Cover
Prologue
1. My Story
CHAPTER 1: Getting Started
1. Why This Book Is Different
2. What You Need to Know
3. Important Resources
4. Cryptocurrencies 101
5. Summary
CHAPTER 2: Investigations and Threat Actors
1. The Path of an Investigator
2. The Dark Overlord
3. Summary
Part I: Network Exploration
1. CHAPTER 3: Manual Network Exploration
  1. Asset Discovery
  2. Phishing Domains and Typosquatting
  3. Summary
2. CHAPTER 4: Looking for Network Activity (Advanced NMAP Techniques)
  1. Getting Started
  2. Working against Firewalls and IDS
  3. Summary
3. CHAPTER 5: Automated Tools for Network Discovery
  1. SpiderFoot
  2. SpiderFoot HX (Premium)
  3. Intrigue.io
  4. Recon‐NG
  5. Summary
Part II: Web Exploration
1. CHAPTER 6: Website Information Gathering
  1. BuiltWith
  2. Webapp Information Gatherer (WIG)
  3. CMSMap
  4. WPScan
  5. Summary
2. CHAPTER 7: Directory Hunting
  1. Dirhunt
  2. Wfuzz
  3. Photon
  4. Intrigue.io
  5. Summary
3. CHAPTER 8: Search Engine Dorks
  1. Essential Search Dorks
  2. Automated Dorking Tools
  3. Summary
4. CHAPTER 9: WHOIS
  1. WHOIS
  2. Whoisology
  3. DomainTools
  4. Summary
5. CHAPTER 10: Certificate Transparency and Internet Archives
  1. Certificate Transparency
  2. Wayback Machine and Search Engine Archives
  3. Summary
6. CHAPTER 11: Iris by DomainTools
  1. The Basics of Iris
  2. Guided Pivots
  3. Bringing It All Together
  4. Summary
Part III: Digging for Gold
1. CHAPTER 12: Document Metadata
  1. Exiftool
  2. Metagoofil
  3. Recon‐NG Metadata Modules
  4. Intrigue.io
  5. FOCA
  6. Summary
2. CHAPTER 13: Interesting Places to Look
  1. TheHarvester
  2. Paste Sites
  3. Forums
  4. Code Repositories
  5. Wiki Sites
  6. Summary
3. CHAPTER 14: Publicly Accessible Data Storage
  1. The Exactis Leak and Shodan
  2. CloudStorageFinder
  3. NoSQL Databases
  4. NoScrape
  5. Summary
Part IV: People Hunting
1. CHAPTER 15: Researching People, Images, and Locations
  1. PIPL
  2. Public Records and Background Checks
  3. Image Searching
  4. Cree.py and Geolocation
  5. IP Address Tracking
  6. Summary
2. CHAPTER 16: Searching Social Media
  1. OSINT.rest
  2. Skiptracer
  3. Userrecon
  4. Reddit Investigator
  5. Summary
3. CHAPTER 17: Profile Tracking and Password Reset Clues
  1. Where to Start (with TDO)?
  2. Building a Profile Matrix
  3. Social Engineering
  4. Using Password Reset Clues
  5. Summary
4. CHAPTER 18: Passwords, Dumps, and Data Viper
  1. Using Passwords
  2. Acquiring Your Data
  3. Data Viper
  4. Summary
5. CHAPTER 19: Interacting with Threat Actors
  1. Drawing Them Out of the Shadows
  2. Who Is WhitePacket?
  3. YoungBugsThug
  4. Establishing a Flow of Information
  5. Summary
6. CHAPTER 20: Cutting through the Disinformation of a 10‐Million‐Dollar Hack
  1. GnosticPlayers
  2. GnosticPlayers' Posts
  3. Making Contact
  4. Bringing It All Together
  5. What Really Happened?
  6. Summary
Epilogue
1. In Closing, Thank You!
Index
End User License Agreement

