The Art of the Dork Finding Candidates through OSINT ...

Education/Action/Protection

The Art of the Dork Finding Candidates through OSINT

Michele Fincher

Social'Engineer.com

I’m not looking for a job, but….

•  B.S. Human Factors Engineering, USAF Academy

•  M. S. Counseling, Auburn University •  Former USAF Academy Assistant Professor and

National Board Certified Counselor (NBCC) •  Computer Information Systems Security

Professional (CISSP) •  Social engineering penetration tester and Chief

Influencing Agent, Social-Engineer, Inc.

Social'Engineer.com

What is Social Engineering?

“….any act that influences a person to take an action that may or may not be in their best

interests…”

3  

Social'Engineer.com

Why is a pen tester speaking at SourceCon?

u Knowledge is power!

u OSINT (open source intelligence) is a key piece of social engineering pen testing

u You can use the same techniques to find your candidates (creep factor excluded)

4  

Social'Engineer.com

What is OSINT? u  Basically, it’s information

that anyone can find u  Methods include

u  Dumpster diving u  Elicitation u  Online searches

u  Sources can be u  Media u  Photos u  Professional journals,

research, etc.

Social'Engineer.com

What does this photo say about the owner?

Social'Engineer.com

What do I now know about this company?

Social'Engineer.com

The problem with getting information…

Social'Engineer.com

And, there are LOTS of OSINT sources…

u  But this is about using Google Dorks u  Why Google? (legal shizzle: I don’t work for

Google)

Social'Engineer.com

How to: Know your operators u  site – searches a specific domain u  intext/allintext – searches for one/

all terms on the web page u  intitle/allintitle – searches for one/

all terms on the page title u  inurl – searches for a term in the

URL u  filetype – finds a specific file type

(doc) u  numrange – searches in a number

range u  daterange – searches in a date

range u  loc – searches on a specific place

h%p://www.googleguide.com/advanced_operators_reference.ht

ml#=tle  

Social'Engineer.com

How to: Guidelines u  Format - Operator:keyword, no spaces u  Can string together several inquiries – the “AND”

is implicit u  Use “” for exact matches: “Star Wars” u  Use a “-” to exclude items: “Star Wars” –wikipedia

-youtube u  Use a “~” for synonyms (~bread) = rolls, buns,

etc. u  Google limits queries to 32 words u  Not case sensitive u  Use of any “allin” operators must come first

Social'Engineer.com

What kind of stuff can we find?

u  Creeper demo

Social'Engineer.com

What kind of stuff can we find?

u  Your perfect candidate

Social'Engineer.com

How to build your own dork

u  Outline ideal candidate u  Narrow search to

specific site u  Enter key words or

phrases u  Exclude terms as

necessary u  Experiment u  Google Alert it!

Contact Me:

[email protected] www.social-engineer.com

@SocEngineerInc