RECON VILLAGE - Core OSINT: Keeping Track of and Reporting All the Things
Hoffmann, Micah
“Your client gives you their requirement, ““find the social media accounts of the target person and any friends they may have””. Simple enough. You execute your Standard Operating Procedures (you DO have a SOP, right?) and begin running tools, using your sock puppets, scraping web sites, and finding a ton of data. You’ve got CSVs, text output, images, URLs….OH MY! How do you keep track of all this data and, more importantly, how do you ensure that you can report on it and have covered all the pivot points for the OSINT investigation? As OSINTers, pentesters, defenders, PIs, and others, we can easily get swamped in data. Join me as we look at some bad, some good, and some amazing methods of keeping your investigation on track.”
 Okay, if everyone's ready, we'll get into the next session. Don't worry, I will be disappearing from this microphone very, very soon, because I've got a pizza that's under that table that I need to eat. But I will just introduce Michael Hoffman. I introduced him yesterday into the wrong name, so if I've done it wrong again, he's just going to ignore that, and we're swiftly going to move into his talk. This talk is called Ozzie, Keeping Track and Reporting of All Things. And over to you. Thank you. Thanks, everybody. We're going to have a good time. When I first submitted this talk to the Recon Village, I was thinking, hey, this could actually be kind of a workshop. And then I thought, well, maybe I'll do a little bit more of just a presentation. So this is actually one of those neat mash-up talks. You're welcome to play along as I do certain things here. All this stuff, first off, my slides are on the internet already. I'll give you a link at the end, so you don't have to do the Take In The Pictures thing. You'll get the actual slides. And also, there's a lot of things that I'll be releasing during the talk. So you can, again, you can grab that off the interwebs. So I am Michael Hoffman. I go by Web Reacher on the interwebs. I have a nice website, webreacher.com, where I blog about a lot of these open source intelligence things that I find helpful, fun, entertaining, as well as web application stuff. I do pen testing, run a maker space, open source projects, Teach for Sands, Rota, Chlorosun, open source intelligence for Sands. That's a lot. But let's not talk about me. I have a question for you all. This is actually a question where you're going to need to raise your hand. Yes, exercise involved. Here we go. Ready? Raise your hand if you love to document. Wow, you guys are weird. I wrote this slide, I'm like, it's going to be crickets, but no. How many of you really believe? So yeah, I absolutely don't like documenting, but I recognize that it's a necessity in penetration testing as well as defense work, as well as open source intelligence. We have to do it because if we don't, things go awry. Now when I was younger, what I found about open source intelligence is I love to do the data acquisition. I love finding shit about people or things or IPs. I love analyzing the data and putting it together and finding those connections and finding how things actually appeared, whether it was using like Maltigo or something else and finding those relationships. That was awesome. And then which of those things do I need to dive deeper in? Where do I need to pivot and go deep? I love doing all that. And then of course my senior OSINT person or senior pentast would be like, yeah, Micah, you know that the reports do tomorrow. I'm like, just a little bit more, dad, or whatever his name was. Just a little bit more. I've almost got more things I can find. And I always squeeze that little open source, the documentation to the end. Nowadays, adulting Micah, I still like doing the same things. But what I'm finding is that I'm doing a lot more analysis. And the reason why I'm doing more analysis is I have more data, more good data that I can go through. That data that you collect along the way is going to help determine where your OSINT investigation takes you or doesn't take you. And that's very important. Because I've written a lot of open source intelligence reports. I've written a lot of pentast reports. I can't tell you the number of times. I've gotten to the pentast report and like, yeah, we popped that box and I got SQL injection and I stole a copy of the database. Who has the database? I know I popped it and they're like, yeah, you had it. Remember, you put it into our chat. Oh, and the chat now in Slack, that part of the conversation is gone so you can't actually grab it. And I don't have that stuff. That would be awesome sauce to my customer. Don't let that happen to you. One of the things that I like talking about is documenting deeply as you go. When I do web pentests, I document, if I'm doing SQL injection, boom, I'm tagging it, I'm looking at it, I'm recording it as I go. When I do something in open source intelligence, I have to record it as I go because that data might change in a minute. I never see somebody tweet something out and it's gone. You're like, oh, that was cool. And you click on it, it's like tweet is unavailable. Yeah, stuff disappears. And if you're doing a multi-day, multi-week assessment, that stuff is not going to be there potentially when you get back to it. So document deeply. And what I found is that when you actually do document deeply, your reports get better because you have more data. You don't have to start scrounging going, well, I don't really have this data. The screenshot of that, but if you imagine a website with a picture of the person on it, that's what, no, you have the pictures as they showed up. And that's really the impactful part of it. When we do open source intelligence, one of the things that we have to do is convey to our customers what we see and what it means. And what it means is so very important for the impact. Over the years of teaching for SANS and teaching internally for my companies, I've found that people are still using some older technologies to document. We do capture the flags in the SANS classes if you've ever taken one. Usually on the last day, we do a capture the flag. And I see people pulling up these solid but old, tiny types of applications to record their process. And every time I see that, I'm like, ugh, we can do better. And that's really what this course is about. Of course. That's really what this talk is about. Because if you're using these to capture your notes during an assessment, I'm guessing it's suboptimal. And I'll show you how in just a little bit. But before we get to the tools, which I know everybody's like, all right, show me more tools, you know, release something. Before we get to that, let's talk about why you document. Because that's equally as important as what you document. Because what you are collecting while you're actually doing the assessment, while you're doing the scanning, while you're doing the analysis is extremely important. And we've got a lot of different data types. We have a lot of different pieces of data also that we need to collect to keep that timeline of evidence. If you're doing something for law enforcement or for forensics, you've got to keep dates and times. You've got to keep where you've got something. Sometimes you've got to keep how you got there, too. I've seen pentas reports and OSINT reports where it's like, hey, I found that picture of the person that was doing some kind of insurance fraud. And they are playing basketball in their driving. And my customer was like, that is terrific. How did you get it? Where did you get it? What date was that? And if you don't have that data, you're ultimately failing your customer. Now when we actually do collect stuff, we have to think about it. We may have a tendency to collect all the things, and that's great. Before we actually do an assessment, we have to think about what are the types of data? Where might things go awry? And what are my special considerations? For instance, if you're doing some gathering of information, maybe on some dating sites or on some other more sensitive types of sites, maybe you find some classified data or proprietary data, maybe you find some data that is against the law to have on a computer or to be sharing. How do you record that safely enough so you can include it in your report but not violate any laws yourself by propagating that type of stuff? And there are rules for this. You have to think about it before you just collect. Some of the other things that I found is that when you are collecting information about people, sometimes people share an address, right? Share a phone number. Okay. If you're doing that text pad, notepad plus type of documentation, which is serial, right? It's like, I got this person. I got that. Well, then if you are putting that phone number on multiple people, now you have duplicate data in your report, right? It's that phone number here and that phone number up here too, which is a little suboptimal instead of relating a single piece of information. Another thing is some people are going to do an assessment in hours or minutes, and that's going to be really quick. Some people will do campaigns and look at their targets over months. Those are going to have different constraints for how, where, and what you're storing that content on. And your documentation system and platform has to account for that. And another thing is some of you probably work in teams or maybe you share your data with the defenders or maybe you're working cyber threat intelligence, your CTI people, and you're actually going to be writing this up to give to somebody else. Well, when you actually collecting data in teams, it's a whole nother type of mess, right? If you've done this solo, you know, you can rely on yourself. You're like, oh yeah, I'm doing this great. But when you're combining that data or getting somebody else access to it, it can be challenging. You got to work that out first. You got to work that out before you dive into the assessment, especially if your team is around the world. I work with teams that are geographically dispersed across the United States and hey, that time zone change, it matters. Because when I record something on my system and say, hey, I found this at this date and time, well, is that UTC or is that East Coast time? It makes a difference if you're going to court. It makes a difference in some cases. You have to think about these things. The other thing is where are you going to store your stuff, right? Cloud systems, there are some amazing cloud applications that are out there that make storing information so, so simple. And yet they can be a security risk, right? You're sharing your stuff with Google. Now Google would never read your documents that you store in their servers, right? You're using HTTPS. It's encrypted, right? Yeah. You have to think about this. You have to consider it. And then also is your application that you're using made for multiple people to use it or just one? Also, we have to think about are we documenting this for our notes so I can remember my process so I can create a report or are we documenting to hand off to somebody else so that they continue it? When I do some of my assessments, I do up until a certain point and I'm like, hey, I'm done. You keep going, defenders. You go ahead and research the rest of those IPs or do it. And I'm doing that hand off. Well, there's a different level of documentation that you need there. I recently, we were doing some work in a one note document if you know about that Microsoft product. Good tool, multi-user. It works within an enterprise. It's really good or sharing outside of an enterprise. And I was writing this, my notes for myself, you know, because the notebook wasn't shared out. Well, somebody else is like, hey, do you have notes on them? Like, do I have notes on them? Here, let me just add you to this. And he looked at my notes and he was like, well, what the heck does this mean? This is bad person. And what does this mean? Because I was documenting it for me. So we have to think about who our audience is and could be. Because that and could be is that when you deliver your report or your notes, you never know where they're going to go. I've been in organizations where I deliver my notes to a customer and that customer takes that report and then six months later I come back to somebody totally else in that organization. And that other person has said, hey, do you know who Mike is? Quality of work. Do you have anything? And this person's like, yeah, take this really sensitive document and gives it to somebody else in their organization that has no need to know that information. So my report, when I walk into that person's office, is sitting right there on their desk. I'm like, well, I'm glad I didn't include sensitive stuff in there. But we have to think about that. We also have to think about how we're going to document. I always like to document more than I need. Because I can always scale it back. I can summarize, I can redact or whatever it is that I need in order to do my output, whether it's a presentation, whether it's to do something like a report, you can always summarize and redact. But if you don't have that data, it's hard to get it back. I've had people that do an assessment and they're like, oh, it was there. And they take a picture of the thing that says tweet unavailable and put that in the report. It's like, that's not the way to do it. And then your end goal. Where is this document going? Where are your notes going? Are you going to be continuing to work on this project? Are you going to hand it off to somebody, report it, et cetera? Thinking about that is going to help you in understanding what to do with the data. Also, you don't know where the data is going to take you. I'm sure if I ask for a raise of hands, which I'm not going to, and ask you if you ever had a simple project that you were working on, maybe a NoCin project, and you were just doing Facebook stuff and then the assessment maybe took a left turn or something, or maybe you're looking at some dating profiles or something like that, and something weird popped up. I've done assessments where I'm just doing kind of a little background on a CEO or somebody that's a C-suite person. And then I find that there's a Tinder name with that same person that that person has been using for their Gmail. It's like, huh, that's weird. And you look over there and it's a whole nother like lifestyle that this person is leading. You never know where your work is going to be taking you. Now, within open source intelligence, there's a lot of different versions of this diagram of this cycle. Essentially, we have requirements gathering in the upper right, then that leads to retrieving data of some type, analyzing data, and pivoting and reporting. And what I like to do is tag what types of things I'm looking for, what is my documentation, what does my reporting look like at each of these different phases. Retirement gathering is, I'm going to be asking the questions of what am I doing, getting