405 lines
8.4 KiB
Markdown
405 lines
8.4 KiB
Markdown
# OSINT Cheatsheet
|
|
|
|
Quick reference for Open Source Intelligence gathering, reconnaissance, and information discovery.
|
|
|
|
---
|
|
|
|
## Search Engine Operators
|
|
|
|
### Google Dorking
|
|
|
|
| Operator | Description | Example |
|
|
|----------|-------------|---------|
|
|
| `site:` | Search within site | `site:example.com` |
|
|
| `filetype:` | Find file types | `filetype:pdf` |
|
|
| `intitle:` | Search in title | `intitle:"index of"` |
|
|
| `inurl:` | Search in URL | `inurl:admin` |
|
|
| `intext:` | Search in body | `intext:password` |
|
|
| `cache:` | Cached version | `cache:example.com` |
|
|
| `"..."` | Exact match | `"admin login"` |
|
|
| `*` | Wildcard | `"admin * password"` |
|
|
| `-` | Exclude | `site:example.com -www` |
|
|
| `OR` | Either term | `admin OR login` |
|
|
| `..` | Number range | `$100..$500` |
|
|
|
|
### Useful Dorks
|
|
```
|
|
# Find exposed directories
|
|
intitle:"index of" "parent directory"
|
|
|
|
# Find login pages
|
|
inurl:login OR inurl:admin OR inurl:portal
|
|
|
|
# Find exposed files
|
|
site:example.com filetype:pdf OR filetype:doc OR filetype:xls
|
|
|
|
# Find config files
|
|
filetype:env OR filetype:cfg OR filetype:conf
|
|
|
|
# Find backup files
|
|
filetype:bak OR filetype:old OR filetype:backup
|
|
|
|
# Find exposed databases
|
|
filetype:sql "insert into" OR "create table"
|
|
|
|
# Find credentials
|
|
intext:password filetype:log
|
|
"username" "password" filetype:csv
|
|
|
|
# Find vulnerable pages
|
|
inurl:php?id=
|
|
inurl:index.php?id=
|
|
```
|
|
|
|
### Other Search Engines
|
|
- **Bing**: Similar operators, sometimes different results
|
|
- **DuckDuckGo**: Privacy-focused, `site:`, `filetype:`
|
|
- **Yandex**: Better for Russian/Eastern European content
|
|
- **Baidu**: Chinese content
|
|
|
|
---
|
|
|
|
## Domain & Website OSINT
|
|
|
|
### DNS & Whois
|
|
```bash
|
|
# Whois lookup
|
|
whois example.com
|
|
|
|
# DNS records
|
|
dig example.com ANY
|
|
dig example.com MX
|
|
dig example.com TXT
|
|
nslookup -type=any example.com
|
|
|
|
# Zone transfer (if allowed)
|
|
dig axfr @ns1.example.com example.com
|
|
```
|
|
|
|
### Online Tools
|
|
| Tool | URL | Purpose |
|
|
|------|-----|---------|
|
|
| ViewDNS | viewdns.info | DNS, IP, whois |
|
|
| SecurityTrails | securitytrails.com | Historical DNS |
|
|
| DNSDumpster | dnsdumpster.com | DNS recon |
|
|
| crt.sh | crt.sh | Certificate transparency |
|
|
| Shodan | shodan.io | Internet-connected devices |
|
|
| Censys | censys.io | Similar to Shodan |
|
|
| BuiltWith | builtwith.com | Technology profiler |
|
|
| Wappalyzer | wappalyzer.com | Tech detection |
|
|
| Wayback Machine | web.archive.org | Historical snapshots |
|
|
|
|
### Subdomain Enumeration
|
|
```bash
|
|
# Amass
|
|
amass enum -d example.com
|
|
|
|
# Subfinder
|
|
subfinder -d example.com
|
|
|
|
# Sublist3r
|
|
sublist3r -d example.com
|
|
|
|
# Certificate transparency
|
|
curl -s "https://crt.sh/?q=%.example.com&output=json" | jq -r '.[].name_value' | sort -u
|
|
|
|
# DNS brute force
|
|
gobuster dns -d example.com -w wordlist.txt
|
|
```
|
|
|
|
### Technology Detection
|
|
```bash
|
|
# Whatweb
|
|
whatweb example.com
|
|
|
|
# Wappalyzer CLI
|
|
wappalyzer https://example.com
|
|
```
|
|
|
|
---
|
|
|
|
## Email OSINT
|
|
|
|
