Skip to content

@hatless1der | Blog Posts

My 3 Favorite Facebook OSINT Tips & Tricks

You’d be hard pressed to find an information rich source as robust as Facebook. With over 2.7 Billion active users (including my own grandma), it has to be a first stop for anyone conducting online research. There has been much written about gathering information from Facebook, and it remains one of the more popular OSINT subjects, which will likely continue until the simply misunderstood Google + makes its triumphant return to glory and… oh hell, nevermind. Let’s move on.

In trying to prepare for this, I spent many hours sketching out thoughts on my favorite tips and tricks for blue big brother, and eventually it became apparent that unless I wanted to write a book instead of a blog, this needs to be whittled down. Perhaps it’ll end up being a series of blogs one day. And perhaps I’ll print them all off, bind them, and make a cover page sporting a wind-blown, bare-chested, golden-haired super hunk, perched atop the rocks on a beach at sunset. (age check: If you’re super confused about what you just read, and you didn’t know that was a reference to Fabio, or if you thought of Fabio, but only know him as the guy in the butter commercials… you are too young to be reading this blog.)
Turns out it’s basically impossible to find a royalty-free image of Fabio online, and I’m not much for getting sued, but whoever this guy is, he doesn’t mind standing in for free. Besides, after a few beers, you can hardly tell the difference anyway.

https://www.freeimages.com/photographer/sagas-52953

So, this write-up is for my 3 favorite Facebook tips & tricks that I think everyone investigating online should know. One is technical, one is a URL, and one requires a little intuitive thought, which of course you have a truckload of. A preface… the thing you’ll never see from me is trying to take credit where it’s not due. I view my role here in large part as being someone who shares what knowledge I have gained through some trial & error, but mostly research, in a semi-relatable and poorly-written way. Regarding these tips, I can only take credit for teaching myself one of them, and while the other 2 have appeared in print all over the place, my earliest learning of them came from Michael Bazzell. Bazzell just released the 8th Edition of his book, and while tons of incredible free information exists online from stellar sites and collectives (like my favorite, the OSINT Curious Project), as far as books go, it has become widely regarded as the OSINT bible. Anyway, off we go…

The first tip is a URL you’ll want to have handy, so you can easily edit it with your target profile IDs and go:

https://www.facebook.com/browse/mutual_friends/?uid=1&node=2

This is known as the “mutual friends search” where the numbers 1 and 2 are to be replaced with profile user IDs. Basically, you’re asking Facebook to provide you a list of all friends common to 2 different accounts. The real beauty of this search is that it can work even when one of the profiles has their friends list set to private. 

Finding a facebook profile ID is as simple as right clicking on the profile’s page, selecting view page source, then pressing Ctrl + F and searching for “userID” without the quotes. The ID number will follow, looking like this:

Let’s talk about that for a minute…
Say you’re conducting online research and having a hard time finding your target profile. Being the top flight investigator you are, you begin searching for people in their close orbit based on information you’ve gathered from other online sources. Perhaps relatives, close friends, members of a similar social/interest group, friends/followers from a different social platform, co-horts from arrest records, a significant other from a baby registry, etc etc. If you manage to find some of what I call “orbit profiles” (people you know will most likely be connected to your target if your target actually has an account), but you’re not finding your target, perhaps the mutual friends search is in order! To put it another way, if your yet-unlocated target profile is Martin Robinson, Sesame Street Puppeteer, and you don’t know that he goes by the vanity name Young Snuffleupagus, you need some help. If Martin’s adorable grandma is on facebook, but has 1,000 friends, manual review is out of the question, ain’t nobody got time for that! What if you asked Facebook for mutual friends of nana and Martin’s wife, Annie? Suddenly, you’ve only got 50 people to review and ol’ Snuffy is bound to be one of them!
This trick also works well if you’re trying to develop a list of friend connections for a locked-down profile. Take your locked down profile, and run a mutual friends search with anyone who liked or commented on anything of your target and gather up those lists via a scraping tool, add them all together and boom… you’ve got a pretty decent list of people who are friends with your target!

