Skip to content

Tag: SOCMINT

OSINT Quick Tips: That CashApp QR Code on The Web Might Actually Be Hiding a Profile Photo!

Published by hatless1der on March 26, 2024

If you do a lot of web-based OSINT research like I do, you’ve most likely conducted username searches using a powerful tool like https://whatsmyname.app that scurry out onto hundreds of websites in search of profiles bearing the username you’re interested in. In doing so, you may have come across CashApp user pages that usually bear a few common things: a cashtag (username), a display name, and most of the time… a seemingly useless QR code.

Or is it?

You see, while it is the case sometimes that the account holder hasn’t actually populated a profile photo, and therefore just displays a QR code, recently I noticed that the web version of profiles seems to display QR codes even when a profile photo is actually present for the mobile version of the account. Finding the photo (if one exists) from the web is quite simple if you know to look for it, and I’ll give you 2 different ways of doing it…

Note for the extra tenacious investigators out there: While what I’m going to show you works on the CashApp website, the thought process and application may be something you find useful elsewhere in your work too. Be curious, and see where it leads you!

Option 1 – Get Your Hands Dirty

The first, and more manual way, is to go to a profile page like https://cash.app/$JaneDoe (I made this one up so we’re not actually showing someone real here), and drill down in the source code of the page to the place where the profile photo is hiding, should one exist. I’m going to explain this as a Chrome user by the way, and yes, I am well aware of all the “Chrome sucks!” drums that some people like to beat for anyone that will listen.

Start by right clicking somewhere on the QR code and selecting “Inspect” from the menu of options that appear. This will open your browsers developer tools so you can have a look under the hood. The line you’re dropped on will be just a few above the one you’re actually looking for. Look down a few lines for the words:

<div class="mobile-only">

Expand this section by clicking the little triangle to the left of the line and keep doing this for the subsequent drop-downs that appear until you see (if one exists for the profile you’re on) a line that reads:

<img src="https://____________________________________.jpg

Now you can right click on the hyperlink for where the image is being delivered from in CashApp’s content delivery network (CDN), and open it in a new tab to view! Hovering over the hyperlink will show you a preview as well. It looks like this:

Great success!! (just kidding, I hated the movie Borat)

Option 2 – The Easy Button

I’m willing to be that several of you are smart cookies and probably thought of this second option as soon as you started reading the first one and saw “mobile-only”, but for the rest of us who just mash keys for a living, perhaps it wasn’t super obvious…

Open your developer tools using “Inspect” or a hotkey, then leverage that little icon near the top left corner of those developer tools to toggle your browser right on over to the mobile view. (This is something we use in OSINT all the time when we know that the display and/or functionality of a site will change to our benefit. I’m looking at you, Instagram follower lists!) Simply clicking that little button takes us right on over to the mobile view for CashApp and immediately confirms the presence of that image we’re looking for, without the need to invest our hard earned free time for the extra clicks!

Use this “mobile view” method first, and then take all the time you’ve saved to instead click share on this blog post. #shameless

OSINT Quick Tips: 2 Simple Methods of Getting Around Twitter’s Annoying Login Wall

OSINT Quick Tips: 2 Simple Methods of Getting Around Twitter’s Annoying Login Wall

Published by hatless1der on October 2, 2023

Based on how often Twitter, oh sorry… I mean X, is changing these days, there’s a pretty good chance this blog will be obsolete by the time you read it but here goes anyway…

Have you recently found yourself trying to visit a Twitter profile (when not logged in), and while it may initially load on the page, instantly you’re met with an annoying pop up after being redirected to a login prompt? Without a sock puppet account (which is getting harder to create and hang onto), you’re unable to get beyond that unexpected barrier.

ANNOYING.

Annoying, but not impossible.

That is, if all we need to see is the top portion of the profile page where the bio, location, links and other useful information is stored. If that’s all you need from the target’s page, here are a couple of easy options for you…

1. View Google’s cached result

Simple but effective. Google is allowed to crawl and index the profile, without falling victim to the dreaded redirect to a login page. Take advantage of that in one of two ways…

Locate the profile via Google search and simply right click the 3 dot menu next to the result. If Google has a cached version, you’ll find the button for “Cached” as an option in the resulting pop up.

The result is displayed in a way that most users will recognize as different than how the platform is designed to look, but the important part is that the profile information you need is there. This won’t load any posts, replies, media, or likes, but it will get you a look at everything appearing above.

Secondarily, you can try using Google’s “cache:” operator to query your way directly to the cached version of the profile page by typing in the text as shown here, replacing this username with the one you’re searching for:

2. Enter the profile via an indexed post from Google results.

If Google has crawled and indexed content that includes a status written by your target profile, or perhaps a comment they were @ mentioned in by someone else, you can visit the link to that post directly from Google and no login wall will appear. In a second, I’ll show you how to get to a clear version of the profile from there. First, we need to find a post/status/reply with our user in it.

There are lots of ways you can ask Google to find you these kinds of posts from the platform that contain the linked profile name of your target, here is just one example: 

twitter.com/fatusfee inurl:status

Simply click one of the results and head right on into the platform.

Now we’re in, we just need to click on the target’s name here in order to be directed to their profile page.
NOTE: Do not right click and open the profile in a new tab! This will trigger the redirect to a login page. Simply click right on their profile name and load in the same window you’re in.

GRIFFIN YOU LIED TO ME! THERE’S A DAMN LOGIN BOX ON THE SCREEN!

Deep breath.

Unfortunately, you can’t just “X” out of the box and view the page (see what I did there?). So if you are one of those overachievers who tried to run on ahead, welcome back.

While on the page like the one above, open your browser’s developer tools. It’s easiest just to right click on that login pop up box and choose “Inspect” from the options.

This will open the dev tools, and you can (while in the Elements tab), hover over the various lines and see the corresponding elements on the screen being highlighted. Just go up a handful of lines from where you are until your hovering is causing the entire pop up box to be highlighted, like you see here:

Right click and choose “Delete Element”. Poof!

Now you can close the developer tools and freely view the page, though as before, this will not include the profile’s posts, replies media or likes. You’re simply viewing the profile details, photo, banner and other user-supplied information.

Bonus tip… If you’re a bit of a perfectionist, like I am, and you hate that the opaque overlay is still over top of the entire the web page making the screen appear a bit greyed out, well you can delete that element as well. It’ll be the line just above where we previously deleted the box. Delete that and you’ll be viewing a beautifully clear page like the one below.

If you get a little too deletion happy and accidentally delete something important, never fear! Just reload the page and start again until you get it right.

OSINT Quick Tips: Beyond WHOIS

Published by hatless1der on September 25, 2023

In this Quick Tips blog post (yep, that’s a thing now), I’ll be showing you a couple additional (and quite useful) functions of my favorite WHOIS Lookup site, and hopefully adding a little something new to your ever-growing OSINT methodology.

Much like my desire to stay in college, this blog is going to be over just about as soon as it starts.

Disclaimer/Warning: WHOIS records can be falsified, outdated, and in the case of things like common names they may not even be same person you’re investigating.
Stop saying “I learned it from the internet” when you get in trouble for not exercising your own critical thinking skills 🙂

Performing a WHOIS lookup can be a pretty hit-or-miss tactic in OSINT investigations, let’s be honest. These days, it’s becoming exceedingly rare to find useful contact information in a website’s historic WHOIS records (though you should always check). Unfortunately for those of us hunting for digital clues, the use of privacy-guard features are pretty much the standard when you register a domain now.

You can’t escape your digital past though, and my favorite site to perform WHOIS history searches to find those OPSEC mistakes is Whoxy. A lot of you are probably familiar with the site already, but did you know it offers more than just a query using a domain name? Have a look…

Clicking the dropdown menu next to the search field on the top of the page reveals multiple options.

Searching by a person’s name is possible:

Click the drop down menu and select “Owner Name” before typing.

There are lots of places on the internet you can be searching the name of your target, from search engines to social media and everything between, but when was the last time you checked to see if the name you’re interested in comes in as registering a website? Selecting “Owner Name” from the dropdown and typing in a name will search for a match.

Searching by a company name is possible:

Click the drop down menu and select “Company Name” before typing.

Investigating a business? Good chance they’ve got some kind of web presence, and that can mean registering domains! A tip here, since you do not know how their company name will appear, you may need to try a number of variants based on what you’re seeing in other business records to find just the right search terms.

Searching by an email address is possible:

Click the drop down menu and select “Email Address” before typing.

Next time you find yourself with an email address, either work or personal, why not give Whoxy a try and see if there’s a website registered with it? You just never know, maybe your clever online criminal forgot about that time he registered a domain back in the day using his gmail, which you cleverly discover using this trick and then pivot over to captures of his old website on Archive.org to amaze your coworkers!

