bOSINTus
Speaker: Alexander Goncharov
Penetration Tester, Innostage
@Adkkkkkkkk
whoami
• PHDays, OffZone, Codeby, KazHackStan
OSINT mindset
• OSINT specialist
• CTF enjoyer
• sOSINTer
2
Agenda
Preparations
OSINT
▪ Basic
▪ Features
▪ Cases
GEOINT
▪ Basic
▪ Features
▪ Cases
Kid's level
Useful links
Practice Time
3
OSINT
OSINT is a category of challenges
in CTF events that involve
gathering information from
publicly available sources on the
internet to solve specific tasks.
4
Are you sure it's CTF?
5
The Many-Faced
6
Social Links
Must have Optional
7
I‘m fast as f*ck boi
[Link]
8
Discord OSINT
▪ Tools for searching groups,
messages [Link]
▪ Tools for searching bots
▪ Tools for searching for users
and information about them
▪ Discord OSINT attack surface
▪ Discord Dorks
9
Nickname search
1. Maigret 2. Sherlock
Collect a dossier on a person Hunt down social media
by username from accounts by username
thousands of sites across social networks (EU
based)
3. Snoop 4. Social-analyzer
Инструмент разведки на API, CLI, and Web App for
основе открытых данных analyzing and finding a
(RU based) person's profile in 1000 social
media \ websites
10
Email search
1. Mailcat
[Link]
Find existing email addresses
by nickname using API/SMTP
checking methods without user
notification.
2. socialscan
Python library for accurately
querying username and email
usage on online platforms
11
Case #1
Purple Watch has published a press release on its website,
find it!
12
Case #1
[Link]
▪ Instant Domain Checker ▪ Domains For Sale
▪ Domain Generator ▪ Search All Domain Extensions
13
Case #2
[Link]
▪ Some «Jarenierinili»
▪ Can you help us with any
leads?
14
Case #2 – Username search
[Link]
▪ VK
▪ GitHub
▪ Zhihu
▪ Pikabu
▪ Crunchyroll
▪ Pastebin
▪ Xing
▪ CreativeMarket
▪ [Link]
15
Case #2 – Honeypot #1
[Link]
16
Case #2 – Honeypot #2
[Link]
17
Case #2
[Link]
▪ Personal account/blog
Interest:
▪ Movies
▪ Cryptocurrencies
▪ IT
18
Case #2
▪ TG blog is filled with a
variety of content
▪ Significant part about
cryptocurrencies
▪ An unremarkable photo of
a Red Bull?
Photo from TG blog 19
Case #2 – Transaction analysis
▪ An unremarkable photo of a Red Bull?
20
Case #2 – Transaction analysis
▪ And that's where we start
to unravel the tangle.
[Link] 21
Case #2 – Transaction analysis
▪ After several hours of
analyzing addresses, we
find a wallet with "ERC-721
Token"
22
Case #2 – AI help
ChatGPT
23
Case #2 – Victory
[Link]
24
Case #3
25
Twitter Tips
from: @NASA
to: Codeby OR CyberSec
since:2022-02-24
Codeby-CyberSec
until:2022-02-24
lang:fr
Twitter Tips – Image description
[Link] 27
GEOINT
[Link]
GEOINT stands for
Geospatial Intelligence,
which is a field of
intelligence analysis that
involves the collection,
analysis, and visualization of
geospatial data
28
GEOINT - Reverse Image Search
Google Lens Yandex Images Bing
29
Case #4
[Link]
▪ Some signpost?
▪ We can take a look at the
inscriptions? – Yes, but it’s too
hard, let’s take the shortcut
30
Case #4
[Link]/images/
31
Case #4
[Link]
32
Case #5
33
Case #5
[Link]
▪ By reducing the search
area we increase the
accuracy of the data
output
34
Case #6
[Link]
[Link]
▪ Some building
▪ Google it?
▪ Metadata?
35
Case #6 - :(
36
Case #6
[Link]
What to do???
▪ Google it?
▪ Metadata?
▪ Pray?
37
Case #6 – [Link]
Caption
[Link] 38
Case #6 - Victory
[Link]
39
Case #7
▪ Pillar?
[Link] 40
Case #7
[Link]
▪ Okay, it's probably
Germany.
[Link] 41
Case #7 - Leaves
[Link]
▪ Fine, it’s Germany.
[Link] 42
Case #7 - Processing photos
43
Case #7 – Thoughts
[Link]
▪ Germany
▪ District with a high
percentage of of Turkish
residents;
▪ District with the support of
the Left Party.
[Link] 44
Case #7 - Victory
How?
[Link]
▪ With knowledge of the
neighborhood and city just
walked around for 2 hours
on google maps
45
IP/Domain research
1. 2. 3.
Identification of the owner Analysis of archived DNS Analysing whois / archived
records whois information
4. 5.
Searching for subdomains Google dorks xd
46
Website research at CTF
1. 2. 3.
[Link] Source code analysis Searching for domain links
4. 5.
Searching for subdomains WebArchive
47
IP/Domain research
[Link]/jivoi/awesome-osint [Link]/wddadk/Offensive-OSINT-Tools
1. Appropriate for more basic analysis 1. Appropriate for more detailed
IP/Domain analysis
2. Contains a large number of
different tools 2. Suitable for Offensive OSINT spec
3. Suitable for all OSINT specialists
48
OSINT for countries
Often CTF tasks are related to
the host country and you don't
know anything about it.
▪ Australia
▪ UK
▪ China
▪ Hungary
▪ Canada
▪ Japan
▪ Korea
▪ Netherlands Caption
* Other countries will be added later
49
OSINT CTF Tips
1. 2. 3.
Pay attention to the country Don't give up after two hours As cliché as it sounds, but pay
in which the CTF is held. spent on google maps. attention to details. The devil
OSINT tasks may be indirectly is in the details.
related to the country
4. 5. 6.
Try Harder © whoamins Play CTF and read WriteUp :) Use google dorks xd
50
Kid's level
1. Web archive 3. Google Dorks
If you have a
website/personal account, it
is a good idea to check the
WebArchive link
2. Metadata
51
Useful links
[Link] 52
Practice Time
▪ [Link]
▪ [Link]/quiztime
▪ OSINT: форум расследований
Resources for ▪ [Link]/geoint
practicing OSINT
▪ [Link]/GEO1NT
▪ [Link]/event/list/upcoming :)
▪ [Link]
53
Practice Time
▪ googledorking
▪ searchlightosint
▪ shodan
TryHackMe Rooms
▪ geolocatingimages
▪ somesint
▪ Sakura
▪ redteamrecon
54
Questions?
@adkkkkkkkk