Methodology | Preparation | Execution | Documentation

Pre-Operational Considerations Workspace & Tools

Time and Resource Constraints

Adversary Sophistication

Clean/Secure Workstation

Fresh Research Accounts

Collection Tools

Deliverables and Scope Clean/Secure Connectivity

Exposure/Risk Factors Clean Browser w/Extensions

OSINT Cheat-Sheet Investigative Resources – Summer 2019

Control Expectations Storage/Archiving Solution

Communication and Sit-reps Documentation System

Investigative Steps OSINT Resources

Knoll Your Tools

Document Your “Knowns”

Query, Sweep, and Pivot

Define The Question

Set Up Collection

Complete Reporting and Archive

Consolidate Findings

OSINTFramework.com

Netbootcamp.org

Investigativedashboard.org

OSINTBrowser.com

Workinukraine.space

Start.me/p/b56xX8/osint

Ethical and Legal Assessment

INTELTECHNIQUES .com

Tab Management

https://www.one-tab.com/ (Local Storage Only) Simple Tab Management/Export For Chrome and Firefox

https://chrome.google.com/webstore/detail/graphitabs/dcfclemgmkccmnpgn- ldhldjmflphkimp?hl=en GraphiTabs – Tree View of Tabs

http://tabsoutliner.com/ Tab Management – Outline Format, Export, Sync (Paid version)

http://www.gettoby.com/ (Account Bases w/Sync) Thumbnailed Tab Management For Chrome and Firefox

https://clusterwm.com/ Simple Tab Manager w/Export (Sync Premium Offered)

Useful Browser Extensions

https://www.onenote.com/clipper Screen Capture and Tag (One-Note Users Only)

https://github.com/ssborbis/ContextSearch-web-ext Context Menu Search Menu

https://github.com/az0/linkgopher/ Simple Link Extraction

https://getfireshot.com/ Screen Capture and Annotation (as image or pdf)

http://www.osintbrowser.com/ OSINT Bookmarks

https://github.com/mozilla/multi-account-containers#readme Firefox – Multi-Account Containers (Compartmentalization)

https://github.com/marklieberman/downloadstar Firefox – Download all items in a webpage that match a pattern

Link Analysis/Visualization

https://www.paterva.com/buy/maltego-clients.php Maltego CE and CaseFile

https://gephi.org/ http://www.automatingosint.com/blog/category/gephi/

https://medium.com/@raebaker/using-lampyre-for-basic-email- and-phone-number-osint-e0e36c710880 (Lampyre)

https://vis.occrp.org/ Create Link Charts – Organized Crime & Corruption Project

https://www xmind.net/ Mind Mapping – Free and Paid Versions

My Workstation Setup

Workstation – Win 10, PIA/ProtonVPN, Chrome/Firefox, Vbox, Bus- cador/Kali, Nox/Geny, Hunch.ly, UC Cable/Mifi, Keypass, Malware- bytes, Glasswire

Email/Payments – Prontonmail, GMX, Fastmail, Blur, 33mail, Priva- cy.com, Vanilla Visa

Alt-Hardware: MacBook Air, Atom Text Editor, VMware Fusion, Chrome/Firefox, Little Snitch

Mobile – iPhone, MySudo, Signal, Wire – Android, burner, unlocked, on Mint sim kit

Office Software – Libre, OneNote, Notepad++, CherryTree, Stan- dard Notes, Paper notebook, Teams/Slack/Mattermost/Rocket

Hypervisors: Virtualbox, Buscador Linux, Kali Linux, Genymotion, Nox

http://www.visualsitemapper.com/ Domain Mapping

https://www.draw.io/ https://github.com/michenriksen/drawio-threatmodeling

https://github.com/woj-ciech/Danger-zone Link IPs, Domains, and Email Addresses

https://www.mindmup.com/ Mind Mapping – Free and Paid Tiers

https://www.nodexlgraphgallery.org/Pages/Registration.aspx Powerful Graphing Client – Free and Paid Tiers

https://github.com/mozilla/multi-account-containers#readme Firefox – Multi-Account Containers (Compartmentalization)

https://webrobots.io/ Scrape YP, Yelp, Ebay, Amazon, etc. Save as Excel or CSV

https://www.gettabli.com/ Simple, Private (offline-storage only) Tab Management

Google Operators Remember we can string multiple operators together

site: Limit results to those from a specific domain site:apple. com

“ ” Quotes indicate search for exact term “red rider BB gun”