Searching by a domain keyword is also possible:

Click the drop down menu and select “Domain Keyword” before typing.

This one is by far my favorite! Think of how much we love using the inurl: Google search operator to look for keywords or phrases in URLs Google has indexed, and then think of just how much is being missed when we do that search. Domains that no longer exist, webpages with directives asking Google not to index them, domains who didn’t have any web pages on them at all but maybe had other uses, like email services running on them. Well, the “Domain Keyword” lookup is one hell of a powerful tool in those cases. Does your target have a username? Search it! Do you know their real name? Run it! Do you know their business name, telegram group, club name, or something else unique to them? RUN THEM ALL! Any of those things may appear in a domain name that Whoxy has some data on. The only thing limiting you here is your own creativity.

That’s it! That’s the blog. I sure hope this sparked some new ideas for you, and next time you’re doing OSINT research, remember… go beyond WHOIS!

A Veteran’s Day Plea: How OSINT Reunited 2 Long-Lost Soldiers.

A Veteran’s Day Plea: How OSINT Reunited 2 Long-Lost Soldiers.

Published by hatless1der on August 3, 2023

The faces and names shown in this blog are real, and are being used with their permission. Some details have been redacted or obscured to protect the privacy of others.

Every Veteran’s Day for nearly a decade, my friend Bill Stevens has attempted to locate and reconnect with a very special Army battle buddy of his from more than 20 years prior. For a number of those years, Bill has aired his pleas publicly via Facebook, accompanied by photos of this bygone era, in hopes that somehow his plea would go viral and word would reach his long-lost friend… but it never did.

Now, I’ve known Bill for a really long time, and for the past several years I have read these increasingly frustrated posts asking for someone to help him. Each year I wondered to myself if I might have any luck, should I try to help with the search. After all, I do find people online for a living, but finding an “Eric Garcia” with a last-known location from more than 20 years ago? Talk about looking for a needle in a stack of needles!

On November 11, 2022, Bill’s plea once again appeared in my Facebook feed. Incidentally, the fall of 2022 was the 5 year anniversary of the death of my best friend and Army veteran, Chad Jolson. Chad and I spent our formative years as 2 inseparable peas in a pod, and the 2 times I’ve cried the hardest in my entire life were the day he left for basic training and the day I eulogized him. I’ve carried this well-worn photo of him in my wallet every single day for nearly a quarter-century, and I still think of him all the time.

Perhaps it was the timing, perhaps just fate, but this time around I decided to reach out to Bill with an offer to have a go at tracking down his long lost friend. I know how close the bonds are that these brave men and women form in our military, and it’s clear that this person meant a great deal to Bill. It’s a total long shot, but if I can somehow help bring them back together, well… I want to try.

I reached out to Bill and asked for anything at all that he could remember that might help me in tracking down “Eric Garcia”, because you just never know when the smallest detail may be of significant importance when it comes to OSINT work. Unfortunately, I was starting out this search with very, very little information:

  • Name: Eric Garcia
  • Location: Ft. Gordon, Ga (1998-99)
  • Prior Location: Colorado
  • Company: Foxtrot 369

That’s it. That’s all we have to work with here.

It would be impossible for me to understate the amount of failure that followed, as I trudged through hours and hours of fruitless searching.

I started out the easy way, asking some friends in the military if some sort of public database exists and got a big fat no. Then I began focusing on Foxtrot 369, scouring military unit pages, Facebook groups, online articles, and anything I could get my hands on. After hours of going this route, nothing had paid off at all.

From there, I went the typical people-search website route, reviewing the contact information of every single “Eric Garcia” I could find with ties to either Ft. Gordon, GA or the State of Colorado who was born in or around 1980. Do you know how many people that is?? Spoiler alert… IT’S A SHIT-TON.

Now, it’s been well documented that I am stubborn at a nearly Olympic-level, but at this point in the process I’m thinking I might actually have to throw in the towel and admit defeat. I’m really not seeing how this is going to be possible with what little I have to work with. Having exhausted pretty much everything I could think of, I’m afraid this one seems to have gotten the best of me.

That pisses me off.

I hate failing, and I REALLY hate quitting. Time to dig deep.

Whenever I get stuck during an investigation, I always take the same approach… I back up and take stock of what I started with, looking for any ways I’ve missed that I can work with whatever information I have available. It occurs to me in that moment that I have one piece of information I’ve not yet explored at all…

The photo itself!

More specifically, the face of “Eric Garcia”. Yes, these photos are old, and yes they are a picture of a picture and not very high quality, but these days there are a number of free, open-source options for doing facial recognition** and also for upscaling low-quality photos. Some of these FR sites target images scraped from one specific platform, while others search their much wider, scraped databases. In rare cases, you can have some sort of success with search engines looking for a face, though they’re not great.
**Before you visit or use any of these sites, please understand the risks, laws, and policies that may govern your access or use of them. I am not your lawyer or your boss! (but go ahead and take tomorrow off)**

I search several of these open-source facial rec options, including search engines, and BOOM… one of them gives me some very promising results!!

Holy shit!!! Is that?

No way!

To my untrained eye, this certainly looks like a promising result, but these days we don’t need to rely upon my useless opinion, we have the benefit of a number of free AI-powered facial comparison tools like Amazon’s “Rekognition“. Let’s see what artificial intelligence says about whether this is a match to the “Eric” we are looking for…

99.8%? Ok then!

After countless frustrating hours, and nearly throwing in the towel on something that I REAALLLLYYYY wanted to solve, I’ve finally got something to work with!

There’s just one problem.

The URLs for the photos are cut off, intentionally. You see, this site is only willing to give me a teaser for free, but they want me to sign up for their service and pay them for the full results. SHIT!

It’s time to do what we do best. Get creative…

The part of the URL I can see tells me the domain begins with “hitched”. Based on the look of these photos, I’m thinking they’re from some kind of formal event… naturally, the kind where people get “hitched”. I suppose it could be that he’s just a very dapper dresser in everyday life, but even I (whose personal style is best described as “middle-aged, nostalgic, Midwestern dad) can tell that these are probably from a wedding and not how people dress in their day to day lives. Although I can’t discount the possibility that he’s gone on to become a famous menswear model, I decide to go with the wedding photo idea first.

I need to find these photos in the wild, but how? Instantly I wonder… could these results have been indexed by a search engine? Without the full website name, do I even have enough to find them?

Using the most fundamental OSINT skill of Google dorking, I craft query after query using the inurl: search operator coupled with the word hitched, and tack on a few potential keywords that I’m hoping might lead me to the site in question. By using this search operator, I’m asking Google to restrict the results to only URLs containing the word I specified (hitched), and combine that with a search for those other keywords I am interested in. These searches would look similar to something like this:

inurl:hitched wedding photography

As I begin to look through the results, I realize it’s inefficient for me to scroll through their entire websites as I find ones I’m interested in. I really need to be thorough here if I’m going to find that needle I’m looking for though! What if I ask Google to do the hard work again for me? Perhaps a dork that directs Google to query just what they have indexed from each of these sites I’m interested in, focusing on the keyword Eric. That would look something like this (for a site called hitched.com which was not the name of the site):

site:hitched.com eric

This is where being absolutely unassuming in your work will sometimes pay off. If you’ve noticed, I have been putting “Eric” in quotes throughout this blog. Did you wonder why?

The reason is that when I research something, I start broad, making the fewest assumptions I can because several times over the years something like this has happened:

While reviewing the Google results for one particular photographer’s site, I noticed something… One of the entries was for Erik + [Bride]

(I’ve removed her name for privacy, and from here on out will just type [Bride])

Could it be? I take a closer look…

Hell. Yeah!

As it turns out… I’d been given an incorrect spelling of the person’s name that I was looking for. It’s Erik, not Eric. How do you like that for an added layer of complexity?

But seriously… Hell. Yeah!

Ok, tv timeout here for a little soapbox moment. Let this be a helpful lesson for those of you crafting really complex Google dorks in order to find precisely what you’re looking for… It’s a double-edged sword at times. When you’re dorking, consider if it’s best to only be as restrictive as you need to be in order to get the result. I could have easily put the name Eric in quotes in my queries, asking Google to return only results with that particular name, however, I may have accidentally missed what I was looking for by having the Erik result filtered out. Google is doing me a favor here with something called “fuzzy searching” where they provide similar results. Annoying at times, but helpful in cases like this!
You can always add on more specificity in your searches as you go, and in this case I only needed to be completely restrictive about the site: portion of my request.