those requirements from my customers so that when I start gathering the data, I know what the hell I'm looking for. What are we finding? That's where you're collecting the data. Of course, if we also have the what is, what are we missing parts in the analysis section, and then when it gets to reporting of whatever kind, we're going to go ahead and make that. Now, this might hit a little bit close to home for some of you, but stick with me here. Let's say that we have an example. Let's say we have a scenario. Maybe your son or daughter's teacher comes to you and says, listen, I know you do that cyber stuff, and I'm wondering if you could help me find something. There is this dude that has been cyber bullying a bunch of kids in the class. And it goes by the name Dread Pirate Robert. It's written like it is on the slide there. Most of the kids that are playing on PlayStations are actually getting hit by this, so I need you to go ahead and take a look at this. You're like, cool, all right, start me off with the username. I got that. So you start your documentation. Does anybody see anything wrong right off the bat? Yeah, we're in Notepad. So Notepad, what happens on Notepad when you close Notepad? Does it save it? It asks you if you want to save it, but then if you don't say yes, it's gone. What happens if your computer crashes? It's gone. So let's say that you went ahead and did this. All right, here we're going to do Dread Pirate Robert. The goal is this. Fine. So you go into DuckDuckGo and you do a search. Now the search here pulls up a Twitter account with Dread Pirate Roberts, that actual username. We've actually got a bunch of information here that we can pull from. We've got a Twitter account at number one. We've got an avatar. We can do some reverse image searching on. We've got an actual spelled out name, Dread Pirate Roberts. That's that number three. And actually a location. Number four is County Claire. Cool. So we go back to our Notepad document. We type it in. DuckDuckGo reports Dread Pirate Roberts, found on Twitter. Here's a URL. There is a screenshot of the avatar and maybe you save it as TWAvatar1. So now you have a separate file on your system. All right, cool. All right. So you look for some of the other things that are on that DuckDuckGo search. Oh, we've got Clash Royale. Ooh, now we're getting into the gaming stuff. That was kind of the primary thing that we were looking for. There is a username Dread Pirate Roberts. Cool. So we've got that. We're going to document that. And of course, now we've got the Twitter plus we've got this Clash Royale thing. So we've got to look up both of those profiles. So we're just going to put it to do on the page. Cool. All right. Let's go back to that Twitter thing. And so here on the Twitter page, we've got even more information coming across. Because again, we've got that avatar. We've got some tweets we need to look into. We've got some geo-located tweets. Maybe we can get some information about where that person is or has been. And of course, we're going to go back to Notepad. We've got to document this stuff, right? We've got some more to do. We've got to do the reverse image search. We've got to do this and that. And then you do the reverse image search. And now you've got 213 sites to look at. And maybe you do reconNG. There's this cool profiler module some dude wrote that goes through and takes a username and goes and looks at it across over 150 websites. Well, you've got that. And so now this is a blow up of one of those. Now you've got four other sites, including Adult Friend Finder that you need to go look at. You've got an Xbox. Well, you have to go look at it. You never know where your assessment's going to take you, right? Sorry. Yeah, you've got Xbox gaming and stuff. All right. So we've got some URLs to go to. And in 10 minutes, we've got a hell of a lot of to-do items. We've got images. We've got user names. We've got URLs. We've got a lot of stuff that we have to collect. Plus we have that reconNG tool output, which we somehow have to include in our documentation. And like I said, this was within 10 minutes. If you're doing this type of an assessment in hours, can you imagine how many of those branches you're going to have to actually deal with? How many to-dos you're going to have? If we're going to do that, we need to have a documenting system that allows us to say, I need to go do that. And when I do, I can collapse it or I can mark that branch as checked off. We also have to have a documentation platform that allows us to collect, note, annotate different types of data, whether it's the pictures that we're coming across on our site or pictures of the websites or the data. And man, wouldn't it be nice if while we're just doing the work of OSINT, something's collecting all of that stuff for us. And some of you already know that Hunchly does that really, really well. If you don't know about Hunchly, stay tuned. Now when I made this talk, I thought about, well, there is a huge number of documentation products. And many of you that do like OSINT, CTI, or even pen testing, you might have special systems or enterprise-wide systems that you have access to. I wanted to keep this talk geared towards that solo practitioner, that person that's doing that OSINT or that pen testing, a recon or whatever it is, alone or in small groups of teams. So that's really my sweet spot here. And that's who I'm talking about. Now, one of the things that we have to think about is the type of data that we're going to be documenting. I was here today for some of the other talks and earlier yesterday for a couple of talks and I saw some great information on Maltigo. If you saw Andrew present on Maltigo and how it puts together data, we've got some data visualizer apps out there that are amazing for showing us connections between IPs, domain names, user accounts. I had an assignment one time where I had to do, I had to see if I could find information about a certain target. And so I went to her husband on Facebook and I found through his network a whole bunch of people with their same last names and then through all of that right into Maltigo. And what Maltigo did was I said, show this data. It showed me really good, tight packs of people that were interconnected, connected to another group of people that were connected very tightly. And it allowed me to see this is a family group and that's a family group and it's connected via these people. So we have visualizers. Maltigo, Gaffee, cytoscope, sorry. We also have word processing apps, Word, LibreOffice, these types of things as well. And they're good for general documentation. But we also have apps that are made to make our jobs as O-Centers a lot easier. Let's talk about that. Now I wanted to focus on one flexible apps that are going to make sense to most of you. It's not going to work for all of you. Some of you are mandated to do one type of thing or another. I also, there are a lot of apps out there so I don't want to actually say, hey, go ahead and use this and it just does one piece of the puzzle. I'm looking for this biggest thing for my buck because I don't want to focus on documentation. I want to focus on doing the O-Cent and to have something document for me. Also easy to use, always a requirement for me and ultimately decreases the work I have to do. Now if you've looked at my blog, webreader.com, you know I'm a very big fan of MindMaps. MindMaps are amazing visual note taking, free applications that are out there that allow you to organize data graphically. So you have one piece of data like a username like DreadPirateRoberts. That DreadPirateRoberts then breaks out into a Twitter account and a gaming account and an adult friend finder and stuff. You have nodes that then branch out. When you're done working on those nodes, you can collapse it and say, this node is done. I'm done checking out adult friend finder and now I need to go and look at other stuff. That's really helpful for keeping track of where you are in your assessment and what you have left to do. If you're interested in it again, this slide deck is online so you don't have to take pictures but on github.com. I have a mind map that you can have for free that's going to hopefully jump in. Jump start your documentation. Now I created this mind map over a year ago and when I was teaching my Sec 487 Sands class, I found that one of my students was doing a lot of note taking during class. I was like, what are you doing? He's like, well, I took all of the things that you said to do in class and I put it into that mind map. That's awesome. So when you get this file, it has a lot of the notes, a lot of the sites, a lot of the other things that are in some OSINT classes like mine. Now we've written it in the XMind application. XMind is a mind map software application and it's free for Windows, Mac, Linux. Again, easy to use on whatever platform you're using. And what it has is it has the centralized process. It has about five different tabs or sheets if you will. And each one's meant for different things. For instance, one of them is meant to discuss things about process. Like, hey, I have email address. What do I do with it? If you were here for my yoga talk yesterday, yeah, it's kind of the same thing, but in an easy to use mind map format. So here we have an email address. If you look there, well, you do email verification. You might look for that email on breach sites like we saw it will do earlier with have I been phoned. It shows you that process of what you can do. We also have a tab in there on data collection that says, hey, if you're doing research on a person, you might want to grab their name and address and phone number and date of birth and aliases. You actually type that into this document and it'll organize it for you. We can also do the same thing for IP addresses, hashtags, sentiment analysis, whatever it is you're doing, you can put it in here. And when you take that content that we had earlier, you remember our document, that notepadding, you start to fill it in into a mind map. The data comes to life and you can see how things are put together. I love it because instead of duplicating the information like, hey, that Dread Pirate Robert's name is here and here and here, I can just use those double dash arrows to say, oh, that username was found on Twitter. And then I can paste in there the username, the picture of what the site looks like on his profile page and put other data points in there. And when I'm done with investigating the Twitter, I can click on these things, collapse the entire branch. You could store other types of data, other types of files just by putting it in there. Other things that we have to do, document the URLs, document the dates and times. Mind maps are manual. So you have to copy that URL and paste in there. It's not perfect. However, organizing the data this way can save you a lot of time, a lot of effort and it can be quite appealing to your customers. Now it's not all fun and games. It's not all great. I will tell you this, that to be honest, there are some drawbacks with mind maps. First off, getting the data out is sometimes a pain in the ass because think about this. For a simple investigation like the Dread Pirate Roberts thing I was telling you earlier, we've got now 213 sites we have to visit. Yeah, we might use a tool like Eyewitness by Chris Truncher or Peeping Tom by Tim Tomes or something like that to scan all those sites. Cool, and we can shove that in there. But what happens is this mind map keeps branching out and branching out and branching out. And when we're using it on the computer, we're just dragging over to this area or dragging to that area. Well, when it comes time to report, how do you take something this big and fit it down to A4 size or 8.5 by 11 size? Sometimes very challenging. So sometimes we'll cut it up or do other stuff with it. And with the pro version of Xmind, there's some better methods of exporting the content. Sometimes you can do it to a PDF. Multi-user, not so much. So if you're a solar practitioner or you're handing documents off, a mind map might be something that you could use. And then everything is manual, which is something I don't like. So what I do is I'll use a mind map for the overall investigation. Where am I going? What do I need to do? And I'll also use Hunchly for that automated easy button approach to Maya's investigation. And Hunchly is amazing. Written by Justin Scythes and his team. It is a great tool. It's a Google Chrome extension. And it makes our lives so easy. Because it does a bunch of things. Everything from going ahead and cataloging and keeping track of any files we download while we're browsing to recording screen captures of every web page you visit. So when you're Googling or duck duck going, or when you're tin-eyeing something, or when you're doing whatever on Adult Friend Finder or whatever, that keeps it sticking in my head for some reason. I'm sorry. When you're going to the PS4 gaming thing site, those pictures are going to be captured automatically along with the date and time that you visited them and the URL. So you don't have to do it manually anymore. You see how this is like, I'm hearing angels singing right now. Now this costs about $130 Canadian per year if you're in the United States. It's like $3 US or something like that. So if you've never used Hunchly, this is Hunchly 2. A lot of people might be using Hunchly version 1. Justin has team upgraded to version 2. And it's significantly awesomer, which is a word. Here what we have is a dashboard. When you launch Hunchly, you can bring up the dashboard, which does overall case management and summary. It tells you what case you're currently in, how many pages you visited, how many files, photos, tagged, et cetera. And then one of the neat things about Hunchly is that sometimes you have these things, that words you need to look for in pages. If I'm looking for Dread Pirate Roberts, any page I visit, I want Dread Pirate Roberts to pop out at me. So I can set it up as a selector. And then I tell Hunchly, hey, wherever you see this on a page, I want you to highlight it in yellow. So when I'm doing my duck duck going or when I do a forums thing and I'm looking at some forum, a gaming forum, and there's Dread Pirate Roberts, it pops right down on the page for me. Makes it easy for me to do my O-sense. Also it keeps track of, and I know this is a little bit small and all. The slides are out there on the internet. But this keeps track automatically of all the websites you visit in Google Chrome. So if you're doing, if you have this great stream of consciousness, like, oh, this duck duck search showed me this, and now I'm going to take this here and go there and go there, it's going to keep track of all that for you and the date and time you did it. It's amazing. And one of the neat things is that if you're visiting social media sites that allow the metadata that's inside of some pictures, you know, the geolocation or what camera took that picture, if that data is still with the pictures, Hunchly will pull it out and