AND Only show results for both terms apple AND orange

OR Search for term A, term B, or both. A pipe symbol is the same as OR. gun OR rifle is the same as gun | rifle

* Wildcard for words in a phrase that you don’t know wish * a star

( ) Group a set of words/operators separately (gun | pistol) ammo

– Exclude results including this word chicago baseball -cubs

$ Search for a certain price “apple watch” $299

cache: Most recent cached version of a domain cache:boston. gov

filetype: Only search for specific filetype, ext: works the same filetype:pdf “confidential” or ext:pdf “confidential”

related: Search for sites related to a domain related:sony.com

intitle: Find pages with a term in the page title intitle:sabotage

inurl: Find pages with a term in the url inurl:private

around(x) Find pages with terms in X words proximity of each oth- er microsoft (7) surface

info: Sometimes shows related pages, cache date etc. in- fo:chicago.gov

Adv. Search https://www.google.com/advanced_search

Bing Operators Most of the Google operators work in Bing

( ) Just like Google, terms or operators grouped in paren- thesis are processed together and separate from other conditions

OR All Bing searches are treated as AND searches unless you specify OR between terms goat OR pig OR cow

NOT Exclude results with a specific term(s) the – symbol also works boat NOT (raft OR ship)

loc: Return pages from a specific region(s) dogs (loc:GB OR loc:FR)

prefer: Weight results in favor of a term prefer:tomato plum apple

near:x Words in x proximity of each other red near:4 blue

ip Finds sites hosted on an IP address ip:208.43.115.82

site/domain: Filter for specific domain type site/.gov confidential

feed: Finds RSS feeds based on search terms feed:osint

Bing Adv. MS retired Bing’s advanced search page

info:https://www.lifewire.com/bing-advanced-search-3482817

More Operators: https://ahrefs.com/blog/google-ad- vanced-search-operators/

DuckDuckGo DuckDuckGo handles some operators a little differently

Cats dogs Results about cats or dogs

"cats and dogs" Results for exact term "cats and dogs". If no results are found, we'll try to show related results.

cats +dogs More dogs in results

cats filetype:pdf PDFs about cats. Supported file types: pdf, doc(x), xls(x), ppt(x), html

dogs site:exam- ple.com Pages about dogs from example.com

Cats -site:exam- ple.com Pages about cats, excluding example.com

intitle:dogs Page title includes the word "dogs"

inurl:cats Page url includes the word "cats"

Startpage Startpage makes Google requests on your behalf (privacy)

Operators Most standard Google operators work

Adv. Search https://www.startpage.com/en/advanced-search. html

Search Tips https://support.startpage.com/index.php?/Knowl- edgebase/List/Index/1

Yandex Most standard Boolean operators work (Google operators) such as site:

and “quotes“

Adv. Search Click the icon in the search bar

lang: Language filter ccn lang:fr

mime: Similar to filetype mime:docx gdpr

date: Page modified date bombing date:20180416

url: Similar to site: but adding a * to the end of the url pulls up any docs sharing that url url: Alice url:en.wikiquote.org/wiki/*

special operators: https://yandex.com/support/direct/ keywords/symbols-and-operators.html

Baidu Most standard Google Operators work on Baidu

Adv. Search https://www.baidu.com/gaoji/advanced.html

In English http://www.baiduinenglish.com/

Search Tips https://www.seomandarin.com/baidu-search-tips.html

Other International Consider using a proxy or VPN to appear in the target region

Adv. Search https://www.alexa.com/topsites/countries

Colossus http://www.searchenginecolossus.com/

Occrp https://data.occrp.org/

Int. OSINT https://start.me/p/W2kwBd/sources-cnty

UK https://investigativedashboard.org/databases/

http://www.rba.co.uk/search/TopSearchTips.html

Twitter Don’t forget Google – “site:twitter.com keyword”