So let’s take stock of what I have so far…

After reviewing the wedding photos, I have the names Erik & [Bride] Garcia, I know what they look like, I know their August 3rd, 2013 wedding was at a well known venue in San Pedro, CA, I know the name of the Los Angeles photography company who did their pictures, aaaaaand… not much else. Do you know how many Erik Garcia and [Bride] Garcias are in and around the Los Angeles, CA area?

You guessed it! A SHIT-TON.

My first instinct was to take a look at the photographer’s social media. Surely, the bride or groom would have liked or followed one of the photographer’s social accounts, right? Wrong. More time wasted.

I wonder to myself if the photographer made a 2013 post touting their beautiful photography and the happy couple. That’s definitely the sort of thing that a bride and groom might like, right? Let’s find that! I hit the photographer’s Facebook, use the timeline filter feature to head back in time to 2013 and just like that, find the post I was hoping for:

Only… they didn’t like it. Or comment. Neither did their friends. Damn!

At this point in the story I’m back to doing a lot of spinning my wheels. A lot. I’m looking at online reviews of the photography business, the wedding venue, looking at social media pages, scouring posts and comments and shares. I’m grasping and grasping and grasping and nothing I’m trying is paying off.

Remember what to do when you get stuck?

Back up.

So I go back to the photographer’s post above and ask myself what else do I possibly have to work with? What is pivotable? What is unique? What have I overlooked? And then I see it…

#TheSepulvedaHome

The venue has a hashtag! This opens an entirely new set of doors for me because now I’m hunting the wider social media landscape looking for not necessarily just Erik & [Bride], but rather any of their wedding guests who posted photos using the hashtag #TheSepulvedaHome on August 3rd, 2013. If I can find just one wedding guest, maybe I can back into one of their social media profiles!

So I hit Facebook with a hashtag search, look back to 2013 and find this post…

There it is. Just exactly what I was hoping for! A perfectly preserved memory from just the right date, with just the right hashtag, and a mention of just the right couple. Oh, and several guests tagged as an added bonus. Jackpot!

Sidenote, this ends up being a sort of right place/right time situation in retrospect because doing that hashtag search on Facebook now only gives you a handful of results and no filtering by year options like it once had. If I was doing this research today I would have potentially dead-ended right there. Thanks Facebook, for constantly changing all of your best OSINT-use features! #RIPgraphsearch

Alright, so even looking back on this while I write it I’m still kinda feeling myself, so I’m just going to drop this little meme here:

I mean come on… Backing into an associate using the wedding venue hashtag??? If I live to be 1,000 years old I might never use that one again! But the thought process that caused me to back up, take stock of what I had to work with, and find another angle? Hell, I’ll probably do that again tomorrow, hopefully you will too.

At this point I’m expecting to begin my typical social media exploration research, find accounts for Erik & [Bride}, and leverage them to drum up ways for Bill to make contact. Easy enough, right?

I shouldn’t be surprised that this turned out to be harder than expected as well.

Exploring the profiles of the wedding guests for publicly available information eventually leads me to several wedding photo posts that @ mention an interesting username in the text. A username somewhat similar to the bride’s name, or what could be a nickname. Hmm… These aren’t tags like what you normally see on Facebook where a person’s name is hyperlinked to their profile, instead they probably came from the linked Instagram profile of the wedding guest posted them. This is a feature of these two Meta-owned companies, where you can cross-post content in both places. Since Instagram uses @ mentioned usernames in their posts, I head over there and find [Bride]’s Instagram account using the username mentioned in the Facebook post.

The profile (which is now private), had a great many photos on it from over the years but as I scrolled farther and farther down, something was missing… Erik. Now, I felt pretty confident that I had the right [Bride], she is in the wedding photos after all, but she is using a different last name in her social media and I’m beginning to suspect that perhaps the marriage ended at some point and that’s why I’m not seeing him. Could this end up being a dead end after all?

With this in mind, I go back to posts around the fall of 2013, looking to see if anyone who could be Erik comments or if any friend mentions Erik or tags an account that may no longer be hyperlinked, because that could still be viable for me to explore. Once again, tenacity pays off…

Following the tagged profiles in the comments on this post from just weeks after the wedding I come to tagged Instagram user @h8[redacted]

The profile photo is not great, but it sure looks a lot like the Erik I’m looking for. Now that I know he might be a Journeyman Lineman with Local 47, perhaps I can find other sites with information on him that I can pass along to Bill. Returning to Google for some keyword searches does the trick!

WAIT JUST ONE DAMN MINUTE!

Shaun??? You’ve gotta be kidding me. Not only did I start with an incorrect spelling of Erik’s name, but now it appears this wasn’t even his first name at all? If someone came to me and said hey I’d like you to find this person from 20 years ago, but I’m only going to give you their middle name and last name, and I’m going to spell one of them wrong I’d say…

And yet, lining up the original photo with the wedding photo and the LinkedIn photo, I see the truth, right there on the screen. Bill’s long lost friend “Eric Garcia” is really Shaun Erik Garcia.

I’ve found my needle.

From here I have more than enough to go on, and start hitting the usual people search sites with Erik’s name, age, hometowns, etc. It’s not long before I’ve drummed up a couple email addresses, physical addresses, and phone numbers to try. All of this is packaged up with the social media accounts and sent off to what I can only assume was a completely stunned, and very happy Bill.

Several months after I shared all of this information with Bill, I learned that he had successfully leveraged it to make the long overdue reconnection he’d started seeking so very long ago.

Once again, the power of OSINT saves the day.

I’d like to wrap this up by taking a moment to thank Bill & Erik for letting me tell this story, and also recognize Bill, Erik, Chad, and every single brave and selfless person who has courageously put their own lives on the line for the freedoms we enjoy.

An Overseas Businessman Died and Left Me $4.6M, So I Used OSINT & Social Engineering to Scam a Scammer.

Published by hatless1der on May 18, 2023

I received this email to my business back in 2022, and it landed directly in my spam folder, exactly as it should have…

It’s a scam so old it has become clichĂ© in much of the world. The overseas millionaire, perhaps a Prince, or in this case a rich & dead businessman whose living proxy has miraculously plucked me from the masses of all the email-owning people on earth to be the sole benefactor of an oddly specific fortune! What luck!
I mean, never mind the fact that I can’t even conjure up enough luck to win the monthly business card raffle at my local Subway restaurant, looks like things are finally turning around for me!

You ever wonder who’s on the other side of one of these emails?

Well I did, and although it seemed like an impossible feat at the time, I decided to take a swing at exposing the fraudster on the other end of the line and see what kind of end game they had in mind for me, their hapless and less privileged victim. What resulted was a wild OSINT and social engineering ride I’ll never forget!

To start off, I take a moment to define a goal. While things may change as we move along, at the outset I know that I want to elicit information from the scammer that may help me identify them in real life. Ok great, how do I do that? I need to think of the kinds of people the scammer expects to engage with when he or she is successful. Not very savvy? Perhaps unwise about technology? Maybe greedy? I’ll definitely need to play a role in order to accomplish my goal and I figure the more I act like like what they’ve experienced from prior victims, the more likely it is that I might draw something out of them.

How will this all go? Well I don’t know quite yet.

Although I am almost completely certain that I’m dealing with a freshly created throwaway email address, I can’t just assume they’ve not made some kind of mistake and not do the research on it. So I check all the usual boxes to start: run the email through breach data tools, https://haveibeenpwned.com, https://emailrep.io, Google, check the username portion in https://whatsmyname.app, etc etc etc. If you’ve spent any time doing OSINT work, you know those angles quite well, but if not, I would encourage you to check out my prior blog on pivoting off an email address HERE.

All of that was a bust, as expected. Now I know I’m going to need to start the active engagement at this point, so I fire up the VM, open a sock-puppet Gmail, and get to work. I’m not going to email them back from my work account and expose anything about me so this will be done under my favorite alias. (Bonus points to anyone who recognizes where the name Tommy Gemcity comes from) Hint: It may be spelled differently than the actual origin.

So I’m basically cold-emailing them from a new account they’ve never seen before, but given the fact that I’m sure they spammed countless email addresses in their quest for a victim, I doubted they’d notice at all. I was right. You might also notice my email signature where I’m actually taking a stab at (harmlessly) phishing them right back. The Treasure Hunter’s Club? Does that sound interesting enough to click on the link in my signature? If it did, their IP address would be instantaneously captured before they were redirected to a completely normal and harmless website I’ve pre-programmed to be the final destination. How you might ask? There are a number of sites and tools who shall remain nameless, that can help you set something like this up and may even let you choose from some pre-made URLs or use a link shortener to help make your IP-grabbing link look just a little bit more legit. (Blah, blah, don’t break laws, blah, blah, don’t violate policy, blah.

