about how to automate and make working with this search engine more efficient:
- live maps (weather, fire, clouds)
- historic maps (worldwide, countries, towns)
- local conflicts and disasters maps
- satellite maps
- ability to upload your own maps
If you look at a person's history of posts on social media, you can gather a lot of interesting info about them. One of the simplest way to automate this:
Save the feed of posts in PDF (using the Ubikron ext or others)
Process PDF with different online tools (summarize etc)
A repository with text files containing a million dorks for finding potentially vulnerable web pages and sensitive data (in Google and other search engines).