Mastering Osint: How to Find Information on Anyone | Hacker News Reader

Mastering Osint: How to Find Information on Anyone

osintteam.blog

233 pointsdroidrat47 comments

SWIM's recommendation for anyone wanting to learn is to sign up for Breachforum and read up on all of the contents in their OSINT subforum [1] where you can ask questions too. If you're willing to boogey on into the grey area, you can even download leaked datasets from BreachForum, Leakbase.io, etc. to make your job a lot easier if it involves identifying people online - for example a few databases like AT&T customers and the NationalPublicData database were leaked recently which is kind of like having a private LexisNexis Accurint at your fingertips.

[1] https://breachforums.st/Forum-OSINT

A site with a "grey area", which does not work without running a third party Javascript, and hosted in in Russia makes me a bit twitchy.

This is definitely a topic area where people overly familiar might omit standard safety precautions within their instructions: Do use a burner VM, don't do any of your normal computing on that VM, etc.

In the current environment it is tough to host things like that on the clearnet and not rely on "shady" hosting in Russia and similar nations

It really creates a weird cognitive dissonance in me to observe how a lot of useful stuff is hosted in russia.

you'll get over it

Isn't that site now under FBI control?

https://www.justice.gov/opa/pr/justice-department-announces-...

Someone who is me

Legally airtight. A genius stratagem basically.

I never liked this term. Why is the term "Open Source" used to refer to publicly available information? Something like "PAT" would have been a better acronym: Public Available Information.

Do we refer to street dogs as open source dogs?

PAI would sound like anyone had the right to the information, whereas OS sounds like it happens to be public (unfortunately), but of course only we the agencies should access it.

OS is a bureaucratic power term, which is of course quite old:

https://en.wikipedia.org/wiki/Open-source_intelligence#Histo...

...this takes me down a rabbit hole to 2010. We once tried to establish "Public Intelligence" [PubInt] as it was a term we used since 2003 in 2010 but it only caught on with some businesses. The then definition was - to differenciate it from OSINT - bound to the use of the information in a "civic" context - here you got them for fun and giggles:

2003: Public intelligence refers to sources of information freely available to the individual to be the basis for it's role as a responsible and critical citizen as part of a group or state.

Public Intelligence is associated with the application of Open source intelligence (OSInt) to empower the public in its dealings with all forms of organization, and most especially government. It is an applied variant of Collective intelligence.

It was inspired by the 1978 Colby book:

"Intelligence must accept the end of its special status in the American government, and take on the task of informing the public of its nature and its activities as any other department or agency. . . . By far the most effective manner of accomplishing the task . . . is by letting the public benefit directly from the products of intelligence, its information and assessments. " --former DCI William Colby, Honorable Men: My Life in the CIA, Simon & Schuster, 1978, pp. 459-60.

I put it together for your viewing pleasure: https://elib.at/index.php?title=Public_Intelligence_-_Glossa... enjoy

edit:typos

The problem with this is that OSINT has been established as a term at a government level (likely before Open Source Software came about?), so any push to change it will be a greater feat than the inverse.

Or PINT: Public INT.

... I called it Public Intelligence (PubInt)

PINTO - the last o is online.

> I never liked this term. Why is the term "Open Source" used to refer to publicly available information?

I assume your line of thinking is that you associate "Open Source" with software freedom (warm fuzzy feelings) & dislike that being tainted by stalkers & military espionage. Leaving aside that OSINT pre-dates the software term, I think it's quite fitting given the context of the very capitalist-/corporate-friendly "Open Source" licensing trend subsuming the original corporate-unfriendly/copyleft "Free Software" movement. The former enables the military-industrial complex by taking advantage of publicly available data, the latter enables the corporate world by taking advantage of publicly available code.

> "PAT" would have been a better acronym: Public Available Information.

informaTion?

> Do we refer to street dogs as open source dogs?

No, but we don't call them Public Available Dogs either.

“Stray information” sounds good, though.

My bad - messed up the acronym!

PAI might be a bit close to PII.. although I guess there would be overlap :)

The term invariably seems to apply to two phenomenons:

1. Stalkers stalking people

2. Actors spreading misinformation on X about wartime atrocities

I can see why they want to brand their stuff “Open Source” which sounds like a good thing.

Yes, unfortunately I've also observed that while "OSINT" is theoretically a legitimate, white-hat thing, in practice it's very often used as whitewashed branding for malicious (often "righteous") doxxing. Similar to black hats for hire forums that claim to just be about "security research"

> Why is the term "Open Source" used to refer to publicly available information?

Well, why not?

"Source" has long referred to available information. In fact, you probably won't have to read HN long before you encounter a "source plz"-type meme, intended to mean something akin to: "Please point me to the available information that supports your claim."