Advanced Search https://twitter.com/search-advanced

Toolset http://tweetbeaver.com/

User Report https://tinfoleak.com/

Analytics https://socialbearing.com/

Analytics https://analytics.mentionmapp.com/

Analytics https://foller.me

Analytics http://twiangulate.com/search/

Older Posts http://staringispolite.github.io/twayback-machine/

Search https://snapbird.org/

Followers https://doesfollow.com

Video https://twdown.net/

Visualization https://treeverse.app/

Profile Changes https://spoonbill.io/

Mapping https://onemilliontweetmap.com

Inteltechniques https://inteltechniques.com/menu/pages/twitter. tool.html

Legal Requests https://help.twitter.com/en/rules-and-policies/twit- ter-law-enforcement-support#19

Facebook Warning: Many of these tools may not function correctly as

Facebook continues to kill graph search capabilty. https://www. vice.com/en ca/article/zmpgmx/facebook-stops-graph-search

FB Expand http://com.hemiola.com/bookmarklet/

Messenger https://www.messenger.com/

Mobile View https://m.facebook.com/

FB Videos https://www.facebook.com/watch

Video Download https://www.fbdown.net/index.php

Video Download https://www.tubeninja.net/how-to-download/face- book

NetBootcamp http://netbootcamp.org/facebook.html (Warning: Netbootcamp.com does run tracking scripts)

Research Tools http://www.researchclinic.net/facebook/

User -> ID https://lookup-id.com/ (lookup-id.com runs some tracking scripts)

Graph Search https://inteltechniques.com/menu/pages/facebook. tool.html (Reminder FB Graph Is Broken as of 8/2019)

Graph Search http://socmint.tools/graph.htm

Graph Search https://peoplefindthor.dk/ Graph Search https://pitoolbox.com.au/facebook-tool/ Graph Search https://searchisback.com/ Graph Search https://whopostedwhat.com/ Graph Search https://www.uk-osint.net/facebook.html Graph Search https://github.com/sowdust/searchbook

Graph Discussion https://inteltechniques.com/blog/2019/08/02/ the-privacy-security-osint-show-episode-133/

Legal & Privacy https://www.facebook.com/safety/groups/law/guide- lines

Reddit Don’t Forget Google – site:reddit.com keyword

Topic Search https://www.reddit.com/search?q=keyword

User Search https://www.reddit.com/user/username

Analytics https://pushshift.io/api-parameters/

Archives https://web.archive.org/web/*/https://www.reddit.com/ user/username

Inteltech- niques

https://inteltechniques.com/menu/pages/communities.tool. html

TikTok https://www.ticktick.com

Search https://tiktokapi.ga/

Search https://www.osintcombine.com/tiktok-quick-search

How To IOS https://www.pageflows.com/post/ios/general-browsing/ tiktok

How To Android https://www.wikihow.tech/Find-Friends-on-Tik-Tok-on- Android

Downloader https://en.savefrom.net/download-from-tiktok

Video Caputre https://airmore.com/watch-tik-tok-pc.html

Legal Requests https://www.tiktok.com/en/law-enforcement

Instagram User/Tag Search https://www.yooying.com/search

User/Tag Search https://www.social-searcher.com/

Hashtag Search https://tagboard.com/

Analyze Followers https://hypeauditor.com/

Location Search https://www.osintcombine.com/instagram-explorer

Search https://mulpix.com/

Media Capture https://downloadgram.com/

Media Capture https://instasave.xyz/

Downloader https://www.4kdownload.com/products/prod- uct-stogram

Profile Pic https://instadp.net/

Profile Pic http://izuum.com/

Stories https://storiesig.com/

Image Search https://imgwonders.com/

User/Hashtag http://picdeer.com/

User/Hashtag https://www.pictame.com/

Inteltechniques https://inteltechniques.com/menu/pages/instagram. tool.html

Snapchat User Search https://somesnapcode.com/

User Search https://www.snapdex.com/

Loc Search https://map.snapchat.com

Loc Search https://sovip.io

https://storage.googleapis.com/snap-inc/privacy/lawenforcement.pdf

Site Archives Searching pre-existing archives or requesting a capture

Wayback Ma- chine http://archive.org/web/

Archive Today http://archive.fo/

How To – Belling- cat

https://www.bellingcat.com/resources/how- tos/2018/02/22/archive-open-source-materials/

How To – Tech.co https://tech.co/news/tools-to-help-you-search-the-ar- chived-internet-2018-06