List of Illustrations

Chapter 1
1. Figure 1.1
2. Figure 1.2
3. Figure 1.3
4. Figure 1.4
5. Figure 1.5
6. Figure 1.6
Chapter 2
1. Figure 2.1
2. Figure 2.2
3. Figure 2.3
4. Figure 2.4
5. Figure 2.5
6. Figure 2.6
7. Figure 2.7
Chapter 3
1. Figure 3.1
2. Figure 3.2
3. Figure 3.3
4. Figure 3.4
5. Figure 3.5
6. Figure 3.6
7. Figure 3.7
8. Figure 3.8
Chapter 4
1. Figure 4.1
Chapter 5
1. Figure 5.1
2. Figure 5.2
3. Figure 5.3
4. Figure 5.4
5. Figure 5.5
6. Figure 5.6
7. Figure 5.7
8. Figure 5.8
9. Figure 5.9
10. Figure 5.10
11. Figure 5.11
12. Figure 5.12
13. Figure 5.13
14. Figure 5.14
15. Figure 5.15
16. Figure 5.16
17. Figure 5.17
18. Figure 5.18
19. Figure 5.19
20. Figure 5.20
21. Figure 5.21
22. Figure 5.22
23. Figure 5.23
24. Figure 5.24
25. Figure 5.25
26. Figure 5.26
27. Figure 5.27
28. Figure 5.28
29. Figure 5.29
30. Figure 5.30
Chapter 6
1. Figure 6.1
2. Figure 6.2
3. Figure 6.3
4. Figure 6.4
Chapter 7
1. Figure 7.1
2. Figure 7.2
3. Figure 7.3
4. Figure 7.4
5. Figure 7.5
6. Figure 7.6
7. Figure 7.7
Chapter 8
1. Figure 8.1
2. Figure 8.2
3. Figure 8.3
4. Figure 8.4
5. Figure 8.5
6. Figure 8.6
7. Figure 8.7
8. Figure 8.8
9. Figure 8.9
10. Figure 8.10
11. Figure 8.11
Chapter 9
1. Figure 9.1
2. Figure 9.2
3. Figure 9.3
4. Figure 9.4
5. Figure 9.5
6. Figure 9.6
7. Figure 9.7
8. Figure 9.8
9. Figure 9.9
10. Figure 9.10
11. Figure 9.11
12. Figure 9.12
13. Figure 9.13
14. Figure 9.14
15. Figure 9.15
16. Figure 9.16
17. Figure 9.17
18. Figure 9.18
19. Figure 9.19
20. Figure 9.20
21. Figure 9.21
22. Figure 9.22
23. Figure 9.23
24. Figure 9.24
25. Figure 9.25
26. Figure 9.26
27. Figure 9.27
28. Figure 9.28
29. Figure 9.29
30. Figure 9.30
Chapter 10
1. Figure 10.1
2. Figure 10.2
3. Figure 10.3
4. Figure 10.4
5. Figure 10.5
6. Figure 10.6
7. Figure 10.7
8. Figure 10.8
9. Figure 10.9
10. Figure 10.10
11. Figure 10.11
Chapter 11
1. Figure 11.1
2. Figure 11.2
3. Figure 11.3
4. Figure 11.4
5. Figure 11.5
6. Figure 11.6
7. Figure 11.7
8. Figure 11.8
9. Figure 11.9
10. Figure 11.10
11. Figure 11.11
12. Figure 11.12
13. Figure 11.13
14. Figure 11.14
15. Figure 11.15
16. Figure 11.16
17. Figure 11.17
18. Figure 11.18
19. Figure 11.19
20. Figure 11.20
21. Figure 11.21
22. Figure 11.22
23. Figure 11.23
24. Figure 11.24
25. Figure 11.25
26. Figure 11.26
27. Figure 11.27
28. Figure 11.28
Chapter 12
1. Figure 12.1
2. Figure 12.2
3. Figure 12.3
4. Figure 12.4
5. Figure 12.5
6. Figure 12.6
7. Figure 12.7
8. Figure 12.8
9. Figure 12.9
10. Figure 12.10
11. Figure 12.11
12. Figure 12.12
13. Figure 12.13
14. Figure 12.14
15. Figure 12.15
16. Figure 12.16
17. Figure 12.17
18. Figure 12.18