"Open" has long referred to available information that is accessible to users. "Open source[code]" uses "open" in the same way.

PAT works too but I'm not sure it communicates anything meaningfully different. As far as I can tell, they are trying to communicate the very same thing. Is your reaction, perhaps, because you are accustomed to "open source" being used in the software sense?

> Do we refer to street dogs as open source dogs?

Dogs haven't typically been seen as information, so, for all practical purposes, probably not. But if we want to change that, sure, why not? Language doesn't have feelings. It doesn't care.

I agree that individually those terms convey the exact thing as publicly available information.

> Is your reaction, perhaps, because you are accustomed to "open source" being used in the software sense?

Yes exactly. I feel like a different term should be used here, because open source is already a widely established term in software.

The term "open source" as referring to sofware was suggested in 1997 but I could find references to OSINT from at least 1991-1995[0], so I'd say "Open Source Intelligence" should get precedence.

[0] https://apps.dtic.mil/sti/tr/pdf/ADB194025.pdf

The thing is, there's a whole world outside software development and as unpleasant as it might sound, they don't care that much what words we use among us.

Please no more acronyms

PNMA

The idea is about openness and collaboration

Some funny anecdote, my fullname is relatively unique, two or three people have it AFAIK. On my upwork profile, they put the military veteran status because a completely unrelated military guy with the same name shows up in the google/linkedin search. I can't remove the status, I don't even look like the other guy.

In some countries, falsely claiming military status is a crime. I'd be very careful about accepting any jobs using that profile as you may be committing fraud. (Not a lawyer)

Thanks for the heads-up. Not aware of any law like that from where I live, but I should file a ticket to remove the veteran status just in case.

Forced valor

I couldn't get those Google searches to find my resume. I wonder if I was doing something wrong...

You called it Work Experience is that why maybe?

When it’s impossible to prevent bad actors from gaining access to weapons, the best thing to do is to level the field by giving the same weapons to everyone.

It’s kind of mad.

From my impression, the way you get good at OSINT is knowing which types of information tend to be related, and where to go with what you have.

All OSINT guides include a surprising amount of paid tools. OSINT tools are dime a dozen, you have to know how to use them.

Finding tools is easy, there are endless collections of them:

- https://osintframework.com/

- https://github.com/jivoi/awesome-osint

- https://cylect.io/

The hard part is deciding when, where, how, and with what information to use them.

I am surprised how little information about OSINT is on hackernews (https://hn.algolia.com/?query=OSINT barely has results)

If you are not some journalist, you won't need serious OSINT. (Investigating someone for fun?)

You can play geoguesser for fun. That's "technically" OSINT and you will know geography. Here is a Geoguesser (Rainbolt) player finding places from images: https://www.youtube.com/@georainbolt/videos

Here are some OSINT challenges if you want: https://gralhix.com/list-of-osint-exercises/

A skill I recommend much more than OSINT is being good at normal searching and collecting some basic metadata, and getting the gist of new topics quickly.

- You want to buy something, how do you figure out the price, quality, and whether it is a good deal. How to quickly figure out what matters and what doesn't? Which features are common, which false advertised, which are aesthetic bloat.

- You are traveling or moving to a new city, how do you quickly figure out all the tricks locals know and not fall for tourist cash grabs.

- You find a shady website, app, or chrome extension. Pocke around with the source code and domain names to round up the entire operation and report it.

- Some new person you got to know works/likes something you know little about. How do you quickly figure out some deeper questions to ask.

- Find what an error in your computer.

It boils down to knowing the underlying structure of whatever you are digging. Insiders tend to know ecosystem so well it seems obvious, despite it being hard to integrate into for an outsider.

There was a command line tool available where you could enter a few attributes (such as a username) and the tool would plow through just about every online service to find and report data. Anyone remember what it was?

https://github.com/sherlock-project/sherlock

perhaps 'sherlock'?

https://github.com/sherlock-project/sherlock

yup, this was it. Thanks!

It’s shockingly easy to find information about almost anyone within the first couple pages of google

and even if there’s no information on the first and last name. There will likely be at least somebody in your web of relationships that leaked something.

"Gather the Data: Use various tools and methods to collect information."

"By following a structured approach and leveraging specialized tools, you can effectively gather, analyze, and verify information from publicly available sources."

Am I paranoid or was this partly written by an LLM? Or is it just naturally so vague and generic. I mean most of the tips are kinda legit, but after the title I expected a little more than this.

I checked who else submitted osintteam.blog domain, and it's user https://news.ycombinator.com/user?id=haydenbannz , and it looks like they used HN mostly for self-promotion: https://news.ycombinator.com/submitted?id=haydenbannz (some posts are [dead]).

Frankly I got that impression too, but more because of the structure of the post than anything else.

Reply on news.ycombinator.com