Mass Archive Script https://github.com/motherboardgithub/mass archive

OSINT Resource Lists Collections curated by my favorite OSINT experts:

OSINT.Team https://osint.team/home (OSINT rocket chat group)

Ph055a https://github.com/Ph055a/OSINT-Collec- tion#ph055as-osint-collection

Bellingcat Tool- Kit

https://docs.google.com/document/d/1BfLPJpRty- q4RFtHJoNpvWQjmGnyVkfE2HYoICKOGguA/edit

Sprp77 https://drive.google.com/drive/folders/1CBcemF- dorkAqJ-Sthsh67OVHgH4FQF05

Baywolf88 https://www.learnallthethings.net/osint-resources

Sector0355 https://medium.com/@sector035

Justin Nordine https://osintframework.com/

Start.me’s: Technisette

Bruno Mortier Emmanuelle

-Welch Travis Birch

https://start.me/p/7kxL6K/search-engines

https://start.me/p/b56xX8/osint

https://start.me/p/gyXexK/dating-apps-and-sites

https://start.me/p/kx72n5/databases

https://start.me/p/rxeRqr/aml-toolbox

https://start.me/p/ZME8nR/osint

Reuser http://arnoreuser.com/osint-repertorium/

Phonexicum https://phonexicum.github.io/infosec/osint.html#tools

i-intelligence https://www.i-intelligence.eu/wp-content/up- loads/2018/06/OSINT_Handbook_June-2018_Final.pdf

PI Links https://diligentiagroup.com/due-diligence/101-investi- gative-links-for-digging-up-information-on-people/

Photo/Image Search Reminder: we do not upload sensitive photos to the internet

Search/Reverse https://images.google.com/

Search/Reverse https://tineye.com

Search/Reverse https://www.bing.com/images/

Reverse Russia https://www.yandex.com/images/

Reverse Asia http://images.baidu.com/

Search http://www.picsearch.com/

Twitter Search http://twipho.net/

Flickr https://www.flickr.com/map

Exif http://exif.regex.info/exif.cgi

Edit Detection http://www.errorlevelanalysis.com/

Basic Forensics https://fotoforensics.com/

Text Recog. https://www.newocr.com/

Stolen Check www.stolencamerafinder.com/

Document Search Google “keyword AND ext:pdf OR ext:docx OR ext:txt OR ext.xlsx”

https://psbdmp.ws http://www.findpdfdoc.com/

http://cryptome.org https://www.base-search.net/

http://megasearch.co https://psbdmp.ws

Video Extension https://www.downloadhelper.net/

Youtube-DL https://github.com/ytdl-org/youtube-dl

Extension https://addons.mozilla.org/en-US/firefox/addon/ video-downloader-profession/

Screen Capture https://www.techsmith.com/screen-capture.html

Video Archives https://archiving.witness.org/archive-guide/ac- quire/acquiring-raw-video-and-metadata/

Capture/Collection Tools Although not open-source, Hunch.ly remains my go-to ;safety-net & collec-

tion too.

Hunch.ly https://hunch.ly/try-it-now https://hunch.ly//guides

Screen Capture Extension https://getfireshot.com/

Snip & Sketch https://www.microsoft.com/en-us/p/snip-sketch/9mz- 95kl8mr0l#activetab=pivot:overviewtab

Annotation https://www.diigo.com/

OneNote Clip https://www.onenote.com/clipper

Spiderfoot https://www.spiderfoot.net/

Documentation Tools Hunch.ly’s Report Builder Is Great To Build Off Of

OneNote https://www.onenote.com

Win Text Editor https://notepad-plus-plus.org/

Mac Text Editor https://atom.io/

Backnote https://chrome.google.com/webstore/detail/backnote/ gcikdkpooobdlgkkimomdgochmclliek?hl=en-US

Paliscope https://www.paliscope.com (Free Standard Ed for LE)