Chapter 13
1. Figure 13.1
2. Figure 13.2
3. Figure 13.3
4. Figure 13.4
5. Figure 13.5
6. Figure 13.6
7. Figure 13.7
8. Figure 13.8
9. Figure 13.9
10. Figure 13.10
11. Figure 13.11
12. Figure 13.12
13. Figure 13.13
Chapter 14
1. Figure 14.1
2. Figure 14.2
3. Figure 14.3
4. Figure 14.4
5. Figure 14.5
6. Figure 14.6
7. Figure 14.7
8. Figure 14.8
Chapter 15
1. Figure 15.1
2. Figure 15.2
3. Figure 15.3
4. Figure 15.4
5. Figure 15.5
6. Figure 15.6
7. Figure 15.7
8. Figure 15.8
9. Figure 15.9
10. Figure 15.10
11. Figure 15.11
12. Figure 15.12
13. Figure 15.13
14. Figure 15.14
15. Figure 15.15
16. Figure 15.16
17. Figure 15.17
18. Figure 15.18
19. Figure 15.19
20. Figure 15.20
21. Figure 15.21
22. Figure 15.22
23. Figure 15.23
24. Figure 15.24
Chapter 16
1. Figure 16.1
2. Figure 16.2
3. Figure 16.3
4. Figure 16.4
5. Figure 16.5
6. Figure 16.6
7. Figure 16.7
8. Figure 16.8
9. Figure 16.9
10. Figure 16.10
11. Figure 16.11
12. Figure 16.12
13. Figure 16.13
14. Figure 16.14
15. Figure 16.15
16. Figure 16.16
17. Figure 16.17
18. Figure 16.18
19. Figure 16.19
20. Figure 16.20
21. Figure 16.21
22. Figure 16.22
Chapter 17
1. Figure 17.1
2. Figure 17.2
3. Figure 17.3
4. Figure 17.4
5. Figure 17.5
6. Figure 17.6
7. Figure 17.7
8. Figure 17.8
9. Figure 17.9
10. Figure 17.10
11. Figure 17.11
12. Figure 17.12
13. Figure 17.13
14. Figure 17.14
15. Figure 17.15
16. Figure 17.16
17. Figure 17.17
18. Figure 17.18
19. Figure 17.19
20. Figure 17.20
21. Figure 17.21
22. Figure 17.22
23. Figure 17.23
24. Figure 17.24
25. Figure 17.25
26. Figure 17.26
27. Figure 17.27
28. Figure 17.28
29. Figure 17.29
30. Figure 17.30
31. Figure 17.31
32. Figure 17.32
33. Figure 17.33
Chapter 18
1. Figure 18.1
2. Figure 18.2
3. Figure 18.3
4. Figure 18.4
5. Figure 18.5
6. Figure 18.6
7. Figure 18.7
8. Figure 18.8
9. Figure 18.9
10. Figure 18.10
11. Figure 18.11
12. Figure 18.12
13. Figure 18.13
14. Figure 18.14
15. Figure 18.15
16. Figure 18.16
17. Figure 18.17
18. Figure 18.18
19. Figure 18.19
Chapter 19
1. Figure 19.1
2. Figure 19.2
3. Figure 19.3
4. Figure 19.4
5. Figure 19.5
6. Figure 19.6
7. Figure 19.7
8. Figure 19.8
9. Figure 19.9
10. Figure 19.10
11. Figure 19.11
12. Figure 19.12
13. Figure 19.13
14. Figure 19.14
15. Figure 19.15
16. Figure 19.16
17. Figure 19.17
Chapter 20
1. Figure 20.1
2. Figure 20.2
3. Figure 20.3
4. Figure 20.4
5. Figure 20.5
6. Figure 20.6
7. Figure 20.7
8. Figure 20.8
9. Figure 20.9
10. Figure 20.10
11. Figure 20.11
12. Figure 20.12
13. Figure 20.13
14. Figure 20.14
15. Figure 20.15
16. Figure 20.16
17. Figure 20.17
18. Figure 20.18
19. Figure 20.19
20. Figure 20.20

