OSINT technique for information gathering and Background Verification


We will see osint way to gather online info about the target. In this post I will use various open source tools and technique for passive information gathering.


Lets assume our target is shaquib izhar. All we have is this name and we need to find as much information about him as possible.

We will start with simple Google Dorking. My first query will be “shaquib izhar” this will give all websites, URL where this specific name is available. Let’s see what result we get from this search.




We got his twitter profile, quora and other social media accounts registered with this name. There’s also a link of about.me profile on Google search associated with this name. Let's go to that link and see if we can gather some another information.

Below we can see there’s a connect with me LinkedIn link of his profile


Now, because I am using a VPN, whenever I follow that LinkedIn profile link, it is asking me to login to view that profile. And we can’t login because it can notify the user that someone have seen his profile or if you have not configured your profile correctly then it can also reveal your identity.

And second case could be if the person is using LinkedIn pro feature, then he can see who was the LinkedIn user who has visited his profile.


But there’s a way to bypass this login and view that profile anonymously. Osint curious has done a great research on this. I will describe the method step step by step below.

Copy the LinkedIn profile link


Go to https://search.google.com/test/mobile-friendly and enter the profile URL then select test URL


As shown below, we can see his profile page, but there is a limitation we can’t scroll below to see other details.

But there’s a way to see his complete details on LinkedIn. Go to the HTML section of the page and copy the HTML code



Now go to https://codebeautify.org/htmlviewer/ and paste the code in it and select the beautify option



After selecting beautify option we will get a properly structured HTML code as shown below


Copy this code and paste inside the HTML input option


 Finally, after running the code we can see the LinkedIn user complete profile and his details.





Above we can see that I got all the details of the user’s LinkedIn profile anonymously. Let’s see if we can gather any more info about the target. In his LinkedIn profile he mentioned his portfolio link (shaquibizhar.000webhostapp.com) let see what we can get from there.




Looks like he has deleted this site let’s check for the archive version of this site.  I tried my search on archive.is and cache:shaquibizhar.000webhostapp.com but couldn't find any archive for this. but fortunately i was able to fetch the site at archive.org



Above I got his email. There are websites to search for leaked password of emails. Let’s see if we can get something from there. I am going to search on http://pwndb2am4tzkvold.onion


Great! We have got his password now it’s time to get his location and gather as much accurate information about his location as possible.

I will use grabify for making the IP tracer link and will spoof the link with other popular sites.

When the target will click on the link I will get his address, locations etc and the URL will be redirected to Google.com



Final Words


Above I got his IP location, Device Details ( Blurred some personal info)

So this was some basic techniques for passive information gathering using OSINT technique. There are  lots of other advance way to gather info about the target like getting his picture from his phone. Getting his available details from current company where he is working. Which I will cover in my upcoming post.

Connect with me on : Twitter , Facebook

Comments

Post a Comment

Popular posts from this blog

USB forensic : Find the history of every connected USB device on your computer

Image
Sometime we need to know what USB devices were connected to our computer in our absence.These information could be very useful for forensic examiner or in general case also where we just want to know what USB devices were used . How do this works We all know about registry on windows, a registry is a database in windows which stores settings of the operating system, hardware devices, software programs and user preferences settings. Whenever we insert a USB drive in a computers a registry key with name "USBSTOR" is created this registry key store information about that USB device and whatever info the OS need to know can be found in this registry key.  Finding the all attached USB history To find the usb  history of your device just do the following step below  STEP 1  Go to run and type "regedit".  STEP 2: In the registry go to  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR and there you will find a registry key with na
Read more

Crawling pastebin to find specific pastedump

Image
In this post we will crawl into pastebin.com to find specific pastebin dump. For example if we want to find paste for specific keyword like "password" we can get all the paste containing that keyword. Preparing the Attack Usually some sites don't allow web crawling and by doing so you may get banned from accessing that site, which will also make this method vain.  So before doing this i recommend you to use THIS tool to anonymize all your traffic so that if we get banned we can switch our IP address immediately.  Start the Attack STEP 1 Clone into this URL by typing https://github.com/kahunalu/pwnbin.git STEP 2 Now type python pwnbin.py -k pass -n 10 -m 10 here "-k" is the keyword you want to search for "-n" is the number of paste you want to crawl and "-m" number of keywords matches you want.  As we can see above we have found a match and it's now saved to log.txt file so it's time to see the dump co
Read more

Hack WinRAR password by using Brute force attack

Image
Winrar have option to password protect your files in it.Some times we got password protected rar files or we forget our password so we go online to search to crack password of these type of rar files.Some website tell about some program who promises to decrypt the password, But unluckily there are lots of spam ,advertisement, on internet who ask you to complete the survey to download the program that can unlock the password and absolutely that's a spam,some websites also provide direct link downloadable  program to crack rar password but when we download them instead of doing that, they install lots of unwanted sponsors software and make your PC slower.But now we have a easiest way to get the password of rar file by using brute force attack. No spam,no survey,no unwanted software and with proof.So lets start the hack and follow some simple  step by step guide given below.  1 > For example i am going to set password in rar file 2> Now when ever i am try
Read more

Fileless malware Analysis with Cuckoo sandbox

Image
What is cuckoo Sandbox Cuckoo is a dynamic malware analysis sandbox which is open source and completely free. We can submit any malicious binary file and cuckoo will provide a detailed report of the malicious file, including the behaviour of that file during execution.   What is Fileless Malware A fileless malware is a favorite technique for malware authors, what this type of malware does, it doesn’t write anything on the disk to bypass mostly string base detection. The malware executes an obfuscated command usually PowerShell and during run time antivirus could not detect the strings which are being executed and after injecting it in memory the command get deobfuscated. Cuckoo Interface and sample analysis To run cuckoo just type cuckoo from your terminal, this will start cuckoo service. Now to get the web interface type cuckoo run webserver this will start the cuckoo web interface on its defined URL and port address as shown below.
Read more

Web application penetration testing: Tools and Techniques for web security auditing

Image
Every pentester has it's own tool and technique for web app security auditing, Some time it depend on the type of website  we are pentesting. We are gonna see some common tool and technique that can help us to audit our web application security. Detecting web application firewall and other services You can start with by detecting is there any web application firewall in use? Later we can see if there's any way to bypass it.  Recommend tool :  fofa.so It is a cyberspace search engine launched by White Hat. It can help researchers or enterprises quickly match network assets by performing cyberspace mapping, for example, analyzing the scope of vulnerability.  shodan.io It is most poplar search engine among pentester for finding various online vulnerable IoT devices, online open ports f rom various web servers. wafw00f   This tool allow you to detect and identify what Web Application is in use that is protecting the website.  Bypassing Cloudfl
Read more