A common challenge for OSINT practitioners and penetration testers alike is to fully identify the range of domains owned and managed by a particular organisation. Identifying the main domain that a company owns is usually fairly easy since it can be found in the second half of a company email ([email protected]) or as part of …
How To Identify A Company’s Domains With Azure AD Read More »
What’s the most boring part of Open Source Intelligence? Most OSINT practitioners (including me) usually enjoy the research phase of an assignment the most. Collecting data and finding new lines of enquiry is fun, but writing it all up at the end is usually dull. Well-written reports are a vital part of the OSINT process, …
If you’ve been interested in geolocation for any length of time, you’ll already be familiar with some of the most common tools that researchers make use of: Google Maps & Street View, Google Earth, reverse image search tools, Suncalc, and so on. There are many lesser-known tools that are also useful and can help to …
Being able to discover subdomains is an essential part of researching an organisation. Behind a company’s main domain there are many other subdomains that can provide useful information about an organisation’s structure, technology, and business practices. Subdomain discovery is a foundational skill for security researchers, but it is a very useful tool to add to …
In the last post we looked at the basic building blocks of the Open Street Map (OSM) database. Objects in the database are made up of single nodes, ways (which are a series of single nodes joined together), and relations (which are more complex structures where ways and nodes are combined). Tags are used to …
The Open Street Map database contains detailed information about almost every square metre of the surface of the planet. Land use, building types, rivers, park benches, pubs, streets and millions of other data points are all mapped out and documented in detail. You might be familiar with the browser-based Open Street Map (OSM) website. Superficially …
One of the biggest challenges of internet investigation is preserving data once you’ve found it. We have access to more information than ever before, but so much of it can be easily lost if we don’t take steps to archive it. If you’ve ever bookmarked an important resource only to come back later and see …
There’s a huge difference between countries when it comes to using publicly available records for OSINT. If you’re researching a subject in the USA there’s a wealth of available information. In the EU it’s almost the opposite and it can be very difficult to find any public data at all. The UK is much more …
Hunchly is an excellent OSINT tool designed to capture and record your browser activity as you go. Once activated it sits quietly in the background as you browse and saves copies of webpages as you view them. It also records searches, captures EXIF data from images, takes screenshots, and saves lots of other useful data …
Automation or Augmentation? Automation is an increasingly important part of OSINT. Even the simplest of investigations can require large amounts of different data types to be gathered and analysed quickly. Yet it is not accurate to suggest that all OSINT work is going to be automated as time progresses. Good OSINT practitioners will do …
Crypto Scam Investigation: Using Spiderfoot HX For OSINT Automation Read More »