Now I will admit I started out a bit greedy here, and at this early stage of the game, our adversary was too wise to click on my tricky signature link. Let’s carry on.

A few days pass, and I receive a reply with good news! All they need in order to transfer my millions is: my full name, my address, my phone number, and a copy of my passport or ID. AMAZING!
Suddenly though, I get cold feet. You see, I’m a little leery about giving out my information online. Or so I say…

I’m hoping that my need for reassurance will result in the scammer giving me something I can work with. Let’s see what they come back with…

BRILLIANT! Turns out they had some concerns about me as well, but I’ve now proven myself the worthy recipient of this “legal and risk free” fortune, which is coincidentally my favorite kind of fortune! Let’s have a look at these OFFICIAL documents:

Now I’m no bank fraud investigator but I could tell these documents were authentic right when I noticed they used at least 6 different kinds of fonts. And while I’ve never actually seen what kind of paperwork you have to do when you drop that kind of coin in the bank, I definitely image there being lots of stamps and signatures, so check and check! Looking good to me! [rolls eyes]

The scammers are still waiting for my personal information, so I oblige, providing them with the address and phone number for the largest apartment complex in the United States and of course a link that will take them directly to the web page of Google files, while conveniently grabbing whatever IP address they might be using at the time. Yes, I’m trying that trick again. What have I got to lose?

I’m really starting to wonder though… what is their end game here? It can’t be just simple identity theft, can it? Perhaps more will reveal itself as we carry on.

As you can see, I’m being passed off to a new and much more official sounding email address. I will fast forward over this part of the story because it involves multiple email exchanges with them assuring me they are ready to transfer the money but need my ID photo, and me fumbling through various reasons why I can’t manage to attach a simple JPG to my email, trying to keep them on the line to expose something useful.

But in the meantime, something amazing happened… they clicked the link!

I’ve got an IP address to work with! Of course, I’m not holding my breath that this is going to be someone’s actual IP and not one of the zillions of easily accessible VPN IPs available to literally anyone with even the slightest ability to Google, but I’m still going to check…

I see that the Internet Service Provider (ISP) is Orange, from the Ivory Coast area in Africa, and I check it in several tools like https://maxmind.com, https://ipinfo.io, and https://dnslytics.com to see what they can tell me. All say Orange is the ISP, general area is Abidjan in Cote D’Ivoire, and now I’m seeing it’s negative for VPN/proxy/TOR/relay. This is looking really promising!

One other thing I like to look at for someone’s IP is a site called https://iknowwhatyoudownload.com, which checks for torrent download and distributions. In many parts of the world, this is still popular and while it might not offer me any value in terms of identifying someone, I can use this to get a sense of whether an IP might be from a VPN or not by looking at the volume. Many VPN IPs, when checked through this site, will reveal a very long list of torrents (often X-rated), that would be more than a typical household would consume on its own. In this case, the IP in question had just a handful of results for some TV shows, not what I would expect from a commercial VPN IP.

You might be saying to yourself, “all of this is great, Griffin, but it’s not getting us any closer to identifying someone!” You’d be right. Without a legal order or some kind of special access, finding the person behind that IP isn’t going to happen. Or is it?

You see, we have one hail mary left to throw here, and its our good old friend breach data. I call it a hail mary because it has only worked for me a handful of times over the years with IPs due to a number of factors around how they can be changed as well as the move to IPv6 from IPv4, but it’s still something worth checking. As it turns out, this IP address HAD been part of a data breach, and it was connected to someone’s account. Someone we’ll call “PB” from here on out.

This is (potentially) great news! I say potentially because there are a ton of asterisks that should accompany information like this. For one, it does not put this person behind the keyboard in my situation. For another, we do not know if this IP address from the breach is still with this person. The list goes on, but for the moment we’re going to call “PB” a person of interest and see where things go.

Now we get to the fun part, OSINT! We’re working with an email and a name, and we want to see who this person is, what they’re about, and where they are in the world.

Finding a foothold in this person’s online life was a challenge at first, because they do not go by their (presumed real) “PB” name in social media handles, they go by a version of what I will call “Bright Man”. Here’s a little tip for you… I was able to locate a Facebook profile for this person by letting Google do the work for me, creating a Google dork to view results indexed from Facebook specifically that included parts of the “PB” name in the URL. Something along the lines of site:facebook.com "TERM1 AND TERM2". You see, a lot of Facebook users may start out an account using their full name, and then adjust the display name to something new like Mr Bright Man did, but they never change the URL (yes that’s a feature). So when John Smith starts a Facebook account at facebook.com/john.smith and then changes his display name to Jethro Gibbs, well his URL will remain unchanged. I can’t even count the number of times I’ve found someone’s Facebook account by just trying firstname.lastname in the URL, try it out sometime!

OK, so Mr. Bright Man is merely a person of interest here, and may very well be unrelated to the scam so I’m going to blur him out, but I will say he had quite the online presence to explore:

I was also able to gather up several phone numbers and email addresses from clues left in his online posts and videos, as well as determine roughly where he lives by geolocating a few of his YouTube videos. So now I’ve got a decent handle on who this person of interest is, should that become helpful down the road.

All the while I’m researching Mr. Bright Man there’s still one question burning in my brain… what is the scammer’s end game? Obviously, scams are for money, but so far the worst thing they’ve tried to do is get a copy of my passport, address, and phone number. Could they monetize that? Sure. Is it more work than just getting me to send them money somehow? Yup.

And just then, the answer finally arrives in my inbox. It’s a bit small to read in the picture below, so let me just spoil the surprise for you now… it’s an advance fee scam. I’m being advised that the account holding my $4.6M is a “suspense account” which requires reactivation by way of paying a fee before they are able to release the full funds. I am offered two options: 1 reactivate the account and claim the very substantial interest accrued for the fee of $1260, OR reactivate the account and forego the accrued interest for a smaller fee of $860. Classic!

What kind of a money-hating idiot would turn down hundreds of thousands of dollars in accrued interest just to save $400 on fees? NOT THIS SOON-TO-BE MILLIONAIRE!! Sign me up for that $1260 fee right away please and thank you very much!

Is this the end then? That’s really all there was? Well, no. I’m not ready for this to be over. Much like Ted Lasso, I know the end will come eventually, but I won’t let myself think about it being over until the last possible moment. Goldfish memory!

I’m going to take one more stab at getting information from the scammers and see where it leads. If I assess what’s happened, I know they want me to send them money, I know they must have a way to get that money, and I know that their banking information may reveal new clues for me, so I press on. I’m ready to send the money, just tell me where…

Ah crap! Thomas Smith??? That just screams obviously fake.

But wait.

Aren’t they expecting me to send them money to this account? So that means they intend to get it. There must be more to this that what I though. Maybe Thomas Smith is actually a real person. Maybe Thomas Smith is a victim as well! You see, there’s this thing called a money mule, essentially a middle person usually uninvolved in the actual scam who facilitates movement of the funds involved. In some cases they are tricked, in some cases coerced, and in other cases they may actually get a cut of the money for performing services like cashing out and sending the balance elsewhere. (Work from home job scams anyone?)

I need a plan. Finding a Thomas Smith somewhere in the world is going to be impossible without some other kind of information, so I play the helpless, bumbling victim angle in hopes of gaining something I can use. I tell the scammer that my bank won’t allow me to transfer the money despite my best efforts, but let them know that I do have access to PayPal and Venmo instead if only they’d be willing to provide an email address or phone number for me to look up their account. But will they fall for it?

More has been revealed! Let’s get to work on finding Mr. Smith, and seeing what he’s all about. First, we check the PayPal profile using the search by email feature of the mobile app and see what appears.

A face! It’s a start, and we still have the email. If you’ve read any of my other blogs, you know how much I love the https://epieos.com tool for researching email accounts. In this case, I find that the email is connected to a Google account for Thomas, and that Thomas has left a number of reviews of businesses in a fairly tight geographic area.

Using Thomas’ very common name, and some of the names of towns near the area where he left those restaurant reviews, I start hitting the Facebook advance search feature. Combining his name with various town names, it doesn’t take me long to find an account with a face that looks remarkably similar to the PayPal I was referred to by the scammer.

Success!! As I look more into Thomas’ life, I realize that he’s most certainly not someone wrapped up in an international wire fraud scheme, he’s most likely an innocent victim himself, either being preyed upon or compromised in some way. I’d like to see if I can locate his contact information or residence now, because I have every intention of passing him off to local authorities who can help him. I return to his online life in order to gather more information. Part of what I do is read the many different business reviews Thomas has written looking for clues, and I discover one for a church. This particular review leads me to believe that Thomas is very active at this church and I wonder if their social media may have other photos or information about him.