highlight it for you, automatically for you. Whoa, that's awesome. Now one of the problems we have is that sometimes we still need to run like, it wills, it wills, I'm sorry, it wills tool. You might need to run some other tool like reconNG or spiderfoot or something like that. And you have that output. What I like doing is doing some side channel loading of that data into Hunchly. Because I use Hunchly as like my repository of all my data. That way when I'm done with my work, I take all of that Hunchly data and I export it and that's what I save. So what you can do is take that reconNG data, remember that profiler module I ran earlier, we can export that to a CSV or a text file and then visit it in a web page. Take a look at this. So I have exported it to reconNGresults.txt, it's a CSV and then I open that document in my Chrome. And now Hunchly has tagged at that date at that time that it has that content and it will highlight all of the Dread Pirate Roberts names in there. And that way when I'm looking through my data, when I'm searching through my Hunchly, I'm like, well hey, where else do I need to go? Where else was this found? I can pull that data up. And it's all in one place. I mentioned to you the XIF data. Yep, if you're visiting web pages that have images, it'll pull it out such as this beach shot that has actually the GPS latitude and longitude in there. Again, we need to go to another site to take a look at it to see where that is. Does it corroborate with the data? But it's one less step that you have to take. You don't have to run the XIF tool or visit a secondary or tertiary site to pull that out. Now again, I like to present the positives and the negatives. Hunchly's got a couple of drawbacks in my opinion. One, it's only Google Chrome. I like doing stuff in Firefox. A lot of my best plug-ins and stuff are in Firefox. I just like doing that. This is only Hunchly. Also, it's single user. If I have two people that are doing the assessment, each of them is going to have their own Hunchly data. Right now, I don't know a way to easily combine that data, or even if I'd want to. But combining that data and creating a centralized report will be a little bit more challenging because you'll have to combine that data. The reporting, it does have a, hey, dump all of the web pages I visited. Dump all of the pictures that I tagged. It has that, but it's not like Microsoft Word or it's not something of that caliber. Again, this is something that we can use to do that automated documentation. And then we put it together. I know that. It's like, that's the one picture you chose when I get, yes, it was free. So if you know why you're documenting and where you're going to be putting that stuff, and who you're documenting with on your team, and who you're documenting for, then what you need to do along with your team is find those tools that work for you and work for your customers and do things the way you want to. I have actually mandated on my team that they use MindMap to do their assessments. And I had one person, and it just didn't work the way that his brain works. That's fine. That's absolutely fine. I realize that MindMap's work for people that learn visually, it's just beautiful. But if you're not a visual learner, that's not going to work. Whatever, make sure that you understand what the requirements are that you need to keep track of, and some people are not going to necessarily be able to use these tools. But you can check out these tools, and there's other ones out there too. Many of them have free trials, and they'll take it and try it out and see what you're doing. Because if you find yourself or a colleague doing this, instead of doing something like this, then they have a little bit of learning left to do. And with that, I will put my contact information, and again, my presentations are right up there on the Yoastin Ninja Prezos, Prezos, and that includes yesterday's presentation and some other ones I've done as well. You're welcome to take them. And the link to my SANS course as well. So I don't know if I have other, I think I might have a second. Do you have any questions for me? Yes, sir? So there are some distributions like Buscador or Buscador, and other things that are specifically made for open source intelligence gathering and an analysis. Do I have any recommendations? My recommendation is going to be a cop out, because I'm going to say, do what works for you. I was having a conversation with a gentleman next door, and he mentioned something similar. I love Buscador, Buscador. I think it's a great tool for what it is. It simplifies a lot of those command line tools. I understand. You know, I come up as a hacker in this community, and I know that command line tools are not hard for me. Python, Ruby, Go, I get it. But for a lot of people, they focus more on law enforcement, and they focus more on the open source intelligence or the CTI aspects. And that stuff's hard. And where Buscador excels, in my opinion, is it abstracts that whole, you need to run this command on the command line, and they give you a graphical just box. Type in the username, and it does all that stuff behind the scenes. So that is a great distribution, and it's 100% free. It's on inteltechniques.com's website, Michael Bazelle's website. But some of the things that you could also do is create your own virtual machine, depending again on what your threat, what your work is asking you to do as far as who you're working on. Obviously, the more sensitive to data, the more nefarious the things that your place is going to be going, you're going to want more of a barrier between your host computer and the other network. Other questions? Sir? Okay, so the question is, are there any laws that would prevent a company from doing this type of reporting on their employees? And the answer is, I am not a lawyer. Next question. No. The answer is yes. There are laws that companies need to be aware of. There's HR stuff. Mostly what I find is that many companies have privacy policies for their employees, or some kind of policy that governs what type of information they will collect about their employees and about their employees' social and how the social activities and how they will use it. And that is usually what you see guiding this, except if you're in the EU, in which case you now have GDPR laws and stuff like that. So I hope that's helpful. Yes, ma'am? Just answer the question. You answered the question in your head. Well done. Are there any other questions? Yes, ma'am? So in some of your examples, you know other things like similar or targeted, and you have in-field that you know more, but with the mind map, it works well for multiple parties? So the question is, is that in my assessment here, the example, I used the Dread Pirate Roberts user, a single person, and then branched out. Is the mind map format good for multiple targets? Let's say you're investigating a gang or something like that, a group of people. The answer is yes. I like it for documenting that stuff. I don't like it for visualizing that. What I would do is I would document all the relationships in here, note-taking-wise, and then probably make something pretty in Maltigo. There's a free version called Case File, which will take a CSV and import it, and it will make a beautiful diagram of this picture. So for a report and for that finalized version, I'd probably use a real visualization tool instead of this. Okay. All right. Well, I'm going to go ahead and say thank you very much for your time. If you have any questions, hit me up or come talk to me. Thank you for your time, everybody. Thank you.
 Okay, if everyone's ready, we'll get into the next session.  Don't worry, I will be disappearing from this microphone very, very soon,  because I've got a pizza that's under that table that I need to eat.  But I will just introduce Michael Hoffman.  I introduced him yesterday into the wrong name, so if I've done it wrong again,  he's just going to ignore that, and we're swiftly going to move into his talk.  This talk is called Ozzie, Keeping Track and Reporting of All Things.  And over to you.  Thank you.  Thanks, everybody.  We're going to have a good time.  When I first submitted this talk to the Recon Village, I was thinking,  hey, this could actually be kind of a workshop.  And then I thought, well, maybe I'll do a little bit more of just a presentation.  So this is actually one of those neat mash-up talks.  You're welcome to play along as I do certain things here.  All this stuff, first off, my slides are on the internet already.  I'll give you a link at the end, so you don't have to do the Take In The Pictures thing.  You'll get the actual slides.  And also, there's a lot of things that I'll be releasing during the talk.  So you can, again, you can grab that off the interwebs.  So I am Michael Hoffman.  I go by Web Reacher on the interwebs.  I have a nice website, webreacher.com, where I blog about a lot of these open source intelligence  things that I find helpful, fun, entertaining, as well as web application stuff.  I do pen testing, run a maker space, open source projects, Teach for Sands,  Rota, Chlorosun, open source intelligence for Sands.  That's a lot.  But let's not talk about me.  I have a question for you all.  This is actually a question where you're going to need to raise your hand.  Yes, exercise involved.  Here we go.  Ready?  Raise your hand if you love to document.  Wow, you guys are weird.  I wrote this slide, I'm like, it's going to be crickets, but no.  How many of you really believe?  So yeah, I absolutely don't like documenting, but I recognize that it's a necessity in penetration  testing as well as defense work, as well as open source intelligence.  We have to do it because if we don't, things go awry.  Now when I was younger, what I found about open source intelligence is I love to do the  data acquisition.  I love finding shit about people or things or IPs.  I love analyzing the data and putting it together and finding those connections and finding how  things actually appeared, whether it was using like Maltigo or something else and finding  those relationships.  That was awesome.  And then which of those things do I need to dive deeper in?  Where do I need to pivot and go deep?  I love doing all that.  And then of course my senior OSINT person or senior pentast would be like, yeah, Micah,  you know that the reports do tomorrow.  I'm like, just a little bit more, dad, or whatever his name was.  Just a little bit more.  I've almost got more things I can find.  And I always squeeze that little open source, the documentation to the end.  Nowadays, adulting Micah, I still like doing the same things.  But what I'm finding is that I'm doing a lot more analysis.  And the reason why I'm doing more analysis is I have more data, more good data that I  can go through.  That data that you collect along the way is going to help determine where your OSINT  investigation takes you or doesn't take you.  And that's very important.  Because I've written a lot of open source intelligence reports.  I've written a lot of pentast reports.  I can't tell you the number of times.  I've gotten to the pentast report and like, yeah, we popped that box and I got SQL injection  and I stole a copy of the database.  Who has the database?  I know I popped it and they're like, yeah, you had it.  Remember, you put it into our chat.  Oh, and the chat now in Slack, that part of the conversation is gone so you can't actually  grab it.  And I don't have that stuff.  That would be awesome sauce to my customer.  Don't let that happen to you.  One of the things that I like talking about is documenting deeply as you go.  When I do web pentests, I document, if I'm doing SQL injection, boom, I'm tagging it,  I'm looking at it, I'm recording it as I go.  When I do something in open source intelligence, I have to record it as I go because that data  might change in a minute.  I never see somebody tweet something out and it's gone.  You're like, oh, that was cool.  And you click on it, it's like tweet is unavailable.  Yeah, stuff disappears.  And if you're doing a multi-day, multi-week assessment, that stuff is not going to be  there potentially when you get back to it.  So document deeply.  And what I found is that when you actually do document deeply, your reports get better  because you have more data.  You don't have to start scrounging going, well, I don't really have this data.  The screenshot of that, but if you imagine a website with a picture of the person on  it, that's what, no, you have the pictures as they showed up.  And that's really the impactful part of it.  When we do open source intelligence, one of the things that we have to do is convey to  our customers what we see and what it means.  And what it means is so very important for the impact.  Over the years of teaching for SANS and teaching internally for my companies, I've found that  people are still using some older technologies to document.  We do capture the flags in the SANS classes if you've ever taken one.  Usually on the last day, we do a capture the flag.  And I see people pulling up these solid but old, tiny types of applications to record  their process.  And every time I see that, I'm like, ugh, we can do better.  And that's really what this course is about.  Of course.  That's really what this talk is about.  Because if you're using these to capture your notes during an assessment, I'm guessing  it's suboptimal.  And I'll show you how in just a little bit.  But before we get to the tools, which I know everybody's like, all right, show me more  tools, you know, release something.  Before we get to that, let's talk about why you document.  Because that's equally as important as what you document.  Because what you are collecting while you're actually doing the assessment, while you're  doing the scanning, while you're doing the analysis is extremely important.  And we've got a lot of different data types.  We have a lot of different pieces of data also that we need to collect to keep that  timeline of evidence.  If you're doing something for law enforcement or for forensics, you've got to keep dates  and times.  You've got to keep where you've got something.  Sometimes you've got to keep how you got there, too.  I've seen pentas reports and OSINT reports where it's like, hey, I found that picture  of the person that was doing some kind of insurance fraud.  And they are playing basketball in their driving.  And my customer was like, that is terrific.  How did you get it?  Where did you get it?  What date was that?  And if you don't have that data, you're ultimately failing your customer.  Now when we actually do collect stuff, we have to think about it.  We may have a tendency to collect all the things, and that's great.  Before we actually do an assessment, we have to think about what are the types of data?  Where might things go awry?  And what are my special considerations?  For instance, if you're doing some gathering of information, maybe on some dating sites  or on some other more sensitive types of sites, maybe you find some classified data or proprietary  data, maybe you find some data that is against the law to have on a computer or to be sharing.  