https://pixabay.com/photos/universal-studios-singapore-2413365/

Next up is a somewhat technical tip, again something I learned years ago from Bazzell’s book (actually, I think I might have read about it on the now-defunct forums on his website but my dusty old brain can only remember like 3 or 4 things, and 2 of them are the names of cereals I like). Big props to the ever-generous Technisette, who helped me trouble-shoot an issue with this trick and uncover an exception I’ll point out in the write up.
(Also, quick shout out to the HowToFind Bot, which also sent this tip out on Telegram recently, they put out some really great stuff and are worth a follow!)

This one is called the page role trick, and it’s the only known way to still search for Facebook accounts by email. As we’ve discussed in blogs past, much like my dream of being a catalog writer for J. Peterman, Facebook destroyed many of my other important dreams by killing its best OSINT features over the years #RIPgraphsearch. One that survived, albeit in a slightly different fashion is the ability to look up accounts by way of a linked email address.

Here’s a quick explanation of how it works… Basically, you create a new “page” using your covert profile, act like you’re trying to add someone as an admin for that page, open the developer tools, and use Facebook’s predictive analytics against it to reveal whose account is attached to the email address you have. If it works, you grab the userID, slap it on the end of a facebook.com/ URL and off you go! Here’s what it looks like…

First, click on the + in the upper right hand corner of your profile and create a new page:

Add in some info to the boxes on the left and hit save:

Once your page is live, go to settings at the bottom left:

Within the settings menu select Page Roles:

Type the email you’re looking for in the page role box.

When you type the last letter of the full email address, if it’s tied to an account, that account will autopopulate as an option just below the box and you’re in business! If it doesn’t tie, or if the account’s privacy settings prevent it (thanks again Technisette for figuring that headache out), you will not see a result below the box and it’s time to move on.
If you’ve got a match, you’ll be able to see the user name as well as the profile photo. Handy indeed, but we want to take it a step further, especially if that user name is as common as people (asshole scammers) calling me about my vehicle’s warranty.
Open the developer tools for your browser (F12 in Chrome & Firefox) and select the network tab, then the search icon:

In the search box type: ANYONE_EXCEPT_VERIFIED_ACCOUNT and hit enter to filter the information to a more manageable list.

Scroll to the bottom of the list in the search box and expand that entry by clicking the little arrow to the left, then click on the URL line which appears below. Make sure “Preview” is selected from the header in the details box as shown below:

There you’ll see the ID alongside the name. You simply take the user ID and place it after www.facebook.com/ to see the account!

You’d type the result like this: https://www.facebook.com/10002677560191

The 3rd and final tip I have for you is using the new search option on profile pages in the most recent Facebook UI. Not every page will have this option, but if they do, it will look like a magnifying glass either in the area just below the profile photo, or it could be in the 3 dots to the right of that header. 

This is something I stumbled across back early last year and wrote a much more comprehensive blog post about, (which I’m sure everyone has already read, bookmarked, printed off, tweeted about, and saved), but just in case… you can read here.
In essence, the search option on a profile page allows you to bring up posts, photos, comments, etc from a profile page which contain keywords or fuzzy search variations of those. For example, searching for the word mother will also bring up results for mom. The best part of this trick is that it will also search tagged posts & photos of that profile, as long as the post by their friend was set to public, even if they aren’t visible on the target profile’s timeline as you scroll the page! That’s a big win for your OSINT investigation. 
I discovered this while looking at a profile of someone who I knew was a Sr, and had a son by the same name. I wondered if searching Sr’s wall for their first name might provide some results. As I learned, searching first name, last name, or a combination of the two provided me all kinds of things I hadn’t previously found while scrolling the page!
Here’s an example of what that looks like, but I encourage you to revisit my old blog post for a detailed read.

