Open Source Intelligence gathering for CTF challenges.
- Try username pivots first; many CTF personas reuse handles
- If email is available, pivot to breached data/metadata
- Keep an "all-in-one" framework handy for categories you forget
- Check EXIF data on images for GPS coordinates
- Sherlock - Hunt usernames across social networks
- WhatsMyName - Username enumeration
- Namechk - Check username availability
# Sherlock usage
python3 sherlock username
# Check specific sites
python3 sherlock username --site twitter --site github- Epieos - Email to social accounts
- Hunter.io - Find company emails
- Have I Been Pwned - Check breach databases
Received: from mail.example.com
X-Originating-IP: [1.2.3.4]
- Google Images
- TinEye
- Yandex Images - Often finds more results
# Extract metadata
exiftool image.jpg
# Look for GPS coordinates
exiftool -gps* image.jpg
# Remove metadata (for opsec)
exiftool -all= image.jpg- Look for: signs, language, architecture, vegetation, sun position
- GeoGuessr - Practice
- Bellingcat OSM Search
- SunCalc - Sun position calculator
# Limit to domain
site:target.com
# Find specific file types
filetype:pdf confidential
filetype:sql password
# Directory listings
intitle:"index of"
# Admin pages
inurl:admin
# Leaked credentials
"password" filetype:log
# Config files
filetype:env DB_PASSWORD
# Backup files
filetype:bak OR filetype:backup
# Combine operators
site:target.com filetype:pdf intext:confidential
whois example.com# DNS records
dig example.com ANY
nslookup -type=any example.com
# Zone transfer (if allowed)
dig axfr @ns1.example.com example.com
# Subdomain enumeration
subfinder -d example.com- SecurityTrails - DNS history
- Wayback Machine - Historical snapshots
- crt.sh - Certificate transparency logs
- Advanced search:
from:username since:2023-01-01 until:2023-12-31 - Deleted tweets: Wayback Machine
# Search in code
password filename:.env
api_key extension:json
- Use Google:
site:linkedin.com "target company"
# IP geolocation
curl ipinfo.io/1.2.3.4
# Shodan search
shodan search "hostname:target.com"- Shodan
- Censys
- VirusTotal - IP/domain reputation
- OSINT Framework - Comprehensive tool collection
- IntelTechniques - Custom search tools