How do you record that safely enough so you can include it in your report but not violate  any laws yourself by propagating that type of stuff?  And there are rules for this.  You have to think about it before you just collect.  Some of the other things that I found is that when you are collecting information about  people, sometimes people share an address, right?  Share a phone number.  Okay.  If you're doing that text pad, notepad plus type of documentation, which is serial, right?  It's like, I got this person.  I got that.  Well, then if you are putting that phone number on multiple people, now you have duplicate  data in your report, right?  It's that phone number here and that phone number up here too, which is a little suboptimal  instead of relating a single piece of information.  Another thing is some people are going to do an assessment in hours or minutes, and  that's going to be really quick.  Some people will do campaigns and look at their targets over months.  Those are going to have different constraints for how, where, and what you're storing that  content on.  And your documentation system and platform has to account for that.  And another thing is some of you probably work in teams or maybe you share your data  with the defenders or maybe you're working cyber threat intelligence, your CTI people,  and you're actually going to be writing this up to give to somebody else.  Well, when you actually collecting data in teams, it's a whole nother type of mess, right?  If you've done this solo, you know, you can rely on yourself.  You're like, oh yeah, I'm doing this great.  But when you're combining that data or getting somebody else access to it, it can be challenging.  You got to work that out first.  You got to work that out before you dive into the assessment, especially if your team is  around the world.  I work with teams that are geographically dispersed across the United States and hey,  that time zone change, it matters.  Because when I record something on my system and say, hey, I found this at this date and  time, well, is that UTC or is that East Coast time?  It makes a difference if you're going to court.  It makes a difference in some cases.  You have to think about these things.  The other thing is where are you going to store your stuff, right?  Cloud systems, there are some amazing cloud applications that are out there that make  storing information so, so simple.  And yet they can be a security risk, right?  You're sharing your stuff with Google.  Now Google would never read your documents that you store in their servers, right?  You're using HTTPS.  It's encrypted, right?  Yeah.  You have to think about this.  You have to consider it.  And then also is your application that you're using made for multiple people to use it or  just one?  Also, we have to think about are we documenting this for our notes so I can remember my process  so I can create a report or are we documenting to hand off to somebody else so that they  continue it?  When I do some of my assessments, I do up until a certain point and I'm like, hey, I'm  done.  You keep going, defenders.  You go ahead and research the rest of those IPs or do it.  And I'm doing that hand off.  Well, there's a different level of documentation that you need there.  I recently, we were doing some work in a one note document if you know about that Microsoft  product.  Good tool, multi-user.  It works within an enterprise.  It's really good or sharing outside of an enterprise.  And I was writing this, my notes for myself, you know, because the notebook wasn't shared  out.  Well, somebody else is like, hey, do you have notes on them?  Like, do I have notes on them?  Here, let me just add you to this.  And he looked at my notes and he was like, well, what the heck does this mean?  This is bad person.  And what does this mean?  Because I was documenting it for me.  So we have to think about who our audience is and could be.  Because that and could be is that when you deliver your report or your notes, you never  know where they're going to go.  I've been in organizations where I deliver my notes to a customer and that customer  takes that report and then six months later I come back to somebody totally else in that  organization.  And that other person has said, hey, do you know who Mike is?  Quality of work.  Do you have anything?  And this person's like, yeah, take this really sensitive document and gives it to somebody  else in their organization that has no need to know that information.  So my report, when I walk into that person's office, is sitting right there on their desk.  I'm like, well, I'm glad I didn't include sensitive stuff in there.  But we have to think about that.  We also have to think about how we're going to document.  I always like to document more than I need.  Because I can always scale it back.  I can summarize, I can redact or whatever it is that I need in order to do my output,  whether it's a presentation, whether it's to do something like a report, you can always  summarize and redact.  But if you don't have that data, it's hard to get it back.  I've had people that do an assessment and they're like, oh, it was there.  And they take a picture of the thing that says tweet unavailable and put that in the  report.  It's like, that's not the way to do it.  And then your end goal.  Where is this document going?  Where are your notes going?  Are you going to be continuing to work on this project?  Are you going to hand it off to somebody, report it, et cetera?  Thinking about that is going to help you in understanding what to do with the data.  Also, you don't know where the data is going to take you.  I'm sure if I ask for a raise of hands, which I'm not going to, and ask you if you ever  had a simple project that you were working on, maybe a NoCin project, and you were just  doing Facebook stuff and then the assessment maybe took a left turn or something, or maybe  you're looking at some dating profiles or something like that, and something weird popped  up.  I've done assessments where I'm just doing kind of a little background on a CEO or somebody  that's a C-suite person.  And then I find that there's a Tinder name with that same person that that person has  been using for their Gmail.  It's like, huh, that's weird.  And you look over there and it's a whole nother like lifestyle that this person is leading.  You never know where your work is going to be taking you.  Now, within open source intelligence, there's a lot of different versions of this diagram  of this cycle.  Essentially, we have requirements gathering in the upper right, then that leads to retrieving  data of some type, analyzing data, and pivoting and reporting.  And what I like to do is tag what types of things I'm looking for, what is my documentation,  what does my reporting look like at each of these different phases.  Retirement gathering is, I'm going to be asking the questions of what am I doing, getting  those requirements from my customers so that when I start gathering the data, I know what  the hell I'm looking for.  What are we finding?  That's where you're collecting the data.  Of course, if we also have the what is, what are we missing parts in the analysis section,  and then when it gets to reporting of whatever kind, we're going to go ahead and make that.  Now, this might hit a little bit close to home for some of you, but stick with me here.  Let's say that we have an example.  Let's say we have a scenario.  Maybe your son or daughter's teacher comes to you and says, listen, I know you do that  cyber stuff, and I'm wondering if you could help me find something.  There is this dude that has been cyber bullying a bunch of kids in the class.  And it goes by the name Dread Pirate Robert.  It's written like it is on the slide there.  Most of the kids that are playing on PlayStations are actually getting hit by this, so I need  you to go ahead and take a look at this.  You're like, cool, all right, start me off with the username.  I got that.  So you start your documentation.  Does anybody see anything wrong right off the bat?  Yeah, we're in Notepad.  So Notepad, what happens on Notepad when you close Notepad?  Does it save it?  It asks you if you want to save it, but then if you don't say yes, it's gone.  What happens if your computer crashes?  It's gone.  So let's say that you went ahead and did this.  All right, here we're going to do Dread Pirate Robert.  The goal is this.  Fine.  So you go into DuckDuckGo and you do a search.  Now the search here pulls up a Twitter account with Dread Pirate Roberts, that actual username.  We've actually got a bunch of information here that we can pull from.  We've got a Twitter account at number one.  We've got an avatar.  We can do some reverse image searching on.  We've got an actual spelled out name, Dread Pirate Roberts.  That's that number three.  And actually a location.  Number four is County Claire.  Cool.  So we go back to our Notepad document.  We type it in.  DuckDuckGo reports Dread Pirate Roberts, found on Twitter.  Here's a URL.  There is a screenshot of the avatar and maybe you save it as TWAvatar1.  So now you have a separate file on your system.  All right, cool.  All right.  So you look for some of the other things that are on that DuckDuckGo search.  Oh, we've got Clash Royale.  Ooh, now we're getting into the gaming stuff.  That was kind of the primary thing that we were looking for.  There is a username Dread Pirate Roberts.  Cool.  So we've got that.  We're going to document that.  And of course, now we've got the Twitter plus we've got this Clash Royale thing.  So we've got to look up both of those profiles.  So we're just going to put it to do on the page.  Cool.  All right.  Let's go back to that Twitter thing.  And so here on the Twitter page, we've got even more information coming across.  Because again, we've got that avatar.  We've got some tweets we need to look into.  We've got some geo-located tweets.  Maybe we can get some information about where that person is or has been.  And of course, we're going to go back to Notepad.  We've got to document this stuff, right?  We've got some more to do.  We've got to do the reverse image search.  We've got to do this and that.  And then you do the reverse image search.  And now you've got 213 sites to look at.  And maybe you do reconNG.  There's this cool profiler module some dude wrote that goes through and takes a username  and goes and looks at it across over 150 websites.  Well, you've got that.  And so now this is a blow up of one of those.  Now you've got four other sites, including Adult Friend Finder that you need to go look  at.  You've got an Xbox.  Well, you have to go look at it.  You never know where your assessment's going to take you, right?  Sorry.  Yeah, you've got Xbox gaming and stuff.  All right.  So we've got some URLs to go to.  And in 10 minutes, we've got a hell of a lot of to-do items.  We've got images.  We've got user names.  We've got URLs.  We've got a lot of stuff that we have to collect.  Plus we have that reconNG tool output, which we somehow have to include in our documentation.  And like I said, this was within 10 minutes.  If you're doing this type of an assessment in hours, can you imagine how many of those  branches you're going to have to actually deal with?  How many to-dos you're going to have?  If we're going to do that, we need to have a documenting system that allows us to say,  I need to go do that.  And when I do, I can collapse it or I can mark that branch as checked off.  We also have to have a documentation platform that allows us to collect, note, annotate  different types of data, whether it's the pictures that we're coming across on our site  or pictures of the websites or the data.  And man, wouldn't it be nice if while we're just doing the work of OSINT, something's  collecting all of that stuff for us.  And some of you already know that Hunchly does that really, really well.  If you don't know about Hunchly, stay tuned.  Now when I made this talk, I thought about, well, there is a huge number of documentation  products.  And many of you that do like OSINT, CTI, or even pen testing, you might have special systems  or enterprise-wide systems that you have access to.  I wanted to keep this talk geared towards that solo practitioner, that person that's  doing that OSINT or that pen testing, a recon or whatever it is, alone or in small groups  of teams.  So that's really my sweet spot here.  And that's who I'm talking about.  Now, one of the things that we have to think about is the type of data that we're going  to be documenting.  I was here today for some of the other talks and earlier yesterday for a couple of talks  and I saw some great information on Maltigo.  If you saw Andrew present on Maltigo and how it puts together data, we've got some data  visualizer apps out there that are amazing for showing us connections between IPs, domain  names, user accounts.  I had an assignment one time where I had to do, I had to see if I could find information  about a certain target.  And so I went to her husband on Facebook and I found through his network a whole bunch  of people with their same last names and then through all of that right into Maltigo.  And what Maltigo did was I said, show this data.  It showed me really good, tight packs of people that were interconnected, connected  to another group of people that were connected very tightly.  And it allowed me to see this is a family group and that's a family group and it's connected  via these people.  So we have visualizers.  Maltigo, Gaffee, cytoscope, sorry.  We also have word processing apps, Word, LibreOffice, these types of things as well.  And they're good for general documentation.  But we also have apps that are made to make our jobs as O-Centers a lot easier.  Let's talk about that.  Now I wanted to focus on one flexible apps that are going to make sense to most of you.  It's not going to work for all of you.  Some of you are mandated to do one type of thing or another.  I also, there are a lot of apps out there so I don't want to actually say, hey, go  ahead and use this and it just does one piece of the puzzle.  I'm looking for this biggest thing for my buck because I don't want to focus on documentation.  I want to focus on doing the O-Cent and to have something document for me.  Also easy to use, always a requirement for me and ultimately decreases the work I have  to do.  Now if you've looked at my blog, webreader.com, you know I'm a very big fan of MindMaps.  MindMaps are amazing visual note taking, free applications that are out there that allow  you to organize data graphically.  So you have one piece of data like a username like DreadPirateRoberts.  That DreadPirateRoberts then breaks out into a Twitter account and a gaming account and  an adult friend finder and stuff.  You have nodes that then branch out.  When you're done working on those nodes, you can collapse it and say, this node is done.  