Hi, everyone, and welcome to the section. Number seven,
cold email, addresses user names and
images. This is, of course, all to be taken
in the open source, intelligence context. Now,
let's do a quick overview of this section. Although
it is pretty self-explanatory. And obvious.
What are we going to do here? Now, we will discuss
how to research, acquired data and information.
With the tools to get email addresses, then to
do username lookups and how to approach images
with our open source, intelligence way of thinking.
And with the appropriate tools to get the
job done. As you can see. I have put all
of these three resources in one video even
with a short Hands-On demonstration about
images.
So its first I will start with
the email addresses. Actually. The thing I
will not do is to start with a statistic of how many
email addresses there are in the world. Okay.
An analogy for that kind of estimation would be
an answer to a question. How many galaxies are
there? One of the answers is a number between
100 and 200 billion galaxies. Now.
Let's see. What are we up against in?
The off sent context of email addresses?
As you know, when you look up for someone who
someone's real name and really address that
can get you easily feeling frustrated,
especially few, your target has
some commonly going to try it. Pick
a common name in your country and Google it in
my example, a comment creation name
like even Horvath returns over
4.5 million search
results.
I just wanted to show you how common it is. It was even
in my country. Now when I put
that common name even harlot in an email format
even dot Horvat at
gmail.com and search for
it. I get about 171,000 of
results, which is still too
much. But when I put that search term
in quotation marks, I
get about
190 results. And
that is a good place to start from.
Actually, my first stop, when looking for someone's email address
is the search engine. Remember to
check out multiple search engines like Bing start page
DuckDuckGo in the country specific search
engines, like Yandex or
something. If your target is foreign also be
free to make an assumption. You may know about
one and rest but not for some other. It can be productive
to make assumptions of possible, email addresses and
use the verifiers.
See if they exist now.
Now, I will mention a few tools that worked and
still do for my investigations. But
just before I mentioned these tools, I would like to point out, is
that the searches for free based email
addresses, like Gmail or Yahoo is very difficult.
There are different. Technical limitations. Why is
that take Gmail?
Or Google Mail. Well, it is in their
best interest to be secure and they are investing a lot
in their cyber defense, the security of
other business emails, only depends on
the fact. How much are they investing in their cyber defense?
And that is not that much in most cases.
One of the facts about email addresses. Most
of the email search services, do not work or
give you incorrect results. Just for
you to be aware, not to rely on just one tool. Always double
triple check. Everything first,
I would like to point out is true mail dot
IO, it's spelled TR
you Ma i
l .i o as you can
see on my example.
I put down an email spam at do garden dotnet which
is related to my business account. The results, displayed
here. Indicate
that the domain provided, the
burden dotnet is configured for email and the server is
active.
It also identifies that the address is a catch-all which
may indicate a burner account on the target domain.
The results. Definitely confirmed it. We
are not talking about a free Webmail account, and that
this is not a disposable temporary email. The
second service is called verify email
located on the verify hyphen
email, that or address. As
you can see. On the same example, this service provides a
lot less data, and it says about the same.
Get email, we previously checked that it is bad. This
is a perfect example. Why we need to double-check things.
Actually. This is a correct an
existing email address. The only thing we
received here that is correct. Is
that the email server is a catch-all
server next, is a service called
email hippo located on the tools.
That verify email address, that I/O address
this service also gave me
A questionable answer, but at least it was with more
info. The target address is labeled
as unverifiable, but we but
I went to the more info Tab and
I found out more details, like who is the service
provider? Is it a catch-all server? And so
forth. In fact, this email address that I
tested is an alias address and only one service
gave me a more complete answer to the question, is
the email address even valid.
And now next is the email format question. Besides
the assumptions you can do like
is it named surname just
name at the Domain or the
first letter of the targets name and then
their surname? There are a lot of combinations you could try
for that email format. A
good starting point is if you have the targets username
from some social network, people
tend to have the same user names for every
If the Assumption strategy did not work
or it was an oracle for your needs. You may
want to consider a service like email format. You
can get to it by visiting email Hyphen
for mat.com. When
you put down the target domain, you will get
a list of potential email formats. Actually, it
will give you a confidence level value is the
format right? Or not.
There's another service. I think it's worth mentioning
in the email formats realm and
that is Hunter that I owe service. It
is a paid service, but it has a free limit. You can use.
I like the thing that it mentions,
a source where it found the target email
format. And now, the last approach
to get or verify emails is the compromised
approach. As I stated in the slide. You're
probably aware that.