### Email Verification
|
|
| Tool | URL |
|
|
|------|-----|
|
|
| Hunter.io | hunter.io |
|
|
| EmailHippo | emailhippo.com |
|
|
| Verify Email | verify-email.org |
|
|
| Email-Checker | email-checker.net |
|
|
|
|
### Email Discovery
|
|
```bash
|
|
# theHarvester
|
|
theHarvester -d example.com -b all
|
|
|
|
# Hunter.io API
|
|
curl "https://api.hunter.io/v2/domain-search?domain=example.com&api_key=YOUR_KEY"
|
|
```
|
|
|
|
### Email Header Analysis
|
|
| Tool | URL |
|
|
|------|-----|
|
|
| MXToolbox | mxtoolbox.com/EmailHeaders.aspx |
|
|
| Google Admin Toolbox | toolbox.googleapps.com/apps/messageheader |
|
|
|
|
---
|
|
|
|
## Username & People OSINT
|
|
|
|
### Username Search
|
|
| Tool | URL | Purpose |
|
|
|------|-----|---------|
|
|
| Namechk | namechk.com | Username availability |
|
|
| WhatsMyName | whatsmyname.app | Cross-platform search |
|
|
| Sherlock | github.com/sherlock-project | CLI username search |
|
|
| Maigret | github.com/soxoj/maigret | Sherlock alternative |
|
|
|
|
```bash
|
|
# Sherlock
|
|
python3 sherlock username
|
|
|
|
# Maigret
|
|
maigret username
|
|
```
|
|
|
|
### People Search
|
|
| Tool | Purpose |
|
|
|------|---------|
|
|
| Pipl | People search engine |
|
|
| Spokeo | US people search |
|
|
| BeenVerified | Background checks |
|
|
| ThatsThem | Free people search |
|
|
| TruePeopleSearch | Free US lookup |
|
|
| Webmii | Aggregated web presence |
|
|
|
|
### Social Media
|
|
| Platform | OSINT Approach |
|
|
|----------|----------------|
|
|
| LinkedIn | Company employees, roles, connections |
|
|
| Twitter/X | Public posts, followers, connections |
|
|
| Facebook | Public profiles, photos, check-ins |
|
|
| Instagram | Photos, locations, stories |
|
|
| GitHub | Code, email in commits, contributions |
|
|
|
|
---
|
|
|
|
## Image OSINT
|
|
|
|
### Reverse Image Search
|
|
| Tool | URL |
|
|
|------|-----|
|
|
| Google Images | images.google.com |
|
|
| TinEye | tineye.com |
|
|
| Yandex Images | yandex.com/images |
|
|
| Bing Images | bing.com/images |
|
|
|
|
### Metadata Extraction
|
|
```bash
|
|
# ExifTool
|
|
exiftool image.jpg
|
|
|
|
# View GPS coordinates
|
|
exiftool -gpslatitude -gpslongitude image.jpg
|
|
|
|
# Remove metadata
|
|
exiftool -all= image.jpg
|
|
```
|
|
|
|
### Geolocation
|
|
| Tool | URL |
|
|
|------|-----|
|
|
| GeoGuessr | geoguessr.com |
|
|
| Google Earth | earth.google.com |
|
|
| Mapillary | mapillary.com |
|
|
| SunCalc | suncalc.org |
|
|
|
|
---
|
|
|
|
## Password & Breach OSINT
|
|
|
|
### Breach Databases
|
|
| Tool | URL | Notes |
|
|
|------|-----|-------|
|
|
| Have I Been Pwned | haveibeenpwned.com | Check if email breached |
|
|
| DeHashed | dehashed.com | Paid breach search |
|
|
| LeakCheck | leakcheck.io | Email/username search |
|
|
| IntelX | intelx.io | Multiple data types |
|
|
| Snusbase | snusbase.com | Breach database |
|
|
|
|
### Password Policy Discovery
|
|
```bash
|
|
# Check password policies in AD
|
|
crackmapexec smb target -u user -p pass --pass-pol
|
|
```
|
|
|
|
---
|
|
|
|
## Business & Company OSINT
|
|
|
|
### Company Information
|
|
| Tool | URL | Purpose |
|
|
|------|-----|---------|
|
|
| OpenCorporates | opencorporates.com | Global company database |
|
|
| Crunchbase | crunchbase.com | Startup/company info |
|
|
| LinkedIn | linkedin.com | Employees, structure |
|
|