Bingo! I read on and find other posts mentioning him, explaining his background, and listing his family members including his wife by name. This is more than enough information for me to hit some people search sites like https://truepeoplesearch.com and begin researching the addresses. I locate an address that appears to be current, but just to be extra sure I Google for the County GIS portal in order to research property tax information on the property address. You’d be surprised how many US Counties have these kinds of sites and searches available.

Just the thing I was hoping for. Thomas and his wife are both still listed on the property, and through the people search sites I was able to gather information for them as well as locate additional social media. More than enough information for someone to make contact with Thomas and help him out of the situation he may stuck in. Elder scams are sadly quite prevalent, and often extremely detrimental to their victims who can unwittingly lose large sums of money in a short period of time before even realizing something is not right. My hope for a happy ending here is that someone can help Thomas, and I know just the folks to do it.

My findings get packaged up into a report, and despite the fact that I never actually proved that Bright Man was behind the scam, I provided more than enough information to the authorities to demonstrate what was occurring and compel them to at least help Thomas. This was all delivered to a friend at a US agency who deals specifically with these types of crimes and who happened to have a fellow agent and friend right in Thomas’ area that would follow up.

Wow, what a journey that was! By playing the part of a clueless victim, I was able to take a run of the mill scam email, elicit potentially identifiable information from a person or persons halfway around the world, and by utilizing OSINT I was able to put together a significant amount of intelligence on a person of interest, and most importantly identify and lead authorities to a likely victim who may have really needed help. I’d say all in all that’s a pretty impressive result!

Thanks for sticking with me till the end. I hope you enjoyed the story, maybe picked up a few things, and most importantly became just a little more aware of the dangers lurking out there online.

A Snapchat OSINT Tip: Viewing Bitmoji Changes

Published by hatless1der on October 24, 2022

In today’s episode of “Blogs That Should Have Been a Tweet”, I want to give you a tip about Snapchat. More specifically, a tip about Bitmoji users on Snapchat. First though, let’s back up a few steps… Bitmoji is an app that allows users to create a cartoon representation of themselves by picking everything from features to accessories to clothing. You can use this “cartoon you” in many places online and in apps, but it’s most commonly associated with use in Snapchat (the company who bought Bitmoji back in 2016). An estimated 3/4 of all Snapchat users use Bitmoji!

It’s hard to overstate the value of posted photos in OSINT work. When people post photos of themselves, they’re giving you a glimpse at a moment in time, and seeing them with your own eyes can sometimes be the key to answering other investigative questions about your subject. (We are of course excluding that photo of me at the age of 12 standing outside Busch Gardens, sporting a Terminator wanna-be flat top haircut, tight-rolled acid washed jeans, a fanny pack, and glasses with the strap on the back while a parrot perches casually on my hand. No questions went unanswered in that masterpiece)

What about Bitmoji though? Can there be investigative value in viewing a person’s self-generated and self-depicting cartoon? Of course there can! Depending on the context in which you receive the image, it may help you to narrow a search pool of similarly-named individuals, refine your research based on certain visual factors, or even help you make comparisons to known social media accounts that are using or have posted the Bitmoji. Many users will make an effort to ensure their cartoon self is at least recognizably close to the look of their real self.

Now, before we go any farther, I know there’s at least one of you sitting at home shaking your head because there are soooo many variables here. After all, we are talking about someone making their own digital persona in any way, shape or form, using a robust but still finite set of features. Even users who are trying to stay true to form might just give themselves a little esthetic help where they’d like it. I mean, you should see the waistline on my Bitmoji, I haven’t been that thin since… well, the infamous Busch Gardens photo. Anyway, I get it. Like everything we do in OSINT though, in the proper context, it can be a clue.

Let’s say you have found your subject online in one social media site, and you’ve moved on to finding their accounts on other platforms. You’ve decided to start at Snapchat since you see they’ve posted a Bitmoji of themselves, and you know that chances are good that they may also have a Snap. You’ve got a real name and a username from the profile you’ve found, so you’re running username queries using the web version of Snapchat, but you’re just not sure if you’ve found the right person. The name is right, but the cartoon character smiling back at you… is not a match for the one posted by your known account. If you’re like me, you don’t take anything at face value! You probably wonder how long it’s looked this way, and what it may have looked like before.

Snapchat users with a Bitmoji avatar can make changes to the appearance of their cartoon persona any time they want, as much as they want, directly from Snapchat. When someone searched for them moments ago, they looked one way, but now… they may look completely different. Like this guy who used to be cool but eventually turned his life around:

This guy can’t wait for his high school reunion.

If only you could access a prior Bitmoji to compare with the one you’ve found in your earlier research, you could be that much more confident about the potential of your findings… well it turns out that sometimes you can, with a simple URL manipulation.

When you visit someone’s Snapchat profile page via the web URL, by adding their username to the end of: “https://snapchat.com/add/” you land on a page that can look a few different ways depending on the user. Some will simply be a Snap code or a recent Story, while others may contain no avatar at all or perhaps just the face, and those aren’t going to be our focus here. The one we want is one of the more common landing page possibilities, a full-body avatar image of their beloved Bitmoji that looks something like this:

Now you’re in business! When you find yourself on a profile that looks like this, and you want to view the looks of some of their prior Bitmoji, here’s what you do:

1. Right click on the Bitmoji image and select “Open image in new tab” – you’ll get a page that looks like this, which is serving you just their current avatar:

2. Review the last few characters of the URL preceding the .webp extension, they’ll look something like this:

3. When reviewing the URL of the image, you’re looking for that number immediately following the underscore (in the above case it’s 51). That number represents the version of Bitmoji you’re currently viewing. I wonder if the prior versions are stored there as well?
If you simply start changing those digits to lower numbers, refreshing the page and working your way back, you’ll see that they are! In this case, if you work back through the prior versions of their avatar you’ll see numerous changes, and when you get to version 35 you see this:

Interesting…
So does this previously stylish cartoon persona simply enjoy the comfort and freedom offered by wearing scrubs? Perhaps!
Or do they love hospital-themed, early 2000’s sitcoms featuring a prime Zach Braff? Trick question! Everyone loved that show.
More importantly, could they work in some type of medical position, and could that information align with other findings? It’s entirely possible.

There is a limit to this backward research, and at some point you’ll roll back to a number and suddenly the avatar will reverts to the current one. In the case of the above person, that happened after image 33. Anything 32 and prior will just show me the same current Bitmoji I started with at 51, but if my math is correct (and it rarely is) that means I was able to see 18 versions of this person’s digital self!

URL manipulation in OSINT research is nothing new, many of you will already know how to do things like view a higher resolution or larger sized profile image in certain social media sites by changing a few characters in the image URL. If not, I hope this idea sparked a bit of creativity for you and is something you’ll add to your thought process going forward, because it has a wide variety of use.

Ok, so there are a couple of takeaways here, allow me to summarize them:

  1. When Snapchat serves you up a profile page with a full Bitmoji avatar on it, there may be value in rolling back to previous versions for more information.
  2. Paying attention to where on-site content is delivered from on any site can be potentially valuable in your research.
  3. Manipulating the URL of media content can sometimes provide unexpected results.
  4. If you can’t laugh at yourself, then you’re doing life all wrong…
Don’t you dare put this on the internet!

UPDATE: Introducing The Backmoji Tool!

Following the release of this blog, THE Micah Hoffman aka @webbreacher on an internet near you, whipped up a quick UI tool that allows a user to follow the process outlined above, input a couple of variables from the Bitmoji URL they’ve discovered, and view an output of all available versions of the user’s Bitmoji all on a single page! Fantastic work my friend, as always!

To read his explanation of the tool, visit: https://webbreacher.com/2022/10/24/grabbing-old-bitmoji-outfits-with-backmoji/

To jump straight over to Backmoji, visit: https://webbreacher.github.io/osinttools/

Telegram OSINT Basics: 5 Tips Anyone Can Do Right Now

Published by hatless1der on August 3, 2022

A while back I posted a companion blog that was mostly a list of links from a talk I did on Telegram OSINT at the 2022 National Child Protection Task Force conference. The idea behind the talk was approaching Telegram for an OSINT investigation in the lowest-barrier ways possible, meaning not having an actual account on the platform, and utilizing a web browser rather than using the app on a mobile device. Is that you?
Many investigators either can’t get an account on Telegram (it does require a phone number) or only utilize a web browser for their investigative work, and while it’s not the most revealing approach… there are still plenty of things you can do to research Telegram “from the outside” and I’ve listed 5 big ones here. This should help get you started if Telegram is new to you or you find yourself restricted in your access.