Prologue

One of the more recent investigations I worked on involved the hack of a multi‐billion dollar organization. Their stolen data was posted for sale in private circles, and upon finding this out, I immediately contacted the organization. The organization had many questions, and given my prior investigative work, I was able to reach out to the threat actor on their behalf and obtain information on how the breach occurred.

The following text is a portion of the writeup provided by NSFW, a threat actor we will be covering in much greater detail throughout this book, where he describes, in detail, how he was able to hack this organization’s network. The process he used was sophisticated, and by no means a run‐of‐the‐mill drive‐by hack.

This was very well planned and executed.

All identifying information has been changed.

HACK WRITEUP: NSFW

Firstly I realised that GitHub is adding new device verification within the week, therefore I tried to identify as many developers as possible and sign into their GitHub account to access organisation private repo’s.

I then identified software developers working for Company using LinkedIn. Partially doxing each one to obtain Gmail accounts, I found Bob.

Performing database lookups in hope for password reuse (or rules to be applied to their previous password) in order to login with valid credentials.

The way I got into the GitHub was due to Bob, who reused the password “BobsTiger66” (Which GitHub had told was insecure with a red banner, yet he chose to ignore it), and was reused on multiple private databases and one public database (ArmorGames).

Once logged in I had to act quick to avoid GitHub’s new ML algorithm to lock accounts out of using new IPs, so I immediately used ssh‐keygen to add a new public SSH key to the user profile, I had realised you had added Okta SSO preventing the clone of private repos, in order to bypass this I looked at potential integrations.

CircleCI is a popular CI/CD tool which is inherently linked to organisations via either SSH key linkage or PAT’s, therefore I realised the build processes could be exploited in order to obtain private repos, however this was not needed. You guys had added a weird implementation of Okta STS with AWS, producing time‐limited tokens, I realised these were spawned everytime a new build process was triggered, therefore I accessed Circle debug mode and managed to extract these time limited tokens, and used them to download your internal datalakes.

Unfortunately these tokens were not given any further privileges, therefore you got lucky or else I would have gained access to RDS via CLI and cloned a snapshot.

When I read this, I was immediately impressed by the level of effort he put into the hack. And despite the outcome, the client was, too.

In the end, this breach had a happy ending, because I was able to provide useful intel to the customer that allowed them to identify how the breach happened, and to also put in proper safeguards to ensure that this did not happen again.

That’s ultimately the point, right?

Not to provide customers with a useless writeup of generic TTPs (tactics, techniques, and procedures) regarding assumed threat actors—which is what so many threat intelligence companies do—but to actually provide useful context for how a threat actor breaches their systems.

So many companies just rely on providing existing reports on threat actor groups and never actually get to the core of how an attack happened. Sometimes it takes actually hunting down the threat actors and speaking to them directly. They are usually pretty open and willing to brag about how they did it, because on some level all hackers want to be famous; and as we will see in future chapters, vanity always trumps OPSEC (operational security).

In this particular case, I was already speaking to NSFW about several other hacks he is associated with, so it was no issue to ask how he was able to pull this off.

And if you are paying close attention, you will have noticed several misspellings and important “tells” associated with his writeup. Common misspellings or even regional differences in spelling (e.g., organisation vs. organization) can be very important investigative clues that we will discuss in future chapters.

But before we dive into all that, I feel it is important to shed some light on who I am, so you can get to know me a little better, understand what makes me tick, and maybe get accustomed to some of the dry humor and sarcasm that you will find sprinkled throughout this book.

My Story

When I started writing this book, I asked myself a simple question: Am I qualified to write this book? To this day, my answer is still “probably not.” I don’t believe one person can know everything there is to know about a topic, which is why you will find tips and stories from other industry experts throughout this book.

I admire and respect each of the people that I have asked to contribute to this book. I know their work firsthand, which is why I feel they each bring their own unique perspective that complements and reinforces the topics I will be putting forward.

But before we get to that, here is some insight into who I am and what makes me tick.

History

I was about 10 years old when my dad brought home an IBM PS/2. I had no idea what it was or what it could do, but I was mesmerized. This was before the Windows 3.1 days. I remember turning it on and staring at a DOS prompt and just hacking my way through it. The whole thing was like a giant puzzle, which is probably why it sucked me in.

I am a huge puzzle junkie. The more complex, the better. One of my strengths (and also admittedly a weakness) is that I can be relentless when I am trying to find a solution to a complex problem. Some have referred to this behavior as “obsessive.” I get it, and I acknowledge the behavior.