The profile here is locked down, nothing visible on the wall:

When I search their wall for their first name, suddenly I get results! These are posts/photos that tagged the target profile, and are set to public for the original poster, but were hidden by the target on their own timeline.

This tip can open so many doors for you in your research. If you know family member names, search them to find pivot points. If you’re trying to validate whether you’re on the right profile, try searching for things you know about your target: their job name, their school name, the word birthday, the word kids (that’s where the closes friends/family members will be commenting), and on and on.

The possibilities are practically endless!

https://www.freeimages.com/photo/baby-boom-1240639

That’s it! My top 3 favorite FB investigative tricks. I hope you enjoyed the ride as always, and thank you to everyone who writes me and says they learned something or enjoyed something here. I have almost enough casual fans to start a bowling team, which is pretty good ROI for all the nights spent hacking out this content. I wish I had time to do more, but it turns out writing a mediocre and unpopular blog about a niche subject does not pay the bills, but it sure is fun!

New LinkedIn Search Features Mean New OSINT Opportunities!

Let me start with a quick note of apology for my long hiatus. I know you all come here every day just constantly hitting refresh, hoping and praying, for anything at all! Turns out life has gotten really busy, and between my work with NCPTF, Trace Labs, conINT, and everything else… writing has really taken a back seat. Anyway, I’m glad you’re here and hope you find something useful and new.

In late September, 2020, articles like these began popping up regarding a major user interface (UI) redesign for everyone’s 5th favorite social networking site, LinkedIn, intended to make on-platform searching even easier. If you’ve seen the newest mobile design, you probably felt the familiar comforts of a Facebook-style menu bar across the bottom, and “stories” bubbled across the top. Finally, 2020 has given us something besides politics, conspiracies, and videos of a still-terrifying Mike Tyson training maniacally, just to spend 48 minutes hugging an old boxing adversary on pay-per-view.

So, you may be asking yourself… “Why do I care if a lame, old people social media platform like LinkedIn is now more like other (also lame) old people social media platforms?” Just kidding, that was actually a test. If you actually thought that, this is where you get off the ride kid. Go TikTok about Tide Pods, or whatever it is you do, grown ups are talking now.

Anyway, in their effort to help job seekers better leverage their site during this tragically tough time in the job market, they’ve built out more robust search options to help their user base more easily find the content they’re seeking. This is not just great news for those in the job hunt, it’s also great news for investigators, because if you’re conducting online research, your ability to find what you’re seeking just got that much easier! If you’ve ever done online research over the LI platform, you already know that people there are much more inclined to use their full & real name, a good clear photo of their face, share up to date contact information, list personal details you might not find anywhere else, all while connecting to people they may know on other social platforms. All of these things make LI one of the must-check locations when conducting online people research. After all, they boast 760 million users!

So let’s get right to it…

This first screen can be found at the following URL: https://www.linkedin.com/search/results/people/?firstName=&origin=FACETED_SEARCH

As you can see, there are some default search options across the top, but if you click on the All filters button, you’ll see even more pop up on the right. Now before I move on, take note of something else here. Just like so many other social platforms, LI is already trying to push me content based on what it knows about me (well, what it knows about my sock puppet, browser, IP address, and other potentially identifying data points). As a researcher, you can certainly use that to your advantage, and as a privacy conscious person you may want to mitigate that, but that’s a post for another day. 

In the “All filters” section, you’ll see the following options to select and sort your content by: Connections, Connections of (only works with people you are connected to), Location, Current company, Past company, School, Industry, Profile language, Open to, Service providers, and my personal favorite… KEYWORDS! Keywords for: first name, last name, title, company, and school. 

Taking a look at the list of initial suggestions from the search home screen, let’s just say our target was someone who worked at Eat Just, Inc but we don’t have much to go on besides just a name, and we need some pivot points for our research. We know there’s a good chance someone working there will have a more open profile, especially people working in HR or recruiting type roles. Adding in a filter for current employment of Eat Just, Inc gives us 192 results. Unfortunately, many of the people we see here have their names hidden from non-connections. That’s no problem for a super-sleuth like you though! 