Zotero https://www.zotero.org/

Private Notes https://app.standardnotes.org/

Office Alternative https://www.libreoffice.org/

Maps/Locations

https://www.google.com/maps https://www.osintcombine.com/ social-geo-lens

https://www.mapillary.com/ https://openstreetcam.org

https://ctrlq.org/maps/address/ https://livingatlas.arcgis.com/way- back/

https://www.gpsies.com/track- List.do https://www.zillow.com/

Classifieds Ebay https://www.ebay.com/

Fatfingers http://fatfingers.com/default.aspx

Flippity http://www.flippity.com/

Kijiji https://www.kijiji.ca/

SearchAllJunk http://www.searchalljunk.com/

SearchTempest https://www.searchtempest.com/

NotiCraig https://noticraig.com/

Oodle https://www.oodle.com/local/burien-wa/

Offerup https://offerup.com/

Craigslist https://craigslist.org

Inteltechniques https://inteltechniques.com/menu/pages/communities. links.html

User Names Knowem https://knowem.com/checksocialnames.php?u=

NameChk https://namechk.com/

NameCheckr https://www.namecheckr.com/

NameVine https://namevine.com/

UserSearch https://usersearch.org/

UserSherlock http://usersherlock.com/

Profilr https://www.profilr.social/search/

Tinder https://www.gotinder.com/@user

Amazon https://www.google.com/search?q=site%3Aamazon. com+%22name%22

SocialCatfish https://socialcatfish.com/reverse-username-search/ WhatsMyName https://github.com/webbreacher/whatsmyname

Sherlock https://github.com/sherlock-project/sherlock

Inteltechniques https://inteltechniques.com/menu/index.html

Real Name “People” search engines

TruePeopleSch https://www.truepeoplesearch.com/

Spokeo https://www.spokeo.com/

Thatsthem https://thatsthem.com/

Adv Background https://www.advancedbackgroundchecks.com/

Nuwber https://nuwber.com/

FamTreeNow https://www.familytreenow.com/

PeopelByNm http://www.peoplebyname.com/

UFind http://ufind.name/…

PublicRcrds https://publicrecords.directory/

GoLookup https://golookup.com/

PMR http://publicemailrecords.com/name listings

Radaris https://radaris.com/

Cubib https://cubib.com/

ComLullar http://com.lullar.com/

Yasni http://www.yasni.com/

TabSearch https://www.zabasearch.com/

Spytox https://www.spytox.com/

Intelius https://www.intelius.com/

ZoomInfo https://www.zoominfo.com/

Whoodle https://www.whoodle.com/

PeekYou https://peekyou.com/

Webmil http://webmii.com/

CvGadget https://cvgadget.com/

Classmates https://www.classmates.com/

192 (UK) https://www.192.com/

Inteltechniques https://inteltechniques.com/menu/pages/person.tool. html

Email Don’t Forget A Basic Google Search “[email protected]”

Hunter.io https://hunter.io/ (make a free account)

HIBP https://haveibeenpwned.com/ (may be premium soon)

Verify https://tools.verifyemailaddress.io/

Verifalia https://verifalia.com/validate-email

Mailtester http://www.mailtester.com/testmail.php

FindThatEmail http://findthat.email/

AnyMailFinder https://anymailfinder.com/

EmailMatcher https://emailmatcher.com/

ProspectLinked https://prospectlinked.com/#/home

MetricSparrow http://metricsparrow.com/toolkit/email-permutator/

ThatsThem https://thatsthem.com/reverse-email-lookup

Spokeo https://www.spokeo.com/email-search

PsbDmp https://psbdmp.ws/

HackedEmails https://hacked-emails.com/

OCCRP https://data.occrp.org/search?q=gmail.com

Dehashed https://dehashed.com/

Hashes.org https://hashes.org/leaks.php

Gravatar https://en.gravatar.com/site/check/[email protected]

ReverseGenie http://www.reversegenie.com/searching=email

ManyContacts https://www.manycontacts.com/en/mail-check

ComLullar http://com.lullar.com/

Inteltechniques https://inteltechniques.com/osint/menu.email.html

Basic Guide https://www.blurbiz.io/blog/the-most-complete- guide-to-finding-anyones-email

OSINT Flow Charts: https://www.dfir.training/osint

Domains/IPs

Censys https://censys.io

IntelX https://intelx.io

Domaintools https://www.domaintools.com/

CentralOps https://centralops.net/co/

Whoxy https://www.whoxy.com/

IPLocation https://www.iplocation.net/

DNSLytics https://dnslytics.com/reverse-ip

Randhome https://www.randhome.io/blog/2018/02/23/harpoon- an-osint-/-threat-intelligence-tool/