Emails are compromised regularly in
various data breaches. And data leaks malicious
hacker groups, often publish email
databases for public, use and their corresponding passwords.
This is usually done on a service called
pastebin that we covered earlier. I
will mention two websites that provide this information, but
there is more of them like this out there. They
get often, they are they get often.
Get they often get shut down.
Because this is not completely legal or ethical
in a way. There are two reasons why you
should look here. First. If
you learn that the email address
of your interest has been a part of some breach, then
it is obviously valid and the
second reason that usually this service gives
you in what data breach has. The
email being found is LinkedIn or
Dropbox or some other third service data leak.
We will talk later in the course in more detail
about data, breaches and leaks and how can they be relevant
to your investigations sites? I
have listed here are have I been pawned. Diet.com,
and the hashed.com., I
encourage you to check them out, but with caution
and I will move on to the
user names. When it comes to usernames. They
can be really super easy to find or really
super hard to find Hope.
You will have the first scenario in most cases.
As in the previous searches for email,
addresses here with user names. I would also suggest
search engine approach on finding that username of
your interest. A good starting point is, if
you already have the targets email address because people
have the tendency to use the same username on
many different places. I would suggest to
visit Google, big bing Yandex or
even other search engines because you never know which search
engine will provide you with needles.
The information concerning the online, username
search engines. I will mention a few of
them actually five.
First is the check usernames.com website, which
is not my first big when doing the stations, but
I have listed it as the first one
here because then you will understand the
second better as I'm aware the
chick usernames.com service. Relies on
the service. No. MM. But it links directly
to the Turkish profile. When one is identified. As
you can see, I'm searching for
the username.
We know, which is not that good to search for because this
username is definitely more popular in use than
the name dot. Last name, model.
Next
is no one.com, which is usually my
first stop. When I go investigating usernames, gnome
is one of the comprehensive search websites for
user names and many sites rely on
their searches just like previously mentioned service.
Check user names that come
As you can see, I have selected to
find Tino on the most popular online services.
It shows, 25, it shows cut.
It shows, 25 of them, with
knowing, you can spend some time on finding the best solution that
username that might use be used. Cut
with. No, MM. You can spend some
time on finding the best username. That might
be used by your target.
Then I have listed the site user search
dot-org. This site has the potential to
give. You may be the most accurate results, because it's
returns a list of identified profiles matching the
target, the basic basic search gives
you. The results of 45 most popular
websites.
Next is the site and username search, engine called
name wine.com. That's knee
and am e VI
n e.com. It
allows you to begin typing, any partial username
and immediately identify registered
accounts with the, in the top 10
social networks. You can have a good use of
this search. When you are not sure about the correct spelling of
the username, you simply add or remove a character.
And you get immediate results.
And last on my list is
social hyphen Searcher. That come this
username search service besides its Core Business of
providing providing various. The
targets username being used has a possibility to
Monitor and alert you when the username of your interests
changes or comes up on some social platform.
That's a cool feature.
And as before the last approach, I would like to mention is the
compromised one. Actually for you
to identify targets, username through a publicly available
breach. You're probably aware that,
as with emails, usernames are also compromised regularly
in various data breaches. And data leaks
usernames are accompanied along with
their passwords hashed or in clear text.
I will mention have I been pain.com again
and the hash that?
I had better luck with the hashed. The
process is simple. Similar to the previous instructions. Enter
your targets. Username with the intent to
discover any data breaches, quick Bridges queries
here. You can also make assumptions of the
user names as you investigate. For example, let's
say you have an email name
at example.com. You can also
try first name dot last name, then
last name DOT. First name?
On the first letters of them and so forth.
You get the idea, we will talk later in the
course in more detail about data, breaches and leaks. So
I won't bother you much with them in detail. And
now let's move on to the images part. As
you know, images are all around us.
Almost every device has a camera, actually. I
don't know how have you noticed but when they are diverted the
advertising mobile phones, they put
a lot of effort on the camera part today's phones.
At least have two or three cameras as
you can presume digital photography. Has created a whole
new element for the open source intelligence analysis. Will
go through where to look for photos. What
tools to use to do a reverse image
look up. Actually, do the mystify. What a reverse image
lookup is then we will cover
Then we will cover the images made a data because almost
every image has additional technical data about itself
and for last how to approach an image from in
forensic perspective.
As always search
engines, are, are my and
your, and everyone's first up, maybe almost
every search engine has an
option to search for images that they have indexed.