We don’t have to look very far before we find someone currently employed there, with a more open profile, and a unique enough name to pivot away to another platform. Since we know many people will have friend crossover between LinkedIn and their other social platforms, you may want to jump to Facebook, IG or Twitter and begin a parallel thread of research there. Since Jessica’s name is visible, that’s a great place to start. A quick search on our old pals Facebook and Instagram give us plenty of pivot points to work with:

From there, we do a little digging and look to friends, associates, likes, comments, etc in the hopes we discover either our intended target, or someone else at Eat Just who may connect back to them. There are plenty of places to look beyond these sites though, so don’t stop there. One quick example thanks to a hit on Zoom Info via a very simple Google search gives us names of even more coworkers! 

Ok, back to the search filters again, and this time a little story. (DISCLAIMER: everything about this story is completely made up except the obvious reference to the greatest cinematic achievement of our lifetime… Super Troopers.)
I want you to close your eyes for a minute and picture that it’s a post-Covid19 world. No masks, no hand sanitizer, no opening doors with super annoying foot pedal things. Where are you? What are you doing? Naturally, you’ve just pictured yourself at a bar, knocking back a couple drinks with your pals. Shallow, yes, but I like your style. Now let’s pretend that bar is at a wedding, and since we’re pretending… of course, it’s an open bar. You’re standing there, watching the bartender add a little extra ‘tini in your 4th appletini when up stumbles your soon to be brand-new acquaintance, demanding 6 Schlitz’s… or whatever’s free. (that’s the Super Troopers reference you uncultured slob, go watch it)
Jared, as you unnecessarily learn, just flew in from Chicago and recently graduated from Harvard (which he tells you several times). Ever the polite conversationalist, you stand idly by nodding and smiling all while wishing a meteorite would come crashing through the roof and send you to the great open bar in the sky. Now, it takes you a good 30 minutes to escape the never-ending, spittle-laced barrage of bro’s and for realz’s coming from Jared’s gigantic Harvard educated head, but eventually you catch a break when he’s drug out of the place by security, for not knowing a single person even remotely associated with the event. To celebrate, you turn back to the bar for another ‘tini, and see ol’ Jared left his money clip there with $100 in it! Now, you’re no thief, but Jared is long gone. So after you tip the bartender, you need to find a way to return his $70 and the clip! What to do?

What if a LinkedIn search could help you? Since we can’t assume Jared is from Chicago just because he flew from there, what if we assume he’s from the state of Illinois? Will LinkedIn let us search that broadly? Indeed, they will!

From here, how about adding keywords for the other 2 data points we have? “Jared” in the first name box, and “Harvard” in the school keyword box. This will catch all the different variations of Harvard schools listed in LI, and since some users don’t share their full last name for privacy reasons, we will likely catch more people this way anyway.

Boom! Just like that, you’ve got a short list of 10 Jareds from Illinois who attended Harvard and of those, 8 have profile photos!

Now, even though we all know this kind of Jared would for sure have a profile photo, what if none of those 8 matched, and you wondered about the other 2? Of course, you PIVOT! How about a search on other social media sites for a Jared of the same name who matches the information shown? Could you find a photo of Jared Bass who works at Google? Of course you can, superstar!

Eventually, you’ll find your Jared in the mix, and like all of Jared’s social media platforms, his DMs are open, so you can now be the good samaritan you were raised to be, and return that $30 in his money clip, knowing you did the right thing!

(DISCLAIMER 2: None of the Jareds you see here, especially the ones who are lawyers, would ever act like the Jared in our story. They all seem like very fine people to me!)