CrimeFlare http://crimeflare.org:82/

Spyonweb http://spyonweb.com/

Pub-DB http://pub-db.com/

Whoisology https://whoisology.com/

Visualping https://visualping.io/

WatchThatPage http://watchthatpage.com/

PentestTools https://pentest-tools.com/information-gathering/ find-subdomains-of-domain#

SharedCount https://www.sharedcount.com/

SmallSEO https://smallseotools.com/backlink-checker/

SimilarWeb https://www.similarweb.com/

Alexa https://www.alexa.com/siteinfo/inteltechniques.com

Hunter.io https://hunter.io/

ViewDNS https://viewdns.info/

Robtex https://www.robtex.com/?=

Majestic https://majestic.com/

D-Me http://d-me.info/

Netcraft https://www.netcraft.com/

DomainBigData https://domainbigdata.com/

Inteltechniques https://inteltechniques.com/osint/domain.search.html

Inteltechniques https://inteltechniques.com/blog/2018/04/24/search- ing-subdomains-with-findsubdomains-com/

IP6Locator http://ipv6locator.net/

ViewDNS https://viewdns.info/

Maxmind https://www.maxmind.com/en/home

IP2Location https://www.ip2location.com/demo/

IPFingerprints https://www.ipfingerprints.com/

ThatsThem https://thatsthem.com/reverse-ip-lookup

Netbootcamp https://netbootcamp.org/websitetool.html

Shodan https://www.shodan.io/

Inteltechniques https://inteltechniques.com/menu/pages/ip.tool.html#

Phone Numbers For phone #s consider gov/paid options (OSINT is limited)

Zaba https://www.zabasearch.com/reverse-phone-lookup/

USPhoneBook https://www.usphonebook.com/

TruePeopleSearch https://www.truepeoplesearch.com/#

Whitepages+ https://whitepages.plus/

ThatsThem https://thatsthem.com/

TrueCaller https://www.truecaller.com/

Whitepages https://www.whitepages.com/reverse-phone | Reverse Phone Lookup

411 https://www.411.com/reverse-phone

CellRevealer https://www.cellrevealer.com/

FoneFinder http://www.fonefinder.net/

WhoCalld https://whocalld.com/

SpyDialer https://www.spydialer.com/

Searchbug https://www.searchbug.com/tools/

NumberGuru https://www.numberguru.com/phone/

ReverseGenie http://www.reversegenie.com/

YellowPages https://people.yellowpages.com/whitepages/?re=SP people search

Spokeo https://www.spokeo.com/reverse-phone-lookup

PhoneValidator https://www.phonevalidator.com/index.aspx

CallerIDTest https://www.calleridtest.com/

IMEI https://www.imei.info/

IMEI24 https://imei24.com/phone base/

Sync https://sync.me/

Infobel https://www.infobel.com/

DialingCode http://www.dialingcode.com/

OpenCnam https://www.opencnam.com/

TeleFoonGids https://telefoongids.2link.be/

ServiceObjects https://www.serviceobjects.com/developers/lookups/ geophone-plus

WTNG http://www.wtng.info/index.html

SeanLawson https://www.seanlawson.net/2019/02/use-chrome- developer-tools-view-masked-phone-numbers-for-free- people-search/

NANPA https://www.nationalnanpa.com/enas/coCodeRepor- tUnsecured.do?reportType=7

Inteltechniques https://inteltechniques.com/osint/menu.phone.html

Vehicles CarOwners https://carsowners.net

NICB https://www.nicb.org/vincheck

OReilly https://www.oreillyauto.com/

Carvana https://www.carvana.com/

CheckThatVIN https://checkthatvin.com/ctv#/home

CarFax https://www.carfax.com/processQuickVin.cfx

VehicleHistory https://www.vehiclehistory.com/license-plate-search

CarOwners https://carsowners.net/

Misc. Tools & Tricks Efficiency and Organizational Tools That I Use

Better Windows File Search

https://www.voidtools.com/

Synced Notes https://www.onenote.com

Encrypted Coms https://signal.org/

Encrypted Coms https://wire.com/en/

Encrypted Email https://protonmail.com/ (use the free tier for burner/ seed accounts)

Hotkey Panel https://www.elgato.com/en/gaming/stream-deck

NAS/Local Cloud https://www.synology.com/en-us

Screen Capture htt