I will mention Google Images which are located on
the images.google.com address. The
second best source for images in my opinion is
bing.com / images. Being
may not be as good as Google, but it
No, but it should never be overlooked and
those to search engines in
the image. Search context. Are often my go to
places. Actually, I think it is better to do
searches via the search engines. Then to
go directly to some site with, with images,
like Picasso the key. The
key Point here. Is that a good search engine will keep track
of anything published to the internet.
And concerning the reverse image searches and
the images metadata or exit data. Allow me
to show you. What is it all about? They say,
an image is worth a thousand words, but if
the same image shows up all over the Internet, many
times, is that number of words multiplied. Okay.
I'm just kidding there. Reverse image, search is
a search engine technology that takes an image file, as
input query and Returns. The results are related
to the image of
One of the engines and tools like that is a service called
teen eye.
Okay, here we are in our favorite privacy. Aware
web browser, Firefox and we will visit
deny.com. That's
t.i. N. E.y.e. Rune.
And the. And as you can see, it is pretty much
straightforward process. This reverse image
search tool will show you where is your image found elsewhere
online. The exact duplicate you
can upload or enter an image URL.
I will take an image URL.
From the search box.
I will use the Notre Dame.
Fire picture from Wikipedia.
And paste and search.
Now, Dean I will do his thing. And
here it is. As you can see, immediately. We got over
30 results, actually 36 to
be exact eversource is linked and
listed here.
This is also a great fat of for fact-checking methods.
Maybe someone is faking something
which you suspect and you can use this method to
find out that their picture has been used, maybe 10
times the on all over the internet somewhere.
The second thing I would like to show you actually first
to talk about it, is how
much additional information can an image contain that
information is called the exif data. The metadata of
an image exif stands for exchangeable image
file format. When you take a
photo with your mobile phone camera that that
picture is usually stored in the jpeg format on
your phone and besides the information about how the picture looks
like additional data is also
Stored data may or may not contain
when the picture was taken with? What
kind of camera, what were the technical settings? Like color file,
size, encoding process and so forth, but
there's one very important thing and
data about it. And that's the
geolocation data or the exact GPS coordinates where
the picture was taken.
Here is a great tool called Jeffrey's image
metadata viewer, which was developed by
mr. Jeffrey friedel.
You can find it on the address. Exif dot regex,
that info / exif
that CGI. Okay, it's not the
friendliest URL, but believe me, that is
pretty irrelevant. When you do your investigations, and
when you need some data,
So let's check it out.
Okay. Again, here we are in our browser and let's close this.
And visit the exit tool from mr. Jeffrey friedel
on the address. We previously
mentioned.
I'm sick that right Jax.
Okay, and as you can see, it's simple, you
can upload or enter the image URL.
I've prepared a picture so I will copy paste the
URL.
Prove that. I'm not a robot.
Given your bicycles.
And you image data?
Okay. Now, as you can see, we
got a lot of data here and I love the most
and one of the most important.
Information is the location.
Where was this picture taken?
We even have an option to go directly to Google maps with the
provided coordinates.
I also have to say that this metadata can be stripped down with
ease. There are a lot of online tools
out there that will remove the additional images data. And
okay. I have a task for you. Try to see the
exif data of images on your mobile applications, like
WhatsApp, or Viber or even Facebook. Just
give it a try. Will this work?
And back to our slides. And lastly, considering images.
I would like to mention a real formalistic approach to
images. One of the tools is called
photo forensic.
Be addressing where the tool is located is 29.
A DOT CH that's 29 A.C.
H.
/ photo hyphen forensics. This
site allows you to upload a digital image and
then with a set of tools, it allows you to investigate the
uploaded photo. I will only mention a few of
the tools. That's there are cut.
I will only mention a few of the tools that are included. First
you have the magnifier that is a tool with
which, you can see Small hidden details on
an image. It simply magnifies the picture to
the smallest pixel size, so you can better see
if something is odd looking with the image. You
can also apply different contrasts while looking at the
pixels. Then you have a tool called clone detector.
That highlights copied regions inside the
uploaded image this
Can be a good indicator that a picture has been manipulated minimal
similarity, determines how similar the
Clone pixels need to be to
the original picture?
Then the tool error level analysis compares. The
original uploaded image to a recompressed image.
With this method, you can potentially notice
a difference in the image in is
some section darker or brighter.
There are more tools inside the school forensic, image tool and
I really encourage you to go through the help section of the
photo forensic site to learn about it better.
And now we are ready for my personal favorite section
hosting. The it systems. And
the reason to that is because basically I'm an
IT guy or better to say a cyber security professional who
derived from the system engineering field. So
see you in the next session and see you in
the next video. Bye.