If you follow this blog, (hi mom!) you might think I’m somehow picking the most obscure platforms and coming up with some even more obscure OSINT tips for them (and you might be right), but if you follow this blog you probably also know that most of these tips are $$$. This tip on Pinterest is no exception, trust me.
It’s simple, it’s super useful, and it’s something I’ve successfully leveraged dozens and dozens of times over the years while investigating missing children online to discover case-breaking leads.
We’ll get to it in just a second, but first, for the sake of SEO and maintaining my spot on page 14 of OSINT blog search results, I need to say a few words…
Wait! Is this one of those blogs written like an annoying recipe website, where you have to read 10 pages of the author’s boring-ass life story before you find out how much canned chicken to put in the casserole your kids will be throwing in the trash in 45 minutes?
No, but now that I have your attention – the whole point of tricks like this one is that you’ve prioritized taking the time to actually understand the platforms you’re doing your investigative work on. Knowing their features and functions are vital to figuring out little wonders like this.
By the way it’s 1 can of chicken to go with the 1/2c mayo, and 2 cooking soups you mix with the cooked noodles.
So anyway… Pinterest? Yes, the… um… social media website pin-board thing [Googles “what is a Pinterest”]
According to data that I definitely knew off the top of my head and did not just look up using the aforementioned search engine: Pinterest is the 15th most used social media platform with 550M+ monthly users. For people using it, again definitely without looking any of this up, Pinterest is the 5th most popular social commerce platform.
So a lot of people use it, so what?
Well, our username research very often uncovers a seemingly useless Pinterest profile whose tab is promptly closed and ignored in most investigations. This is a huge mistake, let me tell you why…
Pinterest has a feature for signing up that allows you to sign up using your Google account, which does something magical for us in the OSINT world.
See, when you use the log in using Google feature (as many, many, many users do), Pinterest does something fantastic: they take the username portion of your email address, and make it your Pinterest username by default!
What does this mean, Griffin??? Why are you so excited about this??? Why does your generation think using 3 repeating question marks is ok???
It means in some cases we can reverse-engineer our target’s email address by putting it in front of the @emaildomain.com of our choice, and doing our email validation work to… well, validate it.
Boom!
Now, before I get too far along and the comment police come for me, let’s also discuss the limitations of this trick, because there are a few.
Like so many great tips:
First, Pinterest users can change their username in their settings (but really, who has time to do that when there are so many [checks notes] pins to… pin?)
Second, not everyone signs up this way. Some people with infinite free time may want to create an account the old fashioned way with a login and password like a maniac.
Third, I would assume username collisions happen with an app of this size and though I haven’t tested it, I also assume they make you pick or assign you a different username. (one of the infinite free time people can feel free to test that out)
Finally – remember that you always have to VALIDATE. Just because you get a positive result with the email address you’ve guessed, does not necessarily mean it belongs to your target. (See 1, 2, and 3 above)
Hopefully, this idea has opened your mind to thinking about what other applications who offer this function might provide you with a similar investigative opportunity. I have no doubt there are others out there!
If you’re not quite sure how to work with an email address to validate it, discover its use, or connect it to user accounts… I recommend reading this other very wordy and very poorly written blog: Advanced OSINT: The Art of Pivoting.
That’s it! That’s the tip for this one. Small, but oh so very mighty. I hope it helps you do some good out there in the world, it definitely has for me.
Bake at 350 for 25 minutes, then add cheese for the last 5 minutes.