Open Source Intelligence Gathering (OSINT) is growing in popularity among attackers and defenders alike. When an attacker comes knocking on your network's front door, the warning lights go off in multiple systems (IDS, IPS, SIEM, WAF). More sophisticated attackers, however, spend considerable time gathering information using tools and techniques that never touch any of your systems. As a result, these attackers are able to execute their attacks and make off with proprietary data before you even know they are there. This presentation provides an introduction to many OSINT tools and techniques, as well as methods you can use to minimize your exposure.

1. Detecting the Undetectable:
What You Need to Know
About OSINT

2. Hack all the things!
Jerod Brennen, CISSP, GWAPT
You can find me at:
Twitter: @slandail
LinkedIn: /in/slandail

3. Hacker,
hack
thyself.

4. Want Answers? Start With the Right Questions.
◉What the heck is OSINT?
◉What’s your process?
◉What OSINT tools should I know about?
◉How do I defend myself?

5. 1.
What the heck is OSINT?
Let’s begin at the beginning.

6. OSINT
Open Source INTelligence

7. Penetration Testing
OSINT is a key component
of the Penetration Testing
Execution Standard
(PTES).
[Image from https://www.trustedsec.com/penetration-testing/]

8. 2.
What’s your process?
Wash. Rinse. Repeat.

9. EDGAR
U.S. Securities and Exchange
Commission. Over 20 million
filings for publicly traded
companies.
You can also split your content
Google Finance
Leadership, performance, news
stories, external links.
Step 1: Profile the Company
LinkedIn
Company page. Products,
services, 30k foot view.
Company Website
Careful, here. Visits from your
laptop = a record of your IP
touching their web
infrastructure.

10. LinkedIn
Employee names, titles, history
with the company, and
technologies that the IT staff
uses.
You can also split your content
Facebook
What do they eat for lunch?
(More importantly, the answers
to their secret questions.)
Step 2: Profile the People
Twitter
Who do they talk to?
What do they talk about?
Search Engines
Google, Bing, Duck Duck Go
Individual Internet footprint

11. In two or three columns
The Wall of Shame
U.S. Department of
Health and Human
Services
Office for Civil Rights
Breach Portal: Notice
to the Secretary of
HHS Breach of
Unsecured Protected
Health Information.
Breaches Affecting
500 or More
Individuals
PrivacyRights.org
Chronology of Data
Breaches (2005 –
present).
Filter by source (if
known), industry,
and/or year.
PasteBin / Cryptbin
Designed to let
programmers share
and troubleshoot
snippets of code,
they’ve also become
repositories for proof
of breach.
For example. “Here are
1,000 passwords. Send
xxx bitcoins to this
address for the other
49,000.
Step 3: Research Previous Breaches

12. Mobile Apps
Start with Google Play and
iTunes.
Download the app file (.apk, .ipa)
to your testing machine, unzip it,
and start poking around.
If they have an app in Google
Play, reverse the app back to it’s
original Java source code.
You can also split your content
Web Infrastructure
Lots to cover here, folks. Let’s
save the details for the next
section.
Step 4: Profile the Internet-Facing Infrastructure

13. 3.
What OSINT tools do I need to know about?
Automation, folks. That’s where it’s at.

14. Tell Me About Your Web Apps
◉ Netcraft Site Report
http://toolbar.netcraft.com/site_report
◉ ICANN WHOIS
https://whois.icann.org/en
◉ ARIN WHOIS-RWS
https://whois.arin.net/ui/advanced.jsp
◉ Hurricane Electric BGP Toolkit
http://bgp.he.net/

15. These Are a Few of My Favorite Things
◉ Qualys SSL Labs – SSL Server Test
https://www.ssllabs.com/ssltest/
◉ PunkSPIDER
https://www.punkspider.org/
◉ UltraTools DNS Zone Transfer Lookup
https://www.ultratools.com/tools/zoneFileDump
◉ SHODAN
https://www.shodan.io/

16. ◉FOCA
https://www.elevenpaths.co
m/labstools/foca/index.ht
ml
◉ Google Hacking
http://www.hackersforcharity.o
rg/ghdb/
Passive  Active

17. ““Automation, folks. That’s where it’s
at.” – Jerod Brennen, just a few
minutes ago

18. ◉Maltego
https://www.paterva.com/w
eb6/products/maltego.php
◉ recon-ng
https://bitbucket.org/LaNMaSt
eR53/recon-ng
Replace Yourself With a Very Small Shell Script

19. 4.
How do I defend myself?
Sitting under your desk and crying is not an option.

20. Riddle Me This, Batman…
How much of what we’ve
discussed would trigger
an alert in your IDS/IPS?

21. ◉ Unauthorized ports open on
Shodan? Close them.
◉ Web app vulnerabilities on
PunkSPIDER? Fix them.
◉ Zone transfers were
successful? Disable them.
◉ Passwords on Pastebin?
Change them.
◉ Users oversharing on social
media? Train them.
Let’s Not Overcomplicate Things

22. Would You Like to Know More?
◉Online Strategies
http://www.onstrat.com/osint/
◉Penetration Testing Execution Standard
http://www.pentest-standard.org/index.php/Main_Page
◉IT Security Career
http://www.itsecuritycareer.com/blog/what-you-dont-know-
about-osint-can-hurt-you/

23. Thanks!
ANY QUESTIONS?
You can find me at:
Twitter: @slandail
LinkedIn: /in/slandail