OSINT
Open Source INTelligence: Abusing public information
Account Finding
When you have a username of someone and want to find more information about that username, you can try to search for that username on different social media platforms. There are also a few tools that do this for you on a lot of websites quickly.
A popular CLI tool is sherlock, where you can simply provide a username and see all the accounts that were found:
sherlock USERNAME [USERNAMES ...]Another tool I have found to be very useful is the following site:
The above web tool also shows some Google search results, as a bonus. These can be useful in finding more details about a username, and what it is associated with.
Certificate Transparency
Certificate Transparency (CT) can be a useful tool as it provides a publicly accessible log of all issued SSL certificates for websites, including information about the domain names associated with the certificate. Some databases collect these logs and make them able to be queried, like Censys:
Subdomains
Very often when setting up a new subdomain the owner will have to register a new certificate for it. Simply put in a query to Censys with a pattern like .gitbook.com follows to get all the subdomains of a certain root domain:
Note that these queries can take some time, as there is a lot of data to query through. Just be a little patient with these services.
Last updated