Module 4: Lesson 3 OSINT

OSINT

Click here or there to move to the next page!

Jennifer Funk. (2024, April 3). OSINT: How to Become an Intelligence Analyst [Video]. https://youtu.be/MUz9uM4_fSg?si=P-qW1MQKplkABn1p

Show Text Version

Next

OSINT – Open-Source Intelligence Tools

• To create an effective phishing email, you need to gather information about the target

• i.e., perform reconnaissance about their life, their interests, their work, family, hobbies, schools, etc.

• Once you have gathered this info you can craft a scam email that will appeal to them personally.

• OSINT tools provide a simple, powerful way to gather publicly available information about people or companies.

Back

Next

OSINT – Open-Source Intelligence Tools

• To create an effective phishing email, you need to gather information about the target

• i.e., perform reconnaissance about their life, their interests, their work, family, hobbies, schools, etc.

• Once you have gathered this info you can craft a scam email that will appeal to them personally.

• OSINT tools provide a simple, powerful way to gather publicly available information about people or companies.

Back

Next

OSINT Definition

• Any information that can be gathered from free, public sources about an individual or organization

• This information must be legally accessible by a member of the public. Examples are an Etsy review, tweets from an open Twitter account, posting about a home on Zillow,

• OSINT also includes information that has been leaked to the public and are available on the Internet. Examples are information published by Wikileaks.org or posts by data breach hackers.Essentially, this is accessing information that someone else stole and posted publicly. Does that seem ethical?

Back

Next

OSINT Tools

• Google search - instead of John Doe - use “John Doe”Try a different search engine! DuckDuckGo, Bing, or Dogpile

• Google Maps Streetview and Satellite view

• Google Reverse Image Search - with 1 photo of target

• Archive.org (aka the Wayback Machine) – even if data is no longer online, it may be available here.

• Social media sites – Facebook, Twitter, Pinterest, YouTube, Classmates, Instagram, Reddit – the target’s public profile may have a lot of information.

Back

Next

OSINT Tools

• Spokeo: people search with addresses, phone numbers, family relationships
• Real Estate – Zillow: cost of home, pictures (in & out), home description
• LinkedIn – for info about career & awards & contacts
• Political affiliation – www.politicalmoneyline.com
• Shopping - Amazon wish lists, gift registries

Back

Next

Example OSINT

• The target is Tony Stark, a rich businessman. We want to gather info about his personal life so that we can spear phish him or find enough info to guess his password.
• The only thing we know to start with is his name and his town: Southfolk, VA.
• Click next in Canvas to go to the activity.

Back

What is OSINT? Open Source Intelligence is information available from publicly accessible resources, essentially acting as a "digital detective" using the internet to find valuable information. It is a crucial tool for various professions, including cybersecurity, federal agencies, businesses, and journalists. Core Principle: OSINT is about gathering information ethically and responsibly to make informed decisions. It is crucial to prioritize ethics, legality, and privacy, just because you can access something doesn't always mean you should. Steps for an OSINT Investigation: Define Your Objective: Determine your overall goal (e.g., locating a person, uncovering information, securing assets) as your strategy and tools will depend on your mission. Identify Relevant Resources: Identify publicly available sources relevant to your objective, such as social media, online forums, news websites, public databases, government websites, or academic publications. Identify OSINT Tools: Look for tools ranging from Google searching to specialized tools for social media monitoring, web scraping, and data analysis. Popular tools include Maltego, the OSINT Framework, Shodan, SpiderFoot, and Recon-ng. Conduct Searches:

• Start with keyword searches related to your objective.
• Refine your search using advanced keyword operators (like Google hacking).
• Explore social media sites, paying attention to geotags, hashtags, and user-generated content.
• Monitor online forums, discussion boards, and community websites.
• Crucially: Verify and collaborate the credibility of all information collected, and document your findings.