Another handy little feature of searching LinkedIn is that the pre-populated options in some filters update as you’re searching and narrowing down a list of people, to include actual places where the people on that list have worked. Once again, this is a feature where you may be able put their platform to work for you. These are the options for the Harvard Jareds in Illinois once you’ve conducted that preliminary search, so if your wedding crasher pal mentioned any of them you could further zero in by going back to the filters to see what’s there. Something to keep in mind for larger lists of results.

You may have also noticed a feature which allows you to search the people connected to someone. In order to use that feature, your account must be connected to theirs. That’s going to be off limits for all the no-touch OSINT practitioners out there, but may be something that’s in play for certain folks with different parameters, so I still wanted to call it out. You’ll notice the search box will only allow you to select connections you already have when you start typing a name:

HOT TIP: kind of unrelated to what we’re talking about here, but did you know that you can leverage a built-in feature of Outlook email to find the LinkedIn accounts of email addresses you’ve added to your contacts at outlook.office.com/people? Just add the email as a contact, and switch to the LinkedIn tab of their contact card! (make sure you’re signed in to your LI sock puppet) In the privacy questions, you can say yes to sharing information from LinkedIn to your Outlook account, but say no to sharing info from your account to Linked in and this will still work! Thanks Microsoft!

That’s all for this one folks. I hope you’ve grown a little more fond of using LI in your searches, or maybe gained a few ideas of how to approach this kind of research and leverage data points to pivot. If you’re interested in learning more about LinkedIn searches and going beyond these basics, I highly recommend these great articles and videos by some exceptional people:

Intelligence with Steve (Steve Adams) – A Guide to Searching LinkedIn by Email Address: https://www.intelligencewithsteve.com/post/a-guide-to-searching-linkedin-by-email-address

“Dutch OSINT Guy” Nico Dekens for the OSINT Curious Project – 10 Minute Tip: Viewing LinkedIn Profiles Anonymously (Video): https://www.youtube.com/watch?v=bIAdx3CAjtM

Sinwindie for Sec Juice – LinkedIn OSINT Part I & Part II: https://www.secjuice.com/linkedin-osint-part-1/https://www.secjuice.com/linkedin-osint-techniques-part-ii/

“Matt” Maciej Makowski for OSINTme – How to Conduct OSINT on LinkedIn: https://www.osintme.com/index.php/2020/04/26/how-to-conduct-osint-on-linkedin/

As always, you can find me on Twitter: https://twitter.com/hatless1der

and you can find my The Ultimate OSINT Collection Startme here: https://start.me/p/DPYPMz/the-ultimate-osint-collection

Mining OSINT Gold… From Video Game Forums

When a child is missing, every single minute counts. If you’re someone who practices #OSINTforgood (I’m looking at you, Trace Labs CTF participants), you know that the more recent the information is, the more valuable it can be. You also know that searching for information on younger folks in places like people search engines is nearly a total waste of time. So off you go to trusty, old social media… the land of screen names and acronym-speak. Well, next time you fire up your VM and hit the social network bricks, I want you to think beyond Facebook and Instagram, or even Snapchat and TikTok.

Studies have shown that roughly 3 out of every 4 US children & young adults play video games, and that mobile remains the most popular gaming platform, especially for the tweens and teens demographic. It’s not just kids though… in 2017, more than 192 million US citizens played games on their mobile devices. Another 86 million were monthly console or PC gamers. Many young people these days have a gamer handle well before they have a driver’s license, and on top of that, tens of millions worldwide take to the internet to join in discussions, trade ideas, even barter for accounts and upgrades over hundreds of forums and social communities. These communities can be a veritable gold mine of OSINT information, often including one tremendous piece of information… the last date/time a user was active online. 

Now, if your childhood video gaming experience involved the iron-clad-science-backed tradition of artfully blowing life into (and dust out of) the circuitry of clunky, plastic game cartridges, you’re probably wondering where to even begin with all this. Well, as it turns out, so was I!
So, I did what I always do when I find out there’s something new for me to learn, I grabbed a couple beers, opened up a notepad, and went to Google for some research! Come on, let’s take a ride…

In my opinion, this first point is a very important one in terms of investigative approach so try to make sure it goes with you today when you leave… Many of the forum websites dedicated to video games are often uniquely categorized based on some overarching theme like: a specific console type, a certain game genre, a group of games made by one developer, an individual game, or the geography of an audience. 