I'm done checking out adult friend finder and now I need to go and look at other stuff.  That's really helpful for keeping track of where you are in your assessment and what  you have left to do.  If you're interested in it again, this slide deck is online so you don't have to take pictures  but on github.com.  I have a mind map that you can have for free that's going to hopefully jump in.  Jump start your documentation.  Now I created this mind map over a year ago and when I was teaching my Sec 487 Sands class,  I found that one of my students was doing a lot of note taking during class.  I was like, what are you doing?  He's like, well, I took all of the things that you said to do in class and I put it  into that mind map.  That's awesome.  So when you get this file, it has a lot of the notes, a lot of the sites, a lot of the  other things that are in some OSINT classes like mine.  Now we've written it in the XMind application.  XMind is a mind map software application and it's free for Windows, Mac, Linux.  Again, easy to use on whatever platform you're using.  And what it has is it has the centralized process.  It has about five different tabs or sheets if you will.  And each one's meant for different things.  For instance, one of them is meant to discuss things about process.  Like, hey, I have email address.  What do I do with it?  If you were here for my yoga talk yesterday, yeah, it's kind of the same thing, but in  an easy to use mind map format.  So here we have an email address.  If you look there, well, you do email verification.  You might look for that email on breach sites like we saw it will do earlier with have I  been phoned.  It shows you that process of what you can do.  We also have a tab in there on data collection that says, hey, if you're doing research on  a person, you might want to grab their name and address and phone number and date of birth  and aliases.  You actually type that into this document and it'll organize it for you.  We can also do the same thing for IP addresses, hashtags, sentiment analysis, whatever it  is you're doing, you can put it in here.  And when you take that content that we had earlier, you remember our document, that notepadding,  you start to fill it in into a mind map.  The data comes to life and you can see how things are put together.  I love it because instead of duplicating the information like, hey, that Dread Pirate Robert's  name is here and here and here, I can just use those double dash arrows to say, oh, that  username was found on Twitter.  And then I can paste in there the username, the picture of what the site looks like on  his profile page and put other data points in there.  And when I'm done with investigating the Twitter, I can click on these things, collapse the  entire branch.  You could store other types of data, other types of files just by putting it in there.  Other things that we have to do, document the URLs, document the dates and times.  Mind maps are manual.  So you have to copy that URL and paste in there.  It's not perfect.  However, organizing the data this way can save you a lot of time, a lot of effort and  it can be quite appealing to your customers.  Now it's not all fun and games.  It's not all great.  I will tell you this, that to be honest, there are some drawbacks with mind maps.  First off, getting the data out is sometimes a pain in the ass because think about this.  For a simple investigation like the Dread Pirate Roberts thing I was telling you earlier, we've  got now 213 sites we have to visit.  Yeah, we might use a tool like Eyewitness by Chris Truncher or Peeping Tom by Tim Tomes  or something like that to scan all those sites.  Cool, and we can shove that in there.  But what happens is this mind map keeps branching out and branching out and branching out.  And when we're using it on the computer, we're just dragging over to this area or dragging  to that area.  Well, when it comes time to report, how do you take something this big and fit it down  to A4 size or 8.5 by 11 size?  Sometimes very challenging.  So sometimes we'll cut it up or do other stuff with it.  And with the pro version of Xmind, there's some better methods of exporting the content.  Sometimes you can do it to a PDF.  Multi-user, not so much.  So if you're a solar practitioner or you're handing documents off, a mind map might be  something that you could use.  And then everything is manual, which is something I don't like.  So what I do is I'll use a mind map for the overall investigation.  Where am I going?  What do I need to do?  And I'll also use Hunchly for that automated easy button approach to Maya's investigation.  And Hunchly is amazing.  Written by Justin Scythes and his team.  It is a great tool.  It's a Google Chrome extension.  And it makes our lives so easy.  Because it does a bunch of things.  Everything from going ahead and cataloging and keeping track of any files we download  while we're browsing to recording screen captures of every web page you visit.  So when you're Googling or duck duck going, or when you're tin-eyeing something, or when  you're doing whatever on Adult Friend Finder or whatever, that keeps it sticking in my  head for some reason.  I'm sorry.  When you're going to the PS4 gaming thing site, those pictures are going to be captured  automatically along with the date and time that you visited them and the URL.  So you don't have to do it manually anymore.  You see how this is like, I'm hearing angels singing right now.  Now this costs about $130 Canadian per year if you're in the United States.  It's like $3 US or something like that.  So if you've never used Hunchly, this is Hunchly 2.  A lot of people might be using Hunchly version 1.  Justin has team upgraded to version 2.  And it's significantly awesomer, which is a word.  Here what we have is a dashboard.  When you launch Hunchly, you can bring up the dashboard, which does overall case management  and summary.  It tells you what case you're currently in, how many pages you visited, how many files,  photos, tagged, et cetera.  And then one of the neat things about Hunchly is that sometimes you have these things, that  words you need to look for in pages.  If I'm looking for Dread Pirate Roberts, any page I visit, I want Dread Pirate Roberts  to pop out at me.  So I can set it up as a selector.  And then I tell Hunchly, hey, wherever you see this on a page, I want you to highlight  it in yellow.  So when I'm doing my duck duck going or when I do a forums thing and I'm looking at some  forum, a gaming forum, and there's Dread Pirate Roberts, it pops right down on the page for  me.  Makes it easy for me to do my O-sense.  Also it keeps track of, and I know this is a little bit small and all.  The slides are out there on the internet.  But this keeps track automatically of all the websites you visit in Google Chrome.  So if you're doing, if you have this great stream of consciousness, like, oh, this duck  duck search showed me this, and now I'm going to take this here and go there and go there,  it's going to keep track of all that for you and the date and time you did it.  It's amazing.  And one of the neat things is that if you're visiting social media sites that allow the  metadata that's inside of some pictures, you know, the geolocation or what camera took  that picture, if that data is still with the pictures, Hunchly will pull it out and highlight  it for you, automatically for you.  Whoa, that's awesome.  Now one of the problems we have is that sometimes we still need to run like, it wills, it wills,  I'm sorry, it wills tool.  You might need to run some other tool like reconNG or spiderfoot or something like that.  And you have that output.  What I like doing is doing some side channel loading of that data into Hunchly.  Because I use Hunchly as like my repository of all my data.  That way when I'm done with my work, I take all of that Hunchly data and I export it and  that's what I save.  So what you can do is take that reconNG data, remember that profiler module I ran earlier,  we can export that to a CSV or a text file and then visit it in a web page.  Take a look at this.  So I have exported it to reconNGresults.txt, it's a CSV and then I open that document  in my Chrome.  And now Hunchly has tagged at that date at that time that it has that content and it  will highlight all of the Dread Pirate Roberts names in there.  And that way when I'm looking through my data, when I'm searching through my Hunchly, I'm  like, well hey, where else do I need to go?  Where else was this found?  I can pull that data up.  And it's all in one place.  I mentioned to you the XIF data.  Yep, if you're visiting web pages that have images, it'll pull it out such as this beach  shot that has actually the GPS latitude and longitude in there.  Again, we need to go to another site to take a look at it to see where that is.  Does it corroborate with the data?  But it's one less step that you have to take.  You don't have to run the XIF tool or visit a secondary or tertiary site to pull that  out.  Now again, I like to present the positives and the negatives.  Hunchly's got a couple of drawbacks in my opinion.  One, it's only Google Chrome.  I like doing stuff in Firefox.  A lot of my best plug-ins and stuff are in Firefox.  I just like doing that.  This is only Hunchly.  Also, it's single user.  If I have two people that are doing the assessment, each of them is going to have their own Hunchly  data.  Right now, I don't know a way to easily combine that data, or even if I'd want to.  But combining that data and creating a centralized report will be a little bit more challenging  because you'll have to combine that data.  The reporting, it does have a, hey, dump all of the web pages I visited.  Dump all of the pictures that I tagged.  It has that, but it's not like Microsoft Word or it's not something of that caliber.  Again, this is something that we can use to do that automated documentation.  And then we put it together.  I know that.  It's like, that's the one picture you chose when I get, yes, it was free.  So if you know why you're documenting and where you're going to be putting that stuff, and  who you're documenting with on your team, and who you're documenting for, then what  you need to do along with your team is find those tools that work for you and work for  your customers and do things the way you want to.  I have actually mandated on my team that they use MindMap to do their assessments.  And I had one person, and it just didn't work the way that his brain works.  That's fine.  That's absolutely fine.  I realize that MindMap's work for people that learn visually, it's just beautiful.  But if you're not a visual learner, that's not going to work.  Whatever, make sure that you understand what the requirements are that you need to keep  track of, and some people are not going to necessarily be able to use these tools.  But you can check out these tools, and there's other ones out there too.  Many of them have free trials, and they'll take it and try it out and see what you're  doing.  Because if you find yourself or a colleague doing this, instead of doing something like  this, then they have a little bit of learning left to do.  And with that, I will put my contact information, and again, my presentations are right up there  on the Yoastin Ninja Prezos, Prezos, and that includes yesterday's presentation and  some other ones I've done as well.  You're welcome to take them.  And the link to my SANS course as well.  So I don't know if I have other, I think I might have a second.  Do you have any questions for me?  Yes, sir?  So there are some distributions like Buscador or Buscador, and other things that are specifically  made for open source intelligence gathering and an analysis.  Do I have any recommendations?  My recommendation is going to be a cop out, because I'm going to say, do what works for  you.  I was having a conversation with a gentleman next door, and he mentioned something similar.  I love Buscador, Buscador.  I think it's a great tool for what it is.  It simplifies a lot of those command line tools.  I understand.  You know, I come up as a hacker in this community, and I know that command line tools are not  hard for me.  Python, Ruby, Go, I get it.  But for a lot of people, they focus more on law enforcement, and they focus more on the  open source intelligence or the CTI aspects.  And that stuff's hard.  And where Buscador excels, in my opinion, is it abstracts that whole, you need to run  this command on the command line, and they give you a graphical just box.  Type in the username, and it does all that stuff behind the scenes.  So that is a great distribution, and it's 100% free.  It's on inteltechniques.com's website, Michael Bazelle's website.  But some of the things that you could also do is create your own virtual machine, depending  again on what your threat, what your work is asking you to do as far as who you're working  on.  Obviously, the more sensitive to data, the more nefarious the things that your place  is going to be going, you're going to want more of a barrier between your host computer  and the other network.  Other questions?  Sir?  Okay, so the question is, are there any laws that would prevent a company from doing this  type of reporting on their employees?  And the answer is, I am not a lawyer.  Next question.  No.  The answer is yes.  There are laws that companies need to be aware of.  There's HR stuff.  Mostly what I find is that many companies have privacy policies for their employees,  or some kind of policy that governs what type of information they will collect about their  employees and about their employees' social and how the social activities and how they  will use it.  And that is usually what you see guiding this, except if you're in the EU, in which case  you now have GDPR laws and stuff like that.  So I hope that's helpful.  Yes, ma'am?  Just answer the question.  You answered the question in your head.  Well done.  Are there any other questions?  Yes, ma'am?  So in some of your examples, you know other things like similar or targeted, and you have  in-field that you know more, but with the mind map, it works well for multiple parties?  So the question is, is that in my assessment here, the example, I used the Dread Pirate  Roberts user, a single person, and then branched out.  Is the mind map format good for multiple targets?  Let's say you're investigating a gang or something like that, a group of people.  The answer is yes.  I like it for documenting that stuff.  I don't like it for visualizing that.  What I would do is I would document all the relationships in here, note-taking-wise, and  then probably make something pretty in Maltigo.  There's a free version called Case File, which will take a CSV and import it, and it will  make a beautiful diagram of this picture.  So for a report and for that finalized version, I'd probably use a real visualization tool  instead of this.  Okay.  All right.  Well, I'm going to go ahead and say thank you very much for your time.  If you have any questions, hit me up or come talk to me.  Thank you for your time, everybody.  Thank you.
DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_0_1487.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_1488_2183.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_2184_2231.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_2232_2279.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_2280_2375.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_2376_3155.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_3156_4331.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_4332_5075.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_5076_5999.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_6000_6971.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_6972_8327.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_8328_9059.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_9060_9275.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_9276_10679.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_10680_13235.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_13236_14699.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_14700_15623.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_15624_18323.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_18324_19247.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_19248_19631.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_19632_20927.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_20928_22115.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_22116_22235.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_22236_23111.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_23112_23807.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_23808_24035.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_24036_24443.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_24444_24863.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_24864_25223.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_25224_25511.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_25512_25655.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_25656_25955.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_25956_26123.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_26124_26255.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_26256_26567.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_26568_27095.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_27096_27155.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_27156_27611.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_27612_28295.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_28296_29159.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_29160_29939.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_29940_32099.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_32100_32903.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_32904_34139.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_34140_35543.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_35544_36539.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_36540_37103.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37104_37199.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37200_37259.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37260_37331.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37332_37475.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37476_37607.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37608_37739.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_37740_38003.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_38004_38123.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_38124_38795.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_38796_40799.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_40800_42623.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_42624_43331.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_43332_44255.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_44256_45947.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_45948_46607.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_46608_47387.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_47388_48095.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_48096_49427.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_49428_49583.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_49584_49883.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_49884_51083.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_51084_51191.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_51192_51311.png DEF_CON_26_RECON_VILLAGE_-_WebBreacher_-_Core_OSINT_Keeping_Track_of_and_Reporting_A_51312_58102.png
Okay, if everyone's ready, we'll get into the next session. Don't worry, I will be disappearing from this microphone very, very soon, because I've got a pizza that's under that table that I need to eat. But I will just introduce Michael Hoffman. I introduced him yesterday into the wrong name, so if I've done it wrong again, he's just going to ignore that, and we're swiftly going to move into his talk. This talk is called Ozzie, Keeping Track and Reporting of All Things. And over to you. Thank you. Thanks, everybody. We're going to have a good time. When I first submitted this talk to the Recon Village, I was thinking, hey, this could actually be kind of a workshop. And then I thought, well, maybe I'll do a little bit more of just a presentation. So this is actually one of those neat mash-up talks. You're welcome to play along as I do certain things here. All this stuff, first off, my slides are on the internet already. I'll give you a link at the end, so you don't have to do the Take In The Pictures thing. You'll get the actual slides. And also, there's a lot of things that I'll be releasing during the talk. So you can, again, you can grab that off the interwebs. So I am Michael Hoffman. I go by Web Reacher on the interwebs. I have a nice website, webreacher.com, where I blog about a lot of these open source intelligence things that I find helpful, fun, entertaining, as well as web application stuff. I do pen testing, run a maker space, open source projects, Teach for Sands, Rota, Chlorosun, open source intelligence for Sands. That's a lot. But let's not talk about me. I have a question for you all. This is actually a question where you're going to need to raise your hand. Yes, exercise involved. Here we go. Ready? Raise your hand if you love to document. Wow, you guys are weird. I wrote this slide, I'm like, it's going to be crickets, but no. How many of you really believe? So yeah, I absolutely don't like documenting, but I recognize that it's a necessity in penetration testing as well as defense work, as well as open source intelligence. We have to do it because if we don't, things go awry. Now when I was younger, what I found about open source intelligence is I love to do the data acquisition. I love finding shit about people or things or IPs. I love analyzing the data and putting it together and finding those connections and finding how things actually appeared, whether it was using like Maltigo or something else and finding those relationships. That was awesome. And then which of those things do I need to dive deeper in? Where do I need to pivot and go deep? I love doing all that. And then of course my senior OSINT person or senior pentast would be like, yeah, Micah, you know that the reports do tomorrow. I'm like, just a little bit more, dad, or whatever his name was. Just a little bit more. I've almost got more things I can find. And I always squeeze that little open source, the documentation to the end. Nowadays, adulting Micah, I still like doing the same things. But what I'm finding is that I'm doing a lot more analysis. And the reason why I'm doing more analysis is I have more data, more good data that I can go through. That data that you collect along the way is going to help determine where your OSINT investigation takes you or doesn't take you. And that's very important. Because I've written a lot of open source intelligence reports. I've written a lot of pentast reports. I can't tell you the number of times. I've gotten to the pentast report and like, yeah, we popped that box and I got SQL injection and I stole a copy of the database. Who has the database? I know I popped it and they're like, yeah, you had it. Remember, you put it into our chat. Oh, and the chat now in Slack, that part of the conversation is gone so you can't actually grab it. And I don't have that stuff. That would be awesome sauce to my customer. Don't let that happen to you. One of the things that I like talking about is documenting deeply as you go. When I do web pentests, I document, if I'm doing SQL injection, boom, I'm tagging it, I'm looking at it, I'm recording it as I go. When I do something in open source intelligence, I have to record it as I go because that data might change in a minute. I never see somebody tweet something out and it's gone. You're like, oh, that was cool. And you click on it, it's like tweet is unavailable. Yeah, stuff disappears. And if you're doing a multi-day, multi-week assessment, that stuff is not going to be there potentially when you get back to it. So document deeply. And what I found is that when you actually do document deeply, your reports get better because you have more data. You don't have to start scrounging going, well, I don't really have this data. The screenshot of that, but if you imagine a website with a picture of the person on it, that's what, no, you have the pictures as they showed up. And that's really the impactful part of it. When we do open source intelligence, one of the things that we have to do is convey to our customers what we see and what it means. And what it means is so very important for the impact. Over the years of teaching for SANS and teaching internally for my companies, I've found that people are still using some older technologies to document. We do capture the flags in the SANS classes if you've ever taken one. Usually on the last day, we do a capture the flag. And I see people pulling up these solid but old, tiny types of applications to record their process. And every time I see that, I'm like, ugh, we can do better. And that's really what this course is about. Of course. That's really what this talk is about. Because if you're using these to capture your notes during an assessment, I'm guessing it's suboptimal. And I'll show you how in just a little bit. But before we get to the tools, which I know everybody's like, all right, show me more tools, you know, release something. Before we get to that, let's talk about why you document. Because that's equally as important as what you document. Because what you are collecting while you're actually doing the assessment, while you're doing the scanning, while you're doing the analysis is extremely important. And we've got a lot of different data types. We have a lot of different pieces of data also that we need to collect to keep that timeline of evidence. If you're doing something for law enforcement or for forensics, you've got to keep dates and times. You've got to keep where you've got something. Sometimes you've got to keep how you got there, too. I've seen pentas reports and OSINT reports where it's like, hey, I found that picture of the person that was doing some kind of insurance fraud. And they are playing basketball in their driving. And my customer was like, that is terrific. How did you get it? Where did you get it? What date was that? And if you don't have that data, you're ultimately failing your customer. Now when we actually do collect stuff, we have to think about it. We may have a tendency to collect all the things, and that's great. Before we actually do an assessment, we have to think about what are the types of data? Where might things go awry? And what are my special considerations? For instance, if you're doing some gathering of information, maybe on some dating sites or on some other more sensitive types of sites, maybe you find some classified data or proprietary data, maybe you find some data that is against the law to have on a computer or to be sharing. How do you record that safely enough so you can include it in your report but not violate any laws yourself by propagating that type of stuff? And there are rules for this. You have to think about it before you just collect. Some of the other things that I found is that when you are collecting information about people, sometimes people share an address, right? Share a phone number. Okay. If you're doing that text pad, notepad plus type of documentation, which is serial, right? It's like, I got this person. I got that. Well, then if you are putting that phone number on multiple people, now you have duplicate data in your report, right? It's that phone number here and that phone number up here too, which is a little suboptimal instead of relating a single piece of information. Another thing is some people are going to do an assessment in hours or minutes, and that's going to be really quick. Some people will do campaigns and look at their targets over months. Those are going to have different constraints for how, where, and what you're storing that content on. And your documentation system and platform has to account for that. And another thing is some of you probably work in teams or maybe you share your data with the defenders or maybe you're working cyber threat intelligence, your CTI people, and you're actually going to be writing this up to give to somebody else. Well, when you actually collecting data in teams, it's a whole nother type of mess, right? If you've done this solo, you know, you can rely on yourself. You're like, oh yeah, I'm doing this great. But when you're combining that data or getting somebody else access to it, it can be challenging. You got to work that out first. You got to work that out before you dive into the assessment, especially if your team is around the world. I work with teams that are geographically dispersed across the United States and hey, that time zone change, it matters. Because when I record something on my system and say, hey, I found this at this date and