A very quick primer on Telegram for the non-users… At the core of its purpose, it is simply an app for messaging and disseminating information. That can (most often) be from user to user, from user to an audience via a Channel, or from multiple users in a Group amongst each other. There are other features and nuances, but this is what you’ll find at the core.
Now let’s get down to some OSINT business…

  • Dorks! (Advanced Search Operators)

Whether you’re looking for Users, Bots, Channels, Groups, or something else… Good ole’ fashioned Dorks are your best friend. All you really need to know is the Telegram URL structure to craft your site-specific search, and some key words of interest. You’ll find Telegram content indexed by Google and other search engines in a couple common domains: t.me and telegram.me, which you can ask your search engine of choice to limit their results to when querying your little heart away. For example:

In Google, Bing, and DuckDuckGo –> site:t.me cryptocurrency
In Yandex –> url:t.me cryptocurrency

Each of these searches will return results in the respective search engines that have been indexed specifically from t.me URLs and have the word cryptocurrency on the page. Changing t.me to telegram.me would provide you with results found under the telegram.me domain name. I show several variations because there’s ALWAYS a chance that what you’re looking for may not be in the first place you look, so keep flipping those rocks!

When you think about the kinds of things people share in the bio or description section of their profiles, you may not be surprised to know that I’ve found names, emails, phone numbers, crypto wallets, websites, links to other socials, and many other potentially useful things. Get creative with what you seek!

There are several Google Custom Search Engines (CSEs) that are pre-built to search for Telegram content specifically and return them in an easy to navigate result. These are some of my favorite, and there are more in the prior blog post:
CSE “Telegago”:
https://cse.google.com/cse?q=%2B&cx=006368593537057042503%3Aefxu7xprihg
CSE by Francesco Poldi:
https://cse.google.com/cse?cx=004805129374225513871%3Ap8lhfo0g3hg
CSE “Commentgram”:
https://cse.google.com/cse?cx=006368593537057042503:ig4r3rz35qi#gsc.tab=0

  • View Full Description

OK, this is a fun one. Probably my favorite one. When you find yourself on a profile of interest, or perhaps a private group page that you can’t join, and you’re only collecting/analyzing what you can see from the public description… do you realize that there might actually be more than meets the eye? Have a look at this example:

So if you’ve reviewed the photo and just said to yourself “Griffin, you moron, everyone on planet earth already knows how to get the rest of that linked profile followed by the 3 dots. This is the most worthless advice you’ve ever given me!” First of all… I’ve no doubt given way worse advice that this, even just today. Second of all… of course that’s not the thing!

The amount of information that can be in one of those descriptions is much bigger than what you can see in the browser, and there’s actually a decent chance that you’re missing out on something useful, even beyond the obvious. But how do you get to the rest? You right click, right click, right click your way to victory™ of course!
Right click on and inspect the element which contains that text, and have a look at what’s in the code. As you hover over the different elements in the inspector, you might notice that the corresponding parts of the page are being highlighted, making it easier to find the piece you’re looking for. You may have to click on some of those little triangles to expand the drop-down details, but eventually you’ll find the element for “tgme_page_description” just like below:

Boom! What was previously unseen is now perfectly available to your investigative curiosity. Say it with me… MOAR WORDS! Yep, there’s more words than what you could see or even what you thought you were going to see. Much more in fact!

What if I told you I had an example where you’ve landed on a private group, and hidden on the page are their Instagram account, their Facebook account, and their custom bit.ly join-group link?? (that’s the kind of thing they probably post around the internet on other platforms you may wish to find them by the way) Well, of course it’s true:

So now you see that there may be more than meets the eye, and that’s very exciting, but I can literally hear some of you while I’m typing this saying to yourselves “Inspecting elements? Code? What do I look like, that guy from Mr. Robot?” Never fear! My good friend and fellow OSINT smart-guy webbreacher crafted a simple one-liner bookmarklet to make viewing the contents of this element as simple as the push of a button. Literally!

All you do is copy the following text, go into your browser bookmarks, create a new bookmark, and paste the text where you would normally put the URL for a bookmark and save. Give it a name you will remember and ba-da-bing:

javascript:(function()%7Bvar a %3D document.getElementsByClassName('tgme_page_description')%5B0%5D%3B alert(a.innerText)%7D)()

So now, when you’re on a Telegram profile, like the one above at https://t.me/joinchat/C-bhhEwufsxZaUsv0TiSdA, you just click that bookmarklet in your bookmarks bar and there you go! The element pops up on your screen for easy viewing like so:

  • Channel Preview URL Edits

When you preview a channel by clicking on the option available on the channel page you’ve located, if you’re lucky, you’ll find yourself in a sea of messages, beginning with the most recent. Exciting, right? Well, we all know that even the dumbest of us are smarter today than we were yesterday, so when was the most likely time that someone in a Telegram channel made an opsec mistake and leaked useful information? The beginning of course! So let’s say you’ve landed yourself here, alllllll the way at message #6,692 (see URL):

As you can see, the URL you’re starting on is t.me/areaofhacking/s/6692. Now, it’s obvious to you astute readers at home that changing that number on the end will immediately take you to a different post, but here’s a quick edit you can make to help in breaking down your research and review into manageable bites:

t.me/areaofhacking?before=100

This gives you the first 100 channel messages starting at 100, 500, 1000… what ever number you stick on the end. Great for when you have to break your review down into parts as you go on beer runs throughout the course of the day.

  • Getting The Exact Date & Time

When previewing a channel or (while logged in) looking at a specific message, you may need to find the exact date and time it was posted. Down in the lower right corner of the message you’ll see (while previewing a channel for example) a time. If you click that time, you’ll be taken to a static URL for that particular message, where you will then find the date added, like below:

Now, this isn’t EXACT, as you are no doubt ready to tell me… and when it comes to details, you and I are very concerned with being exact, so we’re going to dig deeper. Once again, we’re going to right click our way to victory and by right clicking on the time/date stamp & choosing inspect, we’ll be looking at the element “tgme_widget_message_date”, something like this:

If you’re paying close attention, which of course I know you are, you’ve noticed that there are 2 different times there. This may seem confusing, but never fear! The first time is in UTC, and the second time is translated to your (suspected) local time. If you’re doing things to obscure your machine, browser, location, etc… well that 2nd time may not be accurate, but you can always bet on UTC to be correct, which is exactly why Al Gore invented it!

  • Using Archives

Last tip for ya here, and it just might be the one that makes or breaks your next Telegram investigation. Don’t forget about the archives! When you find yourself reviewing Telegram content, you might just be surprised to find that the channel you’re reviewing has been archived in the past using everybody’s 2 favorite archive (yes, I know there are others) sites- archive.org and archive.ph (or archive.today or archive.is or whatever the hell tld they’re using at the moment). Each one of those sites will allow you to search for the Telegram URL you’re interested in and see what’s in their archives. Don’t forget about trying t.me and telegram.me when you search!
One final little bonus tip along the same lines… Try checking the Google cache version of a page to see if it may have been recently changed. Here’s an example of a user who has no text content in their bio, but a quick search using either a cache: search operator followed by their URL or by clicking the 3 little dots next to them in Google search results to view the Cache button shows us that the bio recently had some text in it after all, and that was captured by Google before it was changed! See the side-by-side comparison:

Well, I said 5 tips and we got through 5 tips. I hope you picked up something new, or perhaps picked up an idea you can try elsewhere in your investigative work, even if it’s not in Telegram! Some of things things are concepts that are useful across a wide variety of investigative work. Remember, nothing beats relentless curiosity, so keep looking and keep flipping over those rocks!

My 3 Favorite Facebook OSINT Tips & Tricks

Published by hatless1der on January 5, 2021

You’d be hard pressed to find an information rich source as robust as Facebook. With over 2.7 Billion active users (including my own grandma), it has to be a first stop for anyone conducting online research. There has been much written about gathering information from Facebook, and it remains one of the more popular OSINT subjects, which will likely continue until the simply misunderstood Google + makes its triumphant return to glory and… oh hell, nevermind. Let’s move on.