Why is this so important? Well, if the information you’ve been provided about your target, or your impressively robust SOCMINT research has led you to learn about their specific gaming interests, you can really dial in on searching key sites by querying Google for the forums dedicated to the games they like, what console they use, or what genre they’re into. In my opinion, that kind of thought process is what separates the great investigators (like you), from the good investigators (like not you). 

How much information can you expect to find on these sites exactly? Depending on the particular site, a lot actually. Of the 30 sites I focused on for this blog, all but 1 offered a place for users to provide some or all of the following: real name, location, birthday, join date, last active date/time, contact information, social media links, personal website links, or a written bio. The one that didn’t have any of that information? It gives a complete username history (pivot points!) including the date of change, for players of one of the biggest MMOG (massively multiplayer online game) on the planet, boasting 112 million monthly players… Minecraft.
In one case, I came across a forum user who linked his PayPal account for donations. One click later… instant email address! When you go beyond basic profile tags, and start reviewing thread comments and written bios, well the sky’s the limit for what kind of information you might find. Many of the forums even had an “Introduce Yourself” type subforum, and still others offered custom signature options that often include self-disclosed personal info as well. The moral of this and every SOCMINT story is… GO OUT AND GET INTO THE WEEDS! Here, look:

This 28 year old Leo would like you to know his real name, visit his website, and probably hates Carole Baskin.

Eli from Denmark was kind enough to post a photo of himself and tell you where he works and goes to school, along with a URL link to his personal website!

This aspiring game developer would like you to give him a donation, or have his email address.

Now, if you’re one of those crusty, old “tools don’t always work!” and “get off my lawn!” kind of people (like me), well… below is a list of those 30 sites I mentioned, each of them marked for whether they have a built-in user search function, if you need to be logged in, what profile information could be available, and if they are indexed by Google. There are plenty of other forum sites you can find, but these were some of the biggest and best, and are a great place to start. A little recon on the front end as mentioned above will help point you to the sites most useful for your search. In the last column I provided a Google dork (if one works for that site) where you can replace the word “username” with your particular target’s username. (seriously, get off my lawn) Not all of the parent sites are indexed, however, so you may need to navigate to them and use their onboard search tool. 

Available via Google Drive – click photo

Some of these forums contain thread-counts in the millions, and have an active user base well into the 6 figures

Now, before you jump over to my Twitter and start screaming at me through your still-cool LED backlit keyboard, I already know some of these sites are covered by all-in-one username search engines, but many are not, and beyond that, some sites use a combination of both the username and a unique userID in the URL, making a plug and play search solution challenging. Plus, we’re only scraping the surface there, and scraping the surface is not what great investigators like yourself do! 

All that being said, I do still encourage you to use the incredible username search sites and tools available to make your searching faster and easier, but I also wanted to stress the importance of developing an investigative thought process that takes you beyond just knowing where you can go to push a button that says “search”. 

Username Search Engines –
These all-in-one web tools can be a tremendous OSINT springboard, and a massive time saver, but I’d still encourage you to spend some time getting to know what sites they cover so you can decide where you may want to put some more manual effort in later on.

Since no one wants to read a theoretical blog with no links to any tools, three of my favorites, in alphabetical order are:
namechk.com – traditional, functional, and very easy to use.
usersearch.org – categorized searches, easy to use, already searches over 600 sites, and has offered to work on adding in these gaming forums to their searches! More to come on that!
whatsmyname.app (shout out to Micah WebBreacher Hoffman of OSINTCurio.us and Chris Poulter of OSINT Combine) nice clean web interface with a search by category feature.