There are nights where I am still cranking away at 4 a.m. because I just can’t stop. It’s part of who I am, and it is a big part of why I feel that I am very good at what I do—whether that be trying to hack into a system or assembling the story behind a criminal investigation.

Roots and Raves

In case you are wondering, I started out my career as a web developer writing HTML and JavaScript in the late ’90s. I grew up in New Jersey and was always into electronic music. Naturally, I was also entranced with the rave culture. Nightclubs like Limelight and Tunnel were the big thing, and I wanted to be a part of it.

Unfortunately these clubs had a 21+ age requirement, which was a problem because I was 16. So I taught myself HTML and offered to build a free website for one of the club’s resident DJs. From then on, I could just walk in with him because I was his “web guy.” Problem solved.

Penetration testing is not much different, which is why I have been doing it (in one form or another) all my life. It’s all a matter of understanding what the rules are, then figuring out a way to circumvent them.

I have always been good at finding ways to get around the rules, which I think is a trait shared by most penetration testers.

Don’t get me wrong, rules are important. Some people like living their lives in a well‐defined sandbox, while others enjoy the challenge of trying to find ways to break out of it. I am the latter.

Developing a Business Model (with Lasers!!)

One evening circa 2011, I was browsing the Internet the same way most people do: with Burp suite active and running passive recon on all sites that I visited.

I was telling my wife about an awesome site that sells high‐powered lasers in different colors, hoping she would let me buy one. That was a hard no, but much to my surprise, Burp suite found a passive SQL injection vulnerability in the site.

I had to check it out, and before I knew it, I was able to see the site’s user accounts with hashed passwords. Logging in to the site with one of the admin accounts meant having to crack the admin’s password hash, which wasn’t difficult using any number of online hash crackers given that the password was some variation of Admin123.

I logged in to the site and voilà! I had full access to everything. System records, user accounts, order information, and all.

It was that exact moment that I felt the entrepreneurial spark. What if I could take this information and give it to the site’s owners so they could fix the injection bug, preventing others from accessing the site in the same way? Surely they would repay this random act of kindness with some of their badass high‐power lasers?

I am now the proud owner of a 2,000mW blue laser, and a 1,000mW green laser! Nice, right? The lasers actually burn stuff. They are pretty bad‐ass.

More importantly, the site closed the SQL injection vulnerability, and I had a model for a business to provide services that could actually help people.

In the process, I also learned an extremely valuable lesson: If you hack into a website first, then try to offer the solution to the customer and ask for a “tip” in the form of a product from their website, it could be interpreted as extortion.

Oops. That clearly wasn’t my intent, which I think came off in my email with the CEO, but looking back, I am sure I could have been in some trouble. So while this particular exercise worked out well for everyone, I clearly had to do some work in refining the business model.

Education

One day while I was working for the Department of Defense, I heard from a senior leader that he was going to be bringing someone onto his team that recently completed his “ethical hacking” certification.

Certification? I bet I could do that, seeing as how I already had the skills to hack into things and had been doing it all my life. It sounded like a great career path doing something that I really enjoyed, so I started looking into it.

By this point, I had already earned a bachelor’s degree. I started working a tech‐support job while I was in high school, then only took a semester of college before dropping out. It was not until much later that I decided to go back and finish my online bachelor’s degree.

After some research, I found a master’s program at Western Governor’s University (WGU) that specialized in information security and included the Certified Ethical Hacker (CEH) and Certificated Hacking Forensic Investigator (CHFI) certifications as part of the coursework. So I decided to get my master’s degree.

After a few years, I finished my master’s and had all of the certifications that I wanted. Thinking back, I guess I felt a lot like Forrest Gump when he was running across the country: I had already made it this far, so I might as well keep going, right? So I decided to skip the customary CISSP certification and went for my PhD.

I spent about four more years taking online classes and wrote my dissertation on the “perceived effectiveness of the cybersecurity framework among CISOs of varying industries.” I received my PhD in 2018.

Starting Night Lion Security

Having worked with a number of large organizations, including being director of security services for RSM (a top‐five accounting firm), I felt that I had a unique perspective on how other organizations performed penetration testing and risk assessments, and I knew I could provide something better.

In 2014, I decided to start Night Lion Security, my own security consulting firm. My vision was (and still is) to assemble an elite force of hackers and penetration testers in order to deliver a report that is thorough and useful.