| SEC EDGAR | sec.gov/edgar | US public filings |
|
|
| Companies House | companieshouse.gov.uk | UK company data |
|
|
|
|
### Financial
|
|
| Tool | URL |
|
|
|------|-----|
|
|
| Bloomberg | bloomberg.com |
|
|
| Yahoo Finance | finance.yahoo.com |
|
|
| Google Finance | google.com/finance |
|
|
|
|
---
|
|
|
|
## Network & Infrastructure OSINT
|
|
|
|
### Shodan
|
|
```bash
|
|
# CLI
|
|
shodan search "hostname:example.com"
|
|
shodan host 1.2.3.4
|
|
|
|
# Common queries
|
|
org:"Target Company"
|
|
hostname:example.com
|
|
port:22
|
|
product:Apache
|
|
ssl.cert.subject.cn:example.com
|
|
```
|
|
|
|
### Censys
|
|
```bash
|
|
# Search syntax
|
|
services.http.response.html_title:"Example"
|
|
ip:1.2.3.4
|
|
autonomous_system.name:"Example ISP"
|
|
```
|
|
|
|
### BGP & ASN
|
|
| Tool | URL |
|
|
|------|-----|
|
|
| BGP.he.net | bgp.he.net |
|
|
| ASN Lookup | asnlookup.com |
|
|
| BGPView | bgpview.io |
|
|
|
|
---
|
|
|
|
## Wireless OSINT
|
|
|
|
| Tool | URL | Purpose |
|
|
|------|-----|---------|
|
|
| Wigle | wigle.net | WiFi network database |
|
|
| WifiMap | wifimap.io | WiFi passwords |
|
|
|
|
---
|
|
|
|
## OSINT Tools - CLI
|
|
|
|
### theHarvester
|
|
```bash
|
|
# All sources
|
|
theHarvester -d example.com -b all
|
|
|
|
# Specific sources
|
|
theHarvester -d example.com -b google,linkedin,twitter
|
|
```
|
|
|
|
### Recon-ng
|
|
```bash
|
|
# Start
|
|
recon-ng
|
|
|
|
# Install modules
|
|
marketplace search
|
|
marketplace install all
|
|
|
|
# Set workspace
|
|
workspaces create example
|
|
db insert domains
|
|
domains add example.com
|
|
|
|
# Run modules
|
|
modules load recon/domains-hosts/hackertarget
|
|
run
|
|
```
|
|
|
|
### SpiderFoot
|
|
```bash
|
|
# Run scan
|
|
spiderfoot -s example.com -o output.html
|
|
```
|
|
|
|
### Maltego
|
|
- GUI-based relationship mapping
|
|
- Entity transformations
|
|
- Visualize connections
|
|
|
|
---
|
|
|
|
## OSINT Workflow
|
|
|
|
```
|
|
1. Define scope and objectives
|
|
↓
|
|
2. Passive reconnaissance
|
|
- Search engines
|
|
- Social media
|
|
- Public records
|
|
↓
|
|
3. Domain/Infrastructure
|
|
- DNS, Whois
|
|
- Subdomains
|
|
- Technology stack
|
|
↓
|
|
4. People/Organization
|
|
- Employees
|
|
- Email addresses
|
|
- Usernames
|
|
↓
|
|
5. Breach data
|
|
- Exposed credentials
|
|
- Data leaks
|
|
↓
|
|
6. Document findings
|
|
- Organize data
|
|
- Create report
|
|
```
|
|
|
|
---
|
|
|
|
## Sock Puppets
|
|
|
|
### Creating Fake Identities
|
|
- Use AI-generated photos (thispersondoesnotexist.com)
|
|
- Create dedicated email (ProtonMail)
|
|
- Use VPN/Tor
|
|
- Build history over time
|
|
- Keep consistent persona
|
|
|
|
### Operational Security
|
|
- Separate browser/profile
|
|
- No real personal info
|
|
- Different IP addresses
|
|
- Avoid linking accounts
|
|
|
|
---
|
|
|
|
## Resources
|
|
|
|
### Websites
|
|
- [OSINT Framework](https://osintframework.com/)
|
|
- [IntelTechniques](https://inteltechniques.com/)
|
|
- [OSINT Dojo](https://www.osintdojo.com/)
|
|
- [Bellingcat](https://www.bellingcat.com/)
|
|
|
|
### Books
|
|
- "Open Source Intelligence Techniques" by Michael Bazzell
|
|
- "The OSINT Handbook" by Dale Meredith
|
|
|
|
### Training
|
|
- [TCM Security OSINT Fundamentals](https://academy.tcm-sec.com/)
|
|
- [SANS SEC487](https://www.sans.org/cyber-security-courses/open-source-intelligence-gathering/)
|