time, well, is that UTC or is that East Coast time? It makes a difference if you're going to court. It makes a difference in some cases. You have to think about these things. The other thing is where are you going to store your stuff, right? Cloud systems, there are some amazing cloud applications that are out there that make storing information so, so simple. And yet they can be a security risk, right? You're sharing your stuff with Google. Now Google would never read your documents that you store in their servers, right? You're using HTTPS. It's encrypted, right? Yeah. You have to think about this. You have to consider it. And then also is your application that you're using made for multiple people to use it or just one? Also, we have to think about are we documenting this for our notes so I can remember my process so I can create a report or are we documenting to hand off to somebody else so that they continue it? When I do some of my assessments, I do up until a certain point and I'm like, hey, I'm done. You keep going, defenders. You go ahead and research the rest of those IPs or do it. And I'm doing that hand off. Well, there's a different level of documentation that you need there. I recently, we were doing some work in a one note document if you know about that Microsoft product. Good tool, multi-user. It works within an enterprise. It's really good or sharing outside of an enterprise. And I was writing this, my notes for myself, you know, because the notebook wasn't shared out. Well, somebody else is like, hey, do you have notes on them? Like, do I have notes on them? Here, let me just add you to this. And he looked at my notes and he was like, well, what the heck does this mean? This is bad person. And what does this mean? Because I was documenting it for me. So we have to think about who our audience is and could be. Because that and could be is that when you deliver your report or your notes, you never know where they're going to go. I've been in organizations where I deliver my notes to a customer and that customer takes that report and then six months later I come back to somebody totally else in that organization. And that other person has said, hey, do you know who Mike is? Quality of work. Do you have anything? And this person's like, yeah, take this really sensitive document and gives it to somebody else in their organization that has no need to know that information. So my report, when I walk into that person's office, is sitting right there on their desk. I'm like, well, I'm glad I didn't include sensitive stuff in there. But we have to think about that. We also have to think about how we're going to document. I always like to document more than I need. Because I can always scale it back. I can summarize, I can redact or whatever it is that I need in order to do my output, whether it's a presentation, whether it's to do something like a report, you can always summarize and redact. But if you don't have that data, it's hard to get it back. I've had people that do an assessment and they're like, oh, it was there. And they take a picture of the thing that says tweet unavailable and put that in the report. It's like, that's not the way to do it. And then your end goal. Where is this document going? Where are your notes going? Are you going to be continuing to work on this project? Are you going to hand it off to somebody, report it, et cetera? Thinking about that is going to help you in understanding what to do with the data. Also, you don't know where the data is going to take you. I'm sure if I ask for a raise of hands, which I'm not going to, and ask you if you ever had a simple project that you were working on, maybe a NoCin project, and you were just doing Facebook stuff and then the assessment maybe took a left turn or something, or maybe you're looking at some dating profiles or something like that, and something weird popped up. I've done assessments where I'm just doing kind of a little background on a CEO or somebody that's a C-suite person. And then I find that there's a Tinder name with that same person that that person has been using for their Gmail. It's like, huh, that's weird. And you look over there and it's a whole nother like lifestyle that this person is leading. You never know where your work is going to be taking you. Now, within open source intelligence, there's a lot of different versions of this diagram of this cycle. Essentially, we have requirements gathering in the upper right, then that leads to retrieving data of some type, analyzing data, and pivoting and reporting. And what I like to do is tag what types of things I'm looking for, what is my documentation, what does my reporting look like at each of these different phases. Retirement gathering is, I'm going to be asking the questions of what am I doing, getting those requirements from my customers so that when I start gathering the data, I know what the hell I'm looking for. What are we finding? That's where you're collecting the data. Of course, if we also have the what is, what are we missing parts in the analysis section, and then when it gets to reporting of whatever kind, we're going to go ahead and make that. Now, this might hit a little bit close to home for some of you, but stick with me here. Let's say that we have an example. Let's say we have a scenario. Maybe your son or daughter's teacher comes to you and says, listen, I know you do that cyber stuff, and I'm wondering if you could help me find something. There is this dude that has been cyber bullying a bunch of kids in the class. And it goes by the name Dread Pirate Robert. It's written like it is on the slide there. Most of the kids that are playing on PlayStations are actually getting hit by this, so I need you to go ahead and take a look at this. You're like, cool, all right, start me off with the username. I got that. So you start your documentation. Does anybody see anything wrong right off the bat? Yeah, we're in Notepad. So Notepad, what happens on Notepad when you close Notepad? Does it save it? It asks you if you want to save it, but then if you don't say yes, it's gone. What happens if your computer crashes? It's gone. So let's say that you went ahead and did this. All right, here we're going to do Dread Pirate Robert. The goal is this. Fine. So you go into DuckDuckGo and you do a search. Now the search here pulls up a Twitter account with Dread Pirate Roberts, that actual username. We've actually got a bunch of information here that we can pull from. We've got a Twitter account at number one. We've got an avatar. We can do some reverse image searching on. We've got an actual spelled out name, Dread Pirate Roberts. That's that number three. And actually a location. Number four is County Claire. Cool. So we go back to our Notepad document. We type it in. DuckDuckGo reports Dread Pirate Roberts, found on Twitter. Here's a URL. There is a screenshot of the avatar and maybe you save it as TWAvatar1. So now you have a separate file on your system. All right, cool. All right. So you look for some of the other things that are on that DuckDuckGo search. Oh, we've got Clash Royale. Ooh, now we're getting into the gaming stuff. That was kind of the primary thing that we were looking for. There is a username Dread Pirate Roberts. Cool. So we've got that. We're going to document that. And of course, now we've got the Twitter plus we've got this Clash Royale thing. So we've got to look up both of those profiles. So we're just going to put it to do on the page. Cool. All right. Let's go back to that Twitter thing. And so here on the Twitter page, we've got even more information coming across. Because again, we've got that avatar. We've got some tweets we need to look into. We've got some geo-located tweets. Maybe we can get some information about where that person is or has been. And of course, we're going to go back to Notepad. We've got to document this stuff, right? We've got some more to do. We've got to do the reverse image search. We've got to do this and that. And then you do the reverse image search. And now you've got 213 sites to look at. And maybe you do reconNG. There's this cool profiler module some dude wrote that goes through and takes a username and goes and looks at it across over 150 websites. Well, you've got that. And so now this is a blow up of one of those. Now you've got four other sites, including Adult Friend Finder that you need to go look at. You've got an Xbox. Well, you have to go look at it. You never know where your assessment's going to take you, right? Sorry. Yeah, you've got Xbox gaming and stuff. All right. So we've got some URLs to go to. And in 10 minutes, we've got a hell of a lot of to-do items. We've got images. We've got user names. We've got URLs. We've got a lot of stuff that we have to collect. Plus we have that reconNG tool output, which we somehow have to include in our documentation. And like I said, this was within 10 minutes. If you're doing this type of an assessment in hours, can you imagine how many of those branches you're going to have to actually deal with? How many to-dos you're going to have? If we're going to do that, we need to have a documenting system that allows us to say, I need to go do that. And when I do, I can collapse it or I can mark that branch as checked off. We also have to have a documentation platform that allows us to collect, note, annotate different types of data, whether it's the pictures that we're coming across on our site or pictures of the websites or the data. And man, wouldn't it be nice if while we're just doing the work of OSINT, something's collecting all of that stuff for us. And some of you already know that Hunchly does that really, really well. If you don't know about Hunchly, stay tuned. Now when I made this talk, I thought about, well, there is a huge number of documentation products. And many of you that do like OSINT, CTI, or even pen testing, you might have special systems or enterprise-wide systems that you have access to. I wanted to keep this talk geared towards that solo practitioner, that person that's doing that OSINT or that pen testing, a recon or whatever it is, alone or in small groups of teams. So that's really my sweet spot here. And that's who I'm talking about. Now, one of the things that we have to think about is the type of data that we're going to be documenting. I was here today for some of the other talks and earlier yesterday for a couple of talks and I saw some great information on Maltigo. If you saw Andrew present on Maltigo and how it puts together data, we've got some data visualizer apps out there that are amazing for showing us connections between IPs, domain names, user accounts. I had an assignment one time where I had to do, I had to see if I could find information about a certain target. And so I went to her husband on Facebook and I found through his network a whole bunch of people with their same last names and then through all of that right into Maltigo. And what Maltigo did was I said, show this data. It showed me really good, tight packs of people that were interconnected, connected to another group of people that were connected very tightly. And it allowed me to see this is a family group and that's a family group and it's connected via these people. So we have visualizers. Maltigo, Gaffee, cytoscope, sorry. We also have word processing apps, Word, LibreOffice, these types of things as well. And they're good for general documentation. But we also have apps that are made to make our jobs as O-Centers a lot easier. Let's talk about that. Now I wanted to focus on one flexible apps that are going to make sense to most of you. It's not going to work for all of you. Some of you are mandated to do one type of thing or another. I also, there are a lot of apps out there so I don't want to actually say, hey, go ahead and use this and it just does one piece of the puzzle. I'm looking for this biggest thing for my buck because I don't want to focus on documentation. I want to focus on doing the O-Cent and to have something document for me. Also easy to use, always a requirement for me and ultimately decreases the work I have to do. Now if you've looked at my blog, webreader.com, you know I'm a very big fan of MindMaps. MindMaps are amazing visual note taking, free applications that are out there that allow you to organize data graphically. So you have one piece of data like a username like DreadPirateRoberts. That DreadPirateRoberts then breaks out into a Twitter account and a gaming account and an adult friend finder and stuff. You have nodes that then branch out. When you're done working on those nodes, you can collapse it and say, this node is done. I'm done checking out adult friend finder and now I need to go and look at other stuff. That's really helpful for keeping track of where you are in your assessment and what you have left to do. If you're interested in it again, this slide deck is online so you don't have to take pictures but on github.com. I have a mind map that you can have for free that's going to hopefully jump in. Jump start your documentation. Now I created this mind map over a year ago and when I was teaching my Sec 487 Sands class, I found that one of my students was doing a lot of note taking during class. I was like, what are you doing? He's like, well, I took all of the things that you said to do in class and I put it into that mind map. That's awesome. So when you get this file, it has a lot of the notes, a lot of the sites, a lot of the other things that are in some OSINT classes like mine. Now we've written it in the XMind application. XMind is a mind map software application and it's free for Windows, Mac, Linux. Again, easy to use on whatever platform you're using. And what it has is it has the centralized process. It has about five different tabs or sheets if you will. And each one's meant for different things. For instance, one of them is meant to discuss things about process. Like, hey, I have email address. What do I do with it? If you were here for my yoga talk yesterday, yeah, it's kind of the same thing, but in an easy to use mind map format. So here we have an email address. If