Deck of Debraj Dey's Session at Null Kolkata Meetup on 6th August.

1. Demystifying Cyber Threat Intelligence

2. $whoami
🔒 Cyber Security Enthusiast 🔒
LinkedIn: linkedin.com/in/cyberdebraj/
GitHub: github.com/VU3ZHY
Twitter: https://twitter.com/vu3zhy
HAM Radio(VU3ZHY): https://www.qrz.com/db/vu3zhy
Facebook: https://www.facebook.com/vu3zhy/

3. The Place of CTI In the overall CyberSecurity posture:
Past Present Future
VAPT
Security Operation Center
(SOC) Cyber Threat Intelligence(CTI)
Red Teaming
Digital Forensic and Incident
Response(DFIR)
Threat Hunting

4. Prerequisite Terms & Topics for CTI
● Indicator of Compromise (IOC)
● Indicator of Attack (IOA)
● Advanced persistent threat (APT)
● Tactics, Techniques, and Procedures (TTPs)
● Cyber Kill Chain

5. Types of Cyber Threat Intelligence

6. Use Case :

7. Scope for Cyber Threat Intelligence
● Domain Monitoring
● Leaked Credential Monitoring
● Deep/Dark web monitoring
○ Deep/Dark web Marketplace & Forams
● Social media Monitoring
● Paste & Document Sharing Sites Monitoring
● Git Monitoring

8. Domain Monitoring
Problem Statement:
● Typosquatters,
● Phishing attacks,
● Fraud
● Brand impersonation
Solution:
● Variety of highly domain fuzzing algorithms
● Unicode domain names (IDN)
● Domain permutations from dictionary files
● Multithreaded task distribution
● Live phishing web page detection:
● HTML similarity with fuzzy hashes
(ssdeep/tlsh)
● Screenshot visual similarity with
perceptual hashes (pHash)
● Rogue MX host detection (intercepting
misdirected e-mails)
● GeoIP location
● Export to CSV and JSON
https://dnstwist.it/
https://github.com/elceef/dnstwist

9. Leaked Credential Monitoring
● https://haveibeenpwned.com/
● https://leakcheck.io/
● https://hacknotice.com/free-account/#instant-security-risk
● https://www.optery.com/
● https://en.wikipedia.org/wiki/List_of_data_breaches

10. Deep/Dark web monitoring
● ahmia
● darksearchio
● onionland
● notevil
● darksearchenginer
● phobos
● onionsearchserver
● torgle
● onionsearchengine
● tordex
● tor66
● tormax
● haystack
● multivac
● evosearch
● deeplink
https://github.com/megadose/OnionSearch

11. Deep/Dark web Marketplace & Forams
Forams:
● raidforums
● leakzone
● Hackforums
● evilzone
● nulled.to
● xss.in
● leakworld
● exploitin
● Leakforums
Marketplaces:
● Genesis market
● Russian market
● Alphabay
● DarkBay
● SilkRoad
● TorMarket
● DarkFox Market
● WhiteHouse
Market
● Hydra
● Versus
● Empire Market
Solution:
https://github.com/webfp/tor-
browser-selenium
https://stackoverflow.com/questi
ons/39134419/run-tor-browser-
with-selenium-webdriver

12. Social Media Monitoring:
Facebook Graph API
Instagram https://github.com/Datalux/Osintgram
Twitter
Tweepy + ELK Stack
Microsoft Power Automate
LinkedIn —--------------------------------
Telegram
TGStat Alert Bot
https://github.com/dayeol/telegram-keyword-detector

13. Paste & Document Sharing Sites Monitoring
Paste Sites
● Pastebin
● ZeroBin
● TextBin
● Hastebin
● Stronghold Paste- TOR
● DeepPaste-TOR
● PrivateBin
Document Sharing Sites
● Scribd
● slideshare
● qdoc
https://github.com/beamzer/pastebin-
monitor-and-alert
Custom Scraper & crawler if the API is
available.
Or Python Library(If Scrapable):
● BeautifulSoup
● Scrapy
● Selenium

14. Library Performance Ease of Use Extensibility Ecosystem
BeautifulSo
up
- Slower than Scrapy and
Selenium, can use multithreading
for speedup.
- Ideal for beginners
exploring web scraping.
- Suitable for minor projects
with low complexity.
- Good
ecosystem but
may have several
dependencies.
Scrapy
- Faster and more efficient,
supports asynchronous request
execution.
- More complex with a
steeper learning curve.
- Preferred for complex,
large-scale projects.
- Robust
ecosystem,
allows
automation with
proxies.
Selenium
- Efficient but slower with large
data volumes, waits for entire
page load.
- More complex, has a
complete toolkit for web
automation.
- Beneficial for JavaScript-
heavy websites.
- Robust
ecosystem, may
require additional
effort for proxies.

15. GIT Monitoring
Platforms that already searched for leaks:
● https://trufflesecurity.com/blog/introducing-forager/
List of open source tools:
● https://github.com/obheda12/GitDorker
● https://github.com/dxa4481/truffleHog
● https://github.com/gitleaks/gitleaks
● https://github.com/hisxo/gitGraber
● https://github.com/eth0izzle/shhgit
● https://github.com/techgaun/github-dorks
● https://github.com/michenriksen/gitrob
● https://github.com/anshumanbh/git-all-secrets
● https://github.com/awslabs/git-secrets
● https://github.com/kootenpv/gittyleaks

17. Wrapping up the CTI

18. Doubts and Queries