1 of 25

A Proven Methodology for Open-Source Intelligence Gathering and Social Engineering

SE-RI, June 16th 2018

Presented by Émilie St-Pierre and Robert Stewart

​

​

​

​

​

2 of 25

whoami - Émilie St-Pierre

  • Security Analyst for Rapid7
  • 5+ years in the infosec community
  • Soft spot for SE, OSINT, and Privacy
  • Twitter: @L4bF0x

3 of 25

whoami - Robert Stewart

  • Security Consultant for Rapid7
  • 7+ years in the infosec community
  • Soft spot for SE, OSINT, and Physical Security
  • Twitter: @RizzyRong

4 of 25

Overview

  • OSINT Methodology for ESE
  • Results: What Works? What Doesn’t Work?
  • Tips and Tricks
  • Free Phishing Templates!

5 of 25

Storytime!

Setting Clear Goals

6 of 25

Setting Goals

  • What are you looking to measure/test?
    • User behavior
    • Infiltration
    • Detection
  • What type of data are you or your client expecting?
  • Is this the first time, the nth time?
    • Will the engagement be reoccuring?
  • Will you be integrating an educational component?
  • Will multiple pretexts be used during an engagement?

7 of 25

OSINT Target Areas

  • Technology
  • People
  • Presence
  • Industry

Technology

People

Presence

Industry

8 of 25

Technology

Domain & Subdomain Enumeration

  • https://appsecco.com/books/subdomain-enumeration/cheatsheets/techniques_cheatsheet.html
  • https://github.com/ChrisTruncer/EyeWitness

​

Open services (passive search)

  • https://www.shodan.io/search?query=weyland+industries
  • https://censys.io/ipv4?q=weyland+industries

9 of 25

Technology

  • Repositories + Secrets
    • https://github.com/search?q=weyland+industries
    • https://github.com/michenriksen/gitrob

​

  • Searching through cloud storage : AWS, Azure, etc.
    • https://github.com/jordanpotti/AWSBucketDump
    • https://github.com/mwrlabs/Azurite

​

  • What AV/Security appliance are they running?
    • Job postings (if not in subdomains)

10 of 25

People

Employee Names, Emails and Titles:

  • connect.data.com
  • LinkedIn
  • https://github.com/initstring/linkedin2username
  • https://github.com/SimplySecurity/SimplyEmail

​

Customers:

  • Google-Fu: “i am a customer of Weyland Industries” ...

11 of 25

Industry

Compliance & Regulations:

  • https://law.justia.com/cfr/

​

Legal Cases

  • https://dockets.justia.com/
  • https://pcl.uscourts.gov/pcl/index.jsf ($)
  • https://www.accessdata.fda.gov/scripts/warningletters/wlFilterByCompany.cfm

​

​

​

12 of 25

Presence

  • Social Media:
    • https://inteltechniques.com/menu.html
  • Physical Locations
  • Sensitive files
    • https://github.com/leebaird/discover
  • Searching for proprietary or unique terms

13 of 25

Storytime with Robby

14 of 25

Results

A Sampling of 60 Reports �from 2015 - 2018

Data points?

  • Was OSINT Performed
  • Number of Emails Discovered
  • Number of Customer Provided
  • Type of Pretext
  • Logo/Signature in Pretext E-mail?
  • Creds Compromised

​

​

15 of 25

OSINT

16 of 25

Types of Pretext

17 of 25

Let’s look at some Pretexts!

What Works

​

  • Targeted salutations
  • Using a