the art of the dork finding candidates through osint
TRANSCRIPT
Education/Action/Protection
The Art of the Dork Finding Candidates through OSINT
Michele Fincher
Social'Engineer.com
I’m not looking for a job, but….
• B.S. Human Factors Engineering, USAF Academy
• M. S. Counseling, Auburn University • Former USAF Academy Assistant Professor and
National Board Certified Counselor (NBCC) • Computer Information Systems Security
Professional (CISSP) • Social engineering penetration tester and Chief
Influencing Agent, Social-Engineer, Inc.
Social'Engineer.com
What is Social Engineering?
“….any act that influences a person to take an action that may or may not be in their best
interests…”
3
Social'Engineer.com
Why is a pen tester speaking at SourceCon?
u Knowledge is power!
u OSINT (open source intelligence) is a key piece of social engineering pen testing
u You can use the same techniques to find your candidates (creep factor excluded)
4
Social'Engineer.com
What is OSINT? u Basically, it’s information
that anyone can find u Methods include
u Dumpster diving u Elicitation u Online searches
u Sources can be u Media u Photos u Professional journals,
research, etc.
Social'Engineer.com
What does this photo say about the owner?
Social'Engineer.com
What do I now know about this company?
Social'Engineer.com
The problem with getting information…
Social'Engineer.com
And, there are LOTS of OSINT sources…
u But this is about using Google Dorks u Why Google? (legal shizzle: I don’t work for
Google)
Social'Engineer.com
How to: Know your operators u site – searches a specific domain u intext/allintext – searches for one/
all terms on the web page u intitle/allintitle – searches for one/
all terms on the page title u inurl – searches for a term in the
URL u filetype – finds a specific file type
(doc) u numrange – searches in a number
range u daterange – searches in a date
range u loc – searches on a specific place
h%p://www.googleguide.com/advanced_operators_reference.ht
ml#=tle
Social'Engineer.com
How to: Guidelines u Format - Operator:keyword, no spaces u Can string together several inquiries – the “AND”
is implicit u Use “” for exact matches: “Star Wars” u Use a “-” to exclude items: “Star Wars” –wikipedia
-youtube u Use a “~” for synonyms (~bread) = rolls, buns,
etc. u Google limits queries to 32 words u Not case sensitive u Use of any “allin” operators must come first
Social'Engineer.com
What kind of stuff can we find?
u Creeper demo
Social'Engineer.com
What kind of stuff can we find?
u Your perfect candidate
Social'Engineer.com
How to build your own dork
u Outline ideal candidate u Narrow search to
specific site u Enter key words or
phrases u Exclude terms as
necessary u Experiment u Google Alert it!