In trying to prepare for this, I spent many hours sketching out thoughts on my favorite tips and tricks for blue big brother, and eventually it became apparent that unless I wanted to write a book instead of a blog, this needs to be whittled down. Perhaps it’ll end up being a series of blogs one day. And perhaps I’ll print them all off, bind them, and make a cover page sporting a wind-blown, bare-chested, golden-haired super hunk, perched atop the rocks on a beach at sunset. (age check: If you’re super confused about what you just read, and you didn’t know that was a reference to Fabio, or if you thought of Fabio, but only know him as the guy in the butter commercials… you are too young to be reading this blog.)
Turns out it’s basically impossible to find a royalty-free image of Fabio online, and I’m not much for getting sued, but whoever this guy is, he doesn’t mind standing in for free. Besides, after a few beers, you can hardly tell the difference anyway.

https://www.freeimages.com/photographer/sagas-52953

So, this write-up is for my 3 favorite Facebook tips & tricks that I think everyone investigating online should know. One is technical, one is a URL, and one requires a little intuitive thought, which of course you have a truckload of. A preface… the thing you’ll never see from me is trying to take credit where it’s not due. I view my role here in large part as being someone who shares what knowledge I have gained through some trial & error, but mostly research, in a semi-relatable and poorly-written way. Regarding these tips, I can only take credit for teaching myself one of them, and while the other 2 have appeared in print all over the place, my earliest learning of them came from Michael Bazzell. Bazzell just released the 8th Edition of his book, and while tons of incredible free information exists online from stellar sites and collectives (like my favorite, the OSINT Curious Project), as far as books go, it has become widely regarded as the OSINT bible. Anyway, off we go…

The first tip is a URL you’ll want to have handy, so you can easily edit it with your target profile IDs and go:

https://www.facebook.com/browse/mutual_friends/?uid=1&node=2

This is known as the “mutual friends search” where the numbers 1 and 2 are to be replaced with profile user IDs. Basically, you’re asking Facebook to provide you a list of all friends common to 2 different accounts. The real beauty of this search is that it can work even when one of the profiles has their friends list set to private. 

Finding a facebook profile ID is as simple as right clicking on the profile’s page, selecting view page source, then pressing Ctrl + F and searching for “userID” without the quotes. The ID number will follow, looking like this:

Let’s talk about that for a minute…
Say you’re conducting online research and having a hard time finding your target profile. Being the top flight investigator you are, you begin searching for people in their close orbit based on information you’ve gathered from other online sources. Perhaps relatives, close friends, members of a similar social/interest group, friends/followers from a different social platform, co-horts from arrest records, a significant other from a baby registry, etc etc. If you manage to find some of what I call “orbit profiles” (people you know will most likely be connected to your target if your target actually has an account), but you’re not finding your target, perhaps the mutual friends search is in order! To put it another way, if your yet-unlocated target profile is Martin Robinson, Sesame Street Puppeteer, and you don’t know that he goes by the vanity name Young Snuffleupagus, you need some help. If Martin’s adorable grandma is on facebook, but has 1,000 friends, manual review is out of the question, ain’t nobody got time for that! What if you asked Facebook for mutual friends of nana and Martin’s wife, Annie? Suddenly, you’ve only got 50 people to review and ol’ Snuffy is bound to be one of them!
This trick also works well if you’re trying to develop a list of friend connections for a locked-down profile. Take your locked down profile, and run a mutual friends search with anyone who liked or commented on anything of your target and gather up those lists via a scraping tool, add them all together and boom… you’ve got a pretty decent list of people who are friends with your target!

https://pixabay.com/photos/universal-studios-singapore-2413365/

****EDIT**** in the Spring of 2021, Facebook killed off the following “page role trick” so it no longer works for searching an email address. Leaving this here for posterity, and to remind myself of how great life was “back in the day”.

Next up is a somewhat technical tip, again something I learned years ago from Bazzell’s book (actually, I think I might have read about it on the now-defunct forums on his website but my dusty old brain can only remember like 3 or 4 things, and 2 of them are the names of cereals I like). Big props to the ever-generous Technisette, who helped me trouble-shoot an issue with this trick and uncover an exception I’ll point out in the write up.
(Also, quick shout out to the HowToFind Bot, which also sent this tip out on Telegram recently, they put out some really great stuff and are worth a follow!)

This one is called the page role trick, and it’s the only known way to still search for Facebook accounts by email. As we’ve discussed in blogs past, much like my dream of being a catalog writer for J. Peterman, Facebook destroyed many of my other important dreams by killing its best OSINT features over the years #RIPgraphsearch. One that survived, albeit in a slightly different fashion is the ability to look up accounts by way of a linked email address.

Here’s a quick explanation of how it works… Basically, you create a new “page” using your covert profile, act like you’re trying to add someone as an admin for that page, open the developer tools, and use Facebook’s predictive analytics against it to reveal whose account is attached to the email address you have. If it works, you grab the userID, slap it on the end of a facebook.com/ URL and off you go! Here’s what it looks like…

First, click on the + in the upper right hand corner of your profile and create a new page:

Add in some info to the boxes on the left and hit save:

Once your page is live, go to settings at the bottom left:

Within the settings menu select Page Roles:

Type the email you’re looking for in the page role box.

When you type the last letter of the full email address, if it’s tied to an account, that account will autopopulate as an option just below the box and you’re in business! If it doesn’t tie, or if the account’s privacy settings prevent it (thanks again Technisette for figuring that headache out), you will not see a result below the box and it’s time to move on.
If you’ve got a match, you’ll be able to see the user name as well as the profile photo. Handy indeed, but we want to take it a step further, especially if that user name is as common as people (asshole scammers) calling me about my vehicle’s warranty.
Open the developer tools for your browser (F12 in Chrome & Firefox) and select the network tab, then the search icon:

In the search box type: ANYONE_EXCEPT_VERIFIED_ACCOUNT and hit enter to filter the information to a more manageable list.

Scroll to the bottom of the list in the search box and expand that entry by clicking the little arrow to the left, then click on the URL line which appears below. Make sure “Preview” is selected from the header in the details box as shown below:

There you’ll see the ID alongside the name. You simply take the user ID and place it after www.facebook.com/ to see the account!

You’d type the result like this: https://www.facebook.com/10002677560191

The 3rd and final tip I have for you is using the new search option on profile pages in the most recent Facebook UI. Not every page will have this option, but if they do, it will look like a magnifying glass either in the area just below the profile photo, or it could be in the 3 dots to the right of that header. 

This is something I stumbled across back early last year and wrote a much more comprehensive blog post about, (which I’m sure everyone has already read, bookmarked, printed off, tweeted about, and saved), but just in case… you can read here.
In essence, the search option on a profile page allows you to bring up posts, photos, comments, etc from a profile page which contain keywords or fuzzy search variations of those. For example, searching for the word mother will also bring up results for mom. The best part of this trick is that it will also search tagged posts & photos of that profile, as long as the post by their friend was set to public, even if they aren’t visible on the target profile’s timeline as you scroll the page! That’s a big win for your OSINT investigation. 
I discovered this while looking at a profile of someone who I knew was a Sr, and had a son by the same name. I wondered if searching Sr’s wall for their first name might provide some results. As I learned, searching first name, last name, or a combination of the two provided me all kinds of things I hadn’t previously found while scrolling the page!
Here’s an example of what that looks like, but I encourage you to revisit my old blog post for a detailed read.

The profile here is locked down, nothing visible on the wall:

When I search their wall for their first name, suddenly I get results! These are posts/photos that tagged the target profile, and are set to public for the original poster, but were hidden by the target on their own timeline.

This tip can open so many doors for you in your research. If you know family member names, search them to find pivot points. If you’re trying to validate whether you’re on the right profile, try searching for things you know about your target: their job name, their school name, the word birthday, the word kids (that’s where the closes friends/family members will be commenting), and on and on.

The possibilities are practically endless!

https://www.freeimages.com/photo/baby-boom-1240639

That’s it! My top 3 favorite FB investigative tricks. I hope you enjoyed the ride as always, and thank you to everyone who writes me and says they learned something or enjoyed something here. I have almost enough casual fans to start a bowling team, which is pretty good ROI for all the nights spent hacking out this content. I wish I had time to do more, but it turns out writing a mediocre and unpopular blog about a niche subject does not pay the bills, but it sure is fun!

Mining OSINT Gold… From Video Game Forums

Published by hatless1der on August 23, 2020

When a child is missing, every single minute counts. If you’re someone who practices #OSINTforgood (I’m looking at you, Trace Labs CTF participants), you know that the more recent the information is, the more valuable it can be. You also know that searching for information on younger folks in places like people search engines is nearly a total waste of time. So off you go to trusty, old social media… the land of screen names and acronym-speak. Well, next time you fire up your VM and hit the social network bricks, I want you to think beyond Facebook and Instagram, or even Snapchat and TikTok.