you look there, well, you do email verification. You might look for that email on breach sites like we saw it will do earlier with have I been phoned. It shows you that process of what you can do. We also have a tab in there on data collection that says, hey, if you're doing research on a person, you might want to grab their name and address and phone number and date of birth and aliases. You actually type that into this document and it'll organize it for you. We can also do the same thing for IP addresses, hashtags, sentiment analysis, whatever it is you're doing, you can put it in here. And when you take that content that we had earlier, you remember our document, that notepadding, you start to fill it in into a mind map. The data comes to life and you can see how things are put together. I love it because instead of duplicating the information like, hey, that Dread Pirate Robert's name is here and here and here, I can just use those double dash arrows to say, oh, that username was found on Twitter. And then I can paste in there the username, the picture of what the site looks like on his profile page and put other data points in there. And when I'm done with investigating the Twitter, I can click on these things, collapse the entire branch. You could store other types of data, other types of files just by putting it in there. Other things that we have to do, document the URLs, document the dates and times. Mind maps are manual. So you have to copy that URL and paste in there. It's not perfect. However, organizing the data this way can save you a lot of time, a lot of effort and it can be quite appealing to your customers. Now it's not all fun and games. It's not all great. I will tell you this, that to be honest, there are some drawbacks with mind maps. First off, getting the data out is sometimes a pain in the ass because think about this. For a simple investigation like the Dread Pirate Roberts thing I was telling you earlier, we've got now 213 sites we have to visit. Yeah, we might use a tool like Eyewitness by Chris Truncher or Peeping Tom by Tim Tomes or something like that to scan all those sites. Cool, and we can shove that in there. But what happens is this mind map keeps branching out and branching out and branching out. And when we're using it on the computer, we're just dragging over to this area or dragging to that area. Well, when it comes time to report, how do you take something this big and fit it down to A4 size or 8.5 by 11 size? Sometimes very challenging. So sometimes we'll cut it up or do other stuff with it. And with the pro version of Xmind, there's some better methods of exporting the content. Sometimes you can do it to a PDF. Multi-user, not so much. So if you're a solar practitioner or you're handing documents off, a mind map might be something that you could use. And then everything is manual, which is something I don't like. So what I do is I'll use a mind map for the overall investigation. Where am I going? What do I need to do? And I'll also use Hunchly for that automated easy button approach to Maya's investigation. And Hunchly is amazing. Written by Justin Scythes and his team. It is a great tool. It's a Google Chrome extension. And it makes our lives so easy. Because it does a bunch of things. Everything from going ahead and cataloging and keeping track of any files we download while we're browsing to recording screen captures of every web page you visit. So when you're Googling or duck duck going, or when you're tin-eyeing something, or when you're doing whatever on Adult Friend Finder or whatever, that keeps it sticking in my head for some reason. I'm sorry. When you're going to the PS4 gaming thing site, those pictures are going to be captured automatically along with the date and time that you visited them and the URL. So you don't have to do it manually anymore. You see how this is like, I'm hearing angels singing right now. Now this costs about $130 Canadian per year if you're in the United States. It's like $3 US or something like that. So if you've never used Hunchly, this is Hunchly 2. A lot of people might be using Hunchly version 1. Justin has team upgraded to version 2. And it's significantly awesomer, which is a word. Here what we have is a dashboard. When you launch Hunchly, you can bring up the dashboard, which does overall case management and summary. It tells you what case you're currently in, how many pages you visited, how many files, photos, tagged, et cetera. And then one of the neat things about Hunchly is that sometimes you have these things, that words you need to look for in pages. If I'm looking for Dread Pirate Roberts, any page I visit, I want Dread Pirate Roberts to pop out at me. So I can set it up as a selector. And then I tell Hunchly, hey, wherever you see this on a page, I want you to highlight it in yellow. So when I'm doing my duck duck going or when I do a forums thing and I'm looking at some forum, a gaming forum, and there's Dread Pirate Roberts, it pops right down on the page for me. Makes it easy for me to do my O-sense. Also it keeps track of, and I know this is a little bit small and all. The slides are out there on the internet. But this keeps track automatically of all the websites you visit in Google Chrome. So if you're doing, if you have this great stream of consciousness, like, oh, this duck duck search showed me this, and now I'm going to take this here and go there and go there, it's going to keep track of all that for you and the date and time you did it. It's amazing. And one of the neat things is that if you're visiting social media sites that allow the metadata that's inside of some pictures, you know, the geolocation or what camera took that picture, if that data is still with the pictures, Hunchly will pull it out and highlight it for you, automatically for you. Whoa, that's awesome. Now one of the problems we have is that sometimes we still need to run like, it wills, it wills, I'm sorry, it wills tool. You might need to run some other tool like reconNG or spiderfoot or something like that. And you have that output. What I like doing is doing some side channel loading of that data into Hunchly. Because I use Hunchly as like my repository of all my data. That way when I'm done with my work, I take all of that Hunchly data and I export it and that's what I save. So what you can do is take that reconNG data, remember that profiler module I ran earlier, we can export that to a CSV or a text file and then visit it in a web page. Take a look at this. So I have exported it to reconNGresults.txt, it's a CSV and then I open that document in my Chrome. And now Hunchly has tagged at that date at that time that it has that content and it will highlight all of the Dread Pirate Roberts names in there. And that way when I'm looking through my data, when I'm searching through my Hunchly, I'm like, well hey, where else do I need to go? Where else was this found? I can pull that data up. And it's all in one place. I mentioned to you the XIF data. Yep, if you're visiting web pages that have images, it'll pull it out such as this beach shot that has actually the GPS latitude and longitude in there. Again, we need to go to another site to take a look at it to see where that is. Does it corroborate with the data? But it's one less step that you have to take. You don't have to run the XIF tool or visit a secondary or tertiary site to pull that out. Now again, I like to present the positives and the negatives. Hunchly's got a couple of drawbacks in my opinion. One, it's only Google Chrome. I like doing stuff in Firefox. A lot of my best plug-ins and stuff are in Firefox. I just like doing that. This is only Hunchly. Also, it's single user. If I have two people that are doing the assessment, each of them is going to have their own Hunchly data. Right now, I don't know a way to easily combine that data, or even if I'd want to. But combining that data and creating a centralized report will be a little bit more challenging because you'll have to combine that data. The reporting, it does have a, hey, dump all of the web pages I visited. Dump all of the pictures that I tagged. It has that, but it's not like Microsoft Word or it's not something of that caliber. Again, this is something that we can use to do that automated documentation. And then we put it together. I know that. It's like, that's the one picture you chose when I get, yes, it was free. So if you know why you're documenting and where you're going to be putting that stuff, and who you're documenting with on your team, and who you're documenting for, then what you need to do along with your team is find those tools that work for you and work for your customers and do things the way you want to. I have actually mandated on my team that they use MindMap to do their assessments. And I had one person, and it just didn't work the way that his brain works. That's fine. That's absolutely fine. I realize that MindMap's work for people that learn visually, it's just beautiful. But if you're not a visual learner, that's not going to work. Whatever, make sure that you understand what the requirements are that you need to keep track of, and some people are not going to necessarily be able to use these tools. But you can check out these tools, and there's other ones out there too. Many of them have free trials, and they'll take it and try it out and see what you're doing. Because if you find yourself or a colleague doing this, instead of doing something like this, then they have a little bit of learning left to do. And with that, I will put my contact information, and again, my presentations are right up there on the Yoastin Ninja Prezos, Prezos, and that includes yesterday's presentation and some other ones I've done as well. You're welcome to take them. And the link to my SANS course as well. So I don't know if I have other, I think I might have a second. Do you have any questions for me? Yes, sir? So there are some distributions like Buscador or Buscador, and other things that are specifically made for open source intelligence gathering and an analysis. Do I have any recommendations? My recommendation is going to be a cop out, because I'm going to say, do what works for you. I was having a conversation with a gentleman next door, and he mentioned something similar. I love Buscador, Buscador. I think it's a great tool for what it is. It simplifies a lot of those command line tools. I understand. You know, I come up as a hacker in this community, and I know that command line tools are not hard for me. Python, Ruby, Go, I get it. But for a lot of people, they focus more on law enforcement, and they focus more on the open source intelligence or the CTI aspects. And that stuff's hard. And where Buscador excels, in my opinion, is it abstracts that whole, you need to run this command on the command line, and they give you a graphical just box. Type in the username, and it does all that stuff behind the scenes. So that is a great distribution, and it's 100% free. It's on inteltechniques.com's website, Michael Bazelle's website. But some of the things that you could also do is create your own virtual machine, depending again on what your threat, what your work is asking you to do as far as who you're working on. Obviously, the more sensitive to data, the more nefarious the things that your place is going to be going, you're going to want more of a barrier between your host computer and the other network. Other questions? Sir? Okay, so the question is, are there any laws that would prevent a company from doing this type of reporting on their employees? And the answer is, I am not a lawyer. Next question. No. The answer is yes. There are laws that companies need to be aware of. There's HR stuff. Mostly what I find is that many companies have privacy policies for their employees, or some kind of policy that governs what type of information they will collect about their employees and about their employees' social and how the social activities and how they will use it. And that is usually what you see guiding this, except if you're in the EU, in which case you now have GDPR laws and stuff like that. So I hope that's helpful. Yes, ma'am? Just answer the question. You answered the question in your head. Well done. Are there any other questions? Yes, ma'am? So in some of your examples, you know other things like similar or targeted, and you have in-field that you know more, but with the mind map, it works well for multiple parties? So the question is, is that in my assessment here, the example, I used the Dread Pirate Roberts user, a single person, and then branched out. Is the mind map format good for multiple targets? Let's say you're investigating a gang or something like that, a group of people. The answer is yes. I like it for documenting that stuff. I don't like it for visualizing that. What I would do is I would document all the relationships in here, note-taking-wise, and then probably make something pretty in Maltigo. There's a free version called Case File, which will take a CSV and import it, and it will make a beautiful diagram of this picture. So for a report and for that finalized version, I'd probably use a real visualization tool instead of this. Okay. All right. Well, I'm going to go ahead and say thank you very much for your time. If you have any questions, hit me up or come talk to me. Thank you for your time, everybody. Thank you.
Maltigo or something else and finding those your OSINT investigation takes you or doesn't you have more data. You don't have to start a website with a picture of the person on it, tools, you know, release something. Before we get we have to think about it. We may have a tendency document and gives it to somebody else in their like a report, you can always summarize and Finder that you need to go look at. You've got an could find information about a certain target. those sites. Cool, and we can shove that in how do you take something this big and fit it Xmind, there's some better methods of exporting keeping track of any files we download while keep track of all that for you and the date and employees' social and how the social activities