OSINT: Find Everything About Anyone! — Transcript

Full transcript

1. 0:00So I already did a video on OSINT a  while back. Decent video, solid tools,
2. 0:05did its job. But since then I've gone way  deeper into this rabbit hole and learned tricks
3. 0:10that genuinely made me sit back in my chair like  there's no way this is legal to know. So tonight
4. 0:13I'm dropping everything I've found since then
5. 0:15the stuff nobody else is sharing, the  actual FBI type shi, tools that make
6. 0:21Maltego and Shodan look like the  beginner tier they actually are.
7. 0:24Quick reality check before anything else.  Everything here uses public information.
8. 0:24No breaching, no hacking, no unauthorized  access. The reason this matters as much as
9. 0:24it does is because almost nobody understands  how much of their life is sitting in public,
10. 0:24searchable, cross-referenceable places.  Understanding these tools is how investigators
11. 0:24find people. It's also exactly how you  find out what's findable about yourself.
12. 0:24Let's start with something most people sleep on  completely, Pipl and Spokeo are fine for surface
13. 0:31level stuff but the real professionals reach for  something called IntelTechniques, built by Michael
14. 0:36Bazzell, a former FBI cyber crimes investigator  who now runs the most respected OSINT training
15. 0:43operation in the field. His site has a free search  tool collection that aggregates dozens of lookups
16. 0:48into one place, usernames, emails, phone numbers,  all cross-referenced instantly. This is the same
17. 0:56methodology actual federal investigators are  trained on, available to you for free, right now.
18. 1:02Now let's talk about something that will genuinely  blow your mind, Epieos. You give it an email
19. 1:08address and it tells you which Google services  that email is tied to, whether there's a profile
20. 1:13photo associated with it, sometimes even a real  name pulled straight from Google's own systems.
21. 1:20People think their email is anonymous. Epieos will  frequently prove otherwise in about four seconds.
22. 1:26Sherlock is the next one and if you've never used  it, prepare to lose an evening. You give Sherlock
23. 1:32a single username and it checks that exact  username against over four hundred websites
24. 1:37simultaneously to tell you everywhere that  name has an account. Someone uses the same
25. 1:42username on their throwaway Reddit and their  real Instagram? Sherlock just connected them.
26. 1:47Run it from any terminal, `python3 sherlock.py  username`, and watch the results populate in
27. 1:51real time. This is genuinely one of the most  underrated tools in the entire OSINT space.
28. 1:57Then there's Holehe, which does something  similarly unsettling but with emails instead
29. 2:02of usernames. Feed it an email and it silently  checks that address against over a hundred
30. 2:08platforms to see which ones it's registered on,  without sending a single password reset email,
31. 2:14without alerting anyone. It works by  exploiting subtle differences in how
32. 2:18registration pages respond to existing versus  nonexistent accounts. One email address in,
33. 2:24and thirty seconds later you have a partial  map of someone's entire digital footprint.
34. 2:30Now here's where it gets genuinely federal level.  GrayKey and Cellebrite are the actual tools law
35. 2:35enforcement uses to extract data from seized  phones, but the public-facing equivalent that
36. 2:41regular researchers can access is something called  Cellebrite's own published methodology documents,
37. 2:46and more practically, Hunchly, a browser extension  built specifically for investigators that
38. 2:52automatically captures and timestamps every single  page you visit during an investigation, building a
39. 2:58fully documented evidence trail as you browse.  Real investigators use this so that everything
40. 3:04they find is admissible and reconstructable later.  Most OSINT hobbyists have never even heard of it.
41. 3:07For geolocation, forget basic reverse  image search for a second and look at
42. 3:12something called Overpass Turbo combined  with OpenStreetMap data. Investigators
43. 3:17use this to cross-reference visual landmarks  in a photo, a specific style of streetlight,
44. 3:22a particular road marking, an unusual building  shape, against actual geographic databases to
45. 3:28pin down a location with shocking  precision. This is exactly the kind
46. 3:33of technique Bellingcat uses to geolocate  conflict footage down to the exact street.
47. 3:38SpiderFoot deserves a mention here too  because it automates almost everything
48. 3:42I just described into a single scan.  Point it at a domain, an email, or an IP,
49. 3:48and it pulls from dozens of data sources  simultaneously, including breach databases,
50. 3:53building a full relationship map  automatically. It's open source,
51. 3:57it runs locally, and most people who've heard  the name still have never actually run it.
52. 4:03And then there's something most  OSINT content completely ignores,
53. 4:07court records and public filing databases.  PACER for federal court records in the US,
54. 4:12and equivalent public registries in most  other countries, contain an enormous amount
55. 4:17of information that nobody thinks to check.  Lawsuits, property disputes, business filings,
56. 4:23all public, all searchable, and frequently  containing addresses, employment history,
57. 4:28and financial details that no social  media platform will ever give you.
58. 4:33None of these tools are illegal. None of them  are hacking. Every single one works because
59. 4:38the information was already public, posted, filed,  registered, or leaked into a breach database that
60. 4:45anyone can search. The skill in OSINT isn't  accessing secret information. It's knowing
61. 4:46that the information was never secret to begin  with, and knowing exactly where to look for it.
62. 4:46This is also exactly why I built a full  OSINT course inside Cyberflow Academy,
63. 4:51because the tools I just listed are  genuinely scattered across forums,
64. 4:56GitHub repos, and obscure training pages  that ninety percent of people learning
65. 5:00OSINT never find on their own. The course goes  through this entire methodology, the tools,
66. 5:02the actual investigative workflow professionals  use, how to chain findings together instead of
67. 5:03just running tools in isolation, and  the community inside is full of people
68. 5:05actively doing this, cross-referencing findings,  helping each other when a lead goes cold. Link's
69. 5:07in the description, code Cyber50 for fifty  percent off. Now let's wrap this up properly.