Being a startup security consulting firm is difficult enough on its own. Being a security startup and trying to compete against giants like Optiv, KPMG, SecureWorks, and AT&T has been brutally difficult.

I feel that I was able to stand out in such an oversaturated market by being heavily active in the news and media. I feel that being on TV is one of the core reasons why companies were willing to take their chance with a small startup that no one had ever heard of. I don’t think I would have been able to make it this far without that.

I have been criticized for this approach because I am seen as the person that is “self‐promoting” by going on TV. But in the end, I feel it was worth it because doing so has allowed me to give back in a way that I would not have been able to otherwise. The following is a perfect example.

We recently completed a penetration test for a large, publicly traded bank. At the end of the test, the VP of security went out of his way to tell me that our test was “the first actual penetration test they ever had.” All of the big “board approved” companies they used in the past did nothing more than provide a glorified vulnerability scan, and we were able to give them something much more valuable. I am extremely proud of this, and so thankful that he told me because this is exactly the vision I set out to accomplish when I started Night Lion.

Digital Investigations and Data Breaches

The transition to digital investigations was so seamless that it wasn’t a transition at all. I wouldn’t even say I “moved” to digital investigations, because it was always just something that I did. Working incident response cases, penetration testing, solving complex problems—it is all the same. It’s all about cracking a puzzle.

As I quickly found out, working on your own cases (i.e., looking for exposed data leaks and breaches) can quickly become more of a challenge in dealing with the aftermath than actually finding and exposing the data.

I uncovered a number of high‐profile data leaks including Exactis, Apollo.io, and Verifications.io (which I will discuss more in Chapter 14), and in each case the aftermath of the exposure was different every time.

Verifications.io was particularly interesting because that led to a situation of discovering that the exposed data had actually been stolen from someone else. The company turned out to be completely fake, and once I started poking around, they shut it all down and went running.

There have also been many times where I have gone in circles sending copies of data to dozens of companies trying to find the owner.

Something to consider: If you contact a company inquiring about a possible data breach (or leak), that company is under no obligation to tell you whether the data actually belongs to them.

Despite the fact that people in this industry may be trying to do the right thing, there are significant repercussions that go along with a company having to publicly admit to a data breach (or leak)—for one, someone is almost always going to get fired, or worse….

In Chapter 14 I detail my own account of the Exactis breach and other discoveries. Let’s just say it’s never fun (or easy) when a CEO sends you a text message on a Saturday night asking why you’ve ruined his life. Here is Troy Hunt, owner of HaveIBeenPwned, with a similar story:

EXPERT TIP: TROY HUNT

An incident that comes to mind is when V‐Tech, the Hong Kong toy maker, was breached. This would have been around 2015. This was a huge amount of data relating to kids, including the kids’ photos. V‐Tech had SQL injection all over the place, it was just an absolute train wreck.

The trouble there as well is it’s a Hong Kong toy maker, and as soon as you seem to get to that part of the world, it can be really, really hard to get ownership for these incidents because the company will just sort of shut the doors on you and ignore it, which is what happened in my case.

Breaches with that level of sensitivity are, I think, particularly interesting.

Along those lines as well, the Red Cross Blood Service in Australia had a similar incident a couple years ago insofar as it was a large amount of very sensitive data, including mine. My blood donation application was in there.

This was about half a million Australians, including your blood type and including eligibility criteria or the questions to eligibility criteria such as have you had at‐risk sexual activity. It is a perfectly valid question to ask someone about to donate blood, but not a perfectly valid thing to back up from a production server to a publicly facing test server with enabled directory browsing.

The difference with the Red Cross is they just did an enormously good job of their handling of the incident once it actually went live. They regularly stand out now as the gold standard for post‐breach incident handling, which is good.

Everything has its ups and downs, but at the end of the day, I love what I do.

This book is the culmination of the past twenty years of my life. I have filled it with real‐life stories, scenarios, and techniques that will hopefully one day help you in your own investigations.

With that, let’s rock and roll.

Hunting Cyber Criminals

A Hacker’s Guide to Online Intelligence Gathering Tools and Techniques

About the Author

About the Technical Editor

Acknowledgments