“OSINT Investigations: We know what you did that summer” Notes
OSINT Investigations: We know what you did that summer by Information Warfare Center is packed with OSINT advice and resources, including tools. It has step-by-step instructions with screenshots. Because it’s a collection of articles from several authors, it reads more like a magazine than a cohesive book. Two authors are contributors to CSI Linux.
My notes follow.
This page contains one or more affiliate links. As an Amazon Associate, I earn from qualifying purchases.
- ReconSpider: aggregate raw data, visualize it on a dashboard, facilitate alerts and monitoring
- OSINT VMs: Kali, CSI Linux, Deft, CAINE
- Dradis CE: project framework for collaboration and reporting, with integrations with many tools
- OpenCTI: knowledge management database for CTI and cyber ops
- Karma: passive OSINT automated recon framework
- Hunch.ly: collects, documents, annotates every website you visit
- Aware Online: search for lost/deleted tweets
- Maltego: visualize data for link analysis and data mining
- Karmerka GUI: IoT & ICS recon tool
- Sublist3r: subdomain enumerator
- DNSRecon: DNS data collection
- ReconDog: vulnerability scanner for website and web apps
- ThreatResponder Forensics: agentless software to see if Windows endpoint is infected, online, offline, on-prem, in cloud
OSINT learning resources
- Search “OSINT site:medium.com”
- Search “OSINT site:site.me”
- Null Byte’s OSINT videos on YouTube
- training.csilinux.com, csilinux.com/tutorials
OSINT community projects
Sock puppet persona generators
Persona photo generators
Sock puppet social media account creation
- Use public Wi-Fi, not Tor or VPN
- Use persona’s non-VoIP burner phone number for verification
- Never tie account to your real accounts
- Change account’s phone number to a VoIP number
- Log out, then back in
- Start adding info to account
Age account (make it look real) by using same Wi-Fi where you created account to create content and take actions (like, comment, share, add friends, etc.).
VPNs & Tor
Kape Technologies has contributed to malware and adware distribution, and has acquired ExpressVPN, Private Internet Access, Zenmate, and CyberGhost.
Connecting to VPN before Tor provides better security; connecting to Tor before VPN provides better anonymity. Both approaches have downsides.
Dark web search engines: ahmia.fi, Torch, DuckDuckGo Dark Web
TorBox: dark web email service