All 3 of these offer different searches with some expected crossover, and are well worth having in your OSINT bookmarks as a first-stop site when you get to work on a case. Remember though, the best open source intelligence might still be elsewhere, and the one tool you can always count on is that mushy grey one, sloshing around between your ears! Happy hunting.

Think Private Facebook Profiles Pages Are A Dead End? Think Again!

As the old saying goes… Facebook giveth, and Facebook taketh away (RIP graph search #neverforget).

Well, in late 2019, Facebook did a little bit (a lotta bit, actually) of both, with their facelift and feature overhaul, creating “new Facebook”. Different search options, new buttons, and an all-around different feel, sent many of us change-resistant folk into angry fits. After all, we’ve been betrayed before! Is this the Decline of Facebook Civilization part 2? (obscure 80s hair-metal movie reference)

If you’re using “new Facebook” perhaps not…

Let’s say you’ve finally arrived, after much strategic pivoting and searching, at your target’s personal profile page. Sweet success! You click excitedly and reach for the champagne as the page loads, but just as you’re about to get your Dom Perignon buzz on, you see it… their wall is blank. No photos, no posts, nothing but a single profile photo set atop a banner with empty boxes underneath. An investigative slap in the face for sure, especially when you’d been expecting to find troves of delightful SOCMINT goodness. How could this be? You had plans! You had dreams!

Now, before you pack up your investigative bags and head for Instagram, I have a little something you might want to see. “New” Facebook added a handy little feature that just might open some doors you weren’t expecting, doors that might remind you of the glorious graph search of old (seriously, #neverforget). That little search button on side of the profile page? It’s not just for what you can see. Here, let me show you…

Notice the profile page is of no use to us at all. Locked down… No photos, no friends, nothing. (profile photo and banner photo are redacted). Well… why don’t we click on that search button and type in the profile owner’s first name as it appears on the page:

BOOM! Suddenly, we’ve got something to look at besides an empty wall! Not only do we get several new photos of our target, but we’ve also acquired new pivot points, namely an account we’ll refer to as “A” who posted “family photos on a beautiful day”. But we’re not done yet…
Let’s try searching for the full first and last name as it appears on the profile:

Different photos! Not only that, but we have a potential fiancée’s name thanks to the photographer’s captions, and since the posts are several years old, let’s suppose they might have tied the knot and now we have the name of this person’s potential wife. Another pivot point!

A quick search for just the target profile’s last name by itself yields yet another unique photo and a business check in:

Now, before we get too far along with searches on our target profile, let’s pivot to the “A” account page on a new tab, and try searching there for our target’s first name:

You guessed it, more photos! Not only that, we see our target is being called Uncle, and his fiancée is being called Aunt. From there, we can surmise the marriage likely took place, and we now have a spouse, and another source of potential intel to work from.
Moving back to our target’s profile page, there are a number of other things worth searching that may yield even more new results. How about searching happy birthday?

Just like that, we have a potential birth date for our target profile owner, and the name of a brother, along with a (redacted) photo of both.

From this point we can go on and on, but I think you get the idea. Pivot to the other profile pages, search their walls for the target profile’s name, find more photos, find more names, search those names on the wall, and continue to expand this person’s network. The possibilities are limited only by your imagination. (and Facebook’s AI, but who understands that stuff anyway?) What about searching words like: mother, father, family, Christmas, Thanksgiving, work, love…?

Remember a few minutes ago when we were frustrated and ready to walk away from this account, and mark it as stone cold? Instead, we used this handy little trick and in just a few minutes, we’ve developed photos, a birthday, a spouse, a brother, some associates, and several other places to look for even more information. It went from a dead end to a small gold mine in just a matter of minutes because we knew where to look!

Next time you find yourself arriving at a target profile page, give this trick a try.  
Even those pages which are already more open will still yield information you didn’t expect, or would have had to dig, and dig, and dig to find. Let Facebook’s AI turn your searches to intelligence and click that button! We’ll call it graph search junior, for as long as it lasts.