Studies have shown that roughly 3 out of every 4 US children & young adults play video games, and that mobile remains the most popular gaming platform, especially for the tweens and teens demographic. It’s not just kids though… in 2017, more than 192 million US citizens played games on their mobile devices. Another 86 million were monthly console or PC gamers. Many young people these days have a gamer handle well before they have a driver’s license, and on top of that, tens of millions worldwide take to the internet to join in discussions, trade ideas, even barter for accounts and upgrades over hundreds of forums and social communities. These communities can be a veritable gold mine of OSINT information, often including one tremendous piece of information… the last date/time a user was active online. 

Now, if your childhood video gaming experience involved the iron-clad-science-backed tradition of artfully blowing life into (and dust out of) the circuitry of clunky, plastic game cartridges, you’re probably wondering where to even begin with all this. Well, as it turns out, so was I!
So, I did what I always do when I find out there’s something new for me to learn, I grabbed a couple beers, opened up a notepad, and went to Google for some research! Come on, let’s take a ride…

In my opinion, this first point is a very important one in terms of investigative approach so try to make sure it goes with you today when you leave… Many of the forum websites dedicated to video games are often uniquely categorized based on some overarching theme like: a specific console type, a certain game genre, a group of games made by one developer, an individual game, or the geography of an audience. 

Why is this so important? Well, if the information you’ve been provided about your target, or your impressively robust SOCMINT research has led you to learn about their specific gaming interests, you can really dial in on searching key sites by querying Google for the forums dedicated to the games they like, what console they use, or what genre they’re into. In my opinion, that kind of thought process is what separates the great investigators (like you), from the good investigators (like not you). 

How much information can you expect to find on these sites exactly? Depending on the particular site, a lot actually. Of the 30 sites I focused on for this blog, all but 1 offered a place for users to provide some or all of the following: real name, location, birthday, join date, last active date/time, contact information, social media links, personal website links, or a written bio. The one that didn’t have any of that information? It gives a complete username history (pivot points!) including the date of change, for players of one of the biggest MMOG (massively multiplayer online game) on the planet, boasting 112 million monthly players… Minecraft.
In one case, I came across a forum user who linked his PayPal account for donations. One click later… instant email address! When you go beyond basic profile tags, and start reviewing thread comments and written bios, well the sky’s the limit for what kind of information you might find. Many of the forums even had an “Introduce Yourself” type subforum, and still others offered custom signature options that often include self-disclosed personal info as well. The moral of this and every SOCMINT story is… GO OUT AND GET INTO THE WEEDS! Here, look:

This 28 year old Leo would like you to know his real name, visit his website, and probably hates Carole Baskin.

Eli from Denmark was kind enough to post a photo of himself and tell you where he works and goes to school, along with a URL link to his personal website!

This aspiring game developer would like you to give him a donation, or have his email address.

Now, if you’re one of those crusty, old “tools don’t always work!” and “get off my lawn!” kind of people (like me), well… below is a list of those 30 sites I mentioned, each of them marked for whether they have a built-in user search function, if you need to be logged in, what profile information could be available, and if they are indexed by Google. There are plenty of other forum sites you can find, but these were some of the biggest and best, and are a great place to start. A little recon on the front end as mentioned above will help point you to the sites most useful for your search. In the last column I provided a Google dork (if one works for that site) where you can replace the word “username” with your particular target’s username. (seriously, get off my lawn) Not all of the parent sites are indexed, however, so you may need to navigate to them and use their onboard search tool. 

Available via Google Drive – click photo

Some of these forums contain thread-counts in the millions, and have an active user base well into the 6 figures

Now, before you jump over to my Twitter and start screaming at me through your still-cool LED backlit keyboard, I already know some of these sites are covered by all-in-one username search engines, but many are not, and beyond that, some sites use a combination of both the username and a unique userID in the URL, making a plug and play search solution challenging. Plus, we’re only scraping the surface there, and scraping the surface is not what great investigators like yourself do! 

All that being said, I do still encourage you to use the incredible username search sites and tools available to make your searching faster and easier, but I also wanted to stress the importance of developing an investigative thought process that takes you beyond just knowing where you can go to push a button that says “search”. 

Username Search Engines –
These all-in-one web tools can be a tremendous OSINT springboard, and a massive time saver, but I’d still encourage you to spend some time getting to know what sites they cover so you can decide where you may want to put some more manual effort in later on.

Since no one wants to read a theoretical blog with no links to any tools, three of my favorites, in alphabetical order are:
namechk.com – traditional, functional, and very easy to use.
usersearch.org – categorized searches, easy to use, already searches over 600 sites, and has offered to work on adding in these gaming forums to their searches! More to come on that!
whatsmyname.app (shout out to Micah WebBreacher Hoffman of OSINTCurio.us and Chris Poulter of OSINT Combine) nice clean web interface with a search by category feature.

All 3 of these offer different searches with some expected crossover, and are well worth having in your OSINT bookmarks as a first-stop site when you get to work on a case. Remember though, the best open source intelligence might still be elsewhere, and the one tool you can always count on is that mushy grey one, sloshing around between your ears! Happy hunting.

Think Private Facebook Profiles Pages Are A Dead End? Think Again!

Published by hatless1der on August 13, 2020

As the old saying goes… Facebook giveth, and Facebook taketh away (RIP graph search #neverforget).

Well, in late 2019, Facebook did a little bit (a lotta bit, actually) of both, with their facelift and feature overhaul, creating “new Facebook”. Different search options, new buttons, and an all-around different feel, sent many of us change-resistant folk into angry fits. After all, we’ve been betrayed before! Is this the Decline of Facebook Civilization part 2? (obscure 80s hair-metal movie reference)

If you’re using “new Facebook” perhaps not…

Let’s say you’ve finally arrived, after much strategic pivoting and searching, at your target’s personal profile page. Sweet success! You click excitedly and reach for the champagne as the page loads, but just as you’re about to get your Dom Perignon buzz on, you see it… their wall is blank. No photos, no posts, nothing but a single profile photo set atop a banner with empty boxes underneath. An investigative slap in the face for sure, especially when you’d been expecting to find troves of delightful SOCMINT goodness. How could this be? You had plans! You had dreams!

Now, before you pack up your investigative bags and head for Instagram, I have a little something you might want to see. “New” Facebook added a handy little feature that just might open some doors you weren’t expecting, doors that might remind you of the glorious graph search of old (seriously, #neverforget). That little search button on side of the profile page? It’s not just for what you can see. Here, let me show you…

Notice the profile page is of no use to us at all. Locked down… No photos, no friends, nothing. (profile photo and banner photo are redacted). Well… why don’t we click on that search button and type in the profile owner’s first name as it appears on the page:

BOOM! Suddenly, we’ve got something to look at besides an empty wall! Not only do we get several new photos of our target, but we’ve also acquired new pivot points, namely an account we’ll refer to as “A” who posted “family photos on a beautiful day”. But we’re not done yet…
Let’s try searching for the full first and last name as it appears on the profile:

Different photos! Not only that, but we have a potential fiancée’s name thanks to the photographer’s captions, and since the posts are several years old, let’s suppose they might have tied the knot and now we have the name of this person’s potential wife. Another pivot point!

A quick search for just the target profile’s last name by itself yields yet another unique photo and a business check in:

Now, before we get too far along with searches on our target profile, let’s pivot to the “A” account page on a new tab, and try searching there for our target’s first name:

You guessed it, more photos! Not only that, we see our target is being called Uncle, and his fiancée is being called Aunt. From there, we can surmise the marriage likely took place, and we now have a spouse, and another source of potential intel to work from.
Moving back to our target’s profile page, there are a number of other things worth searching that may yield even more new results. How about searching happy birthday?

Just like that, we have a potential birth date for our target profile owner, and the name of a brother, along with a (redacted) photo of both.

From this point we can go on and on, but I think you get the idea. Pivot to the other profile pages, search their walls for the target profile’s name, find more photos, find more names, search those names on the wall, and continue to expand this person’s network. The possibilities are limited only by your imagination. (and Facebook’s AI, but who understands that stuff anyway?) What about searching words like: mother, father, family, Christmas, Thanksgiving, work, love…?

Remember a few minutes ago when we were frustrated and ready to walk away from this account, and mark it as stone cold? Instead, we used this handy little trick and in just a few minutes, we’ve developed photos, a birthday, a spouse, a brother, some associates, and several other places to look for even more information. It went from a dead end to a small gold mine in just a matter of minutes because we knew where to look!

Next time you find yourself arriving at a target profile page, give this trick a try.  
Even those pages which are already more open will still yield information you didn’t expect, or would have had to dig, and dig, and dig to find. Let Facebook’s AI turn your searches to intelligence and click that button! We’ll call it graph search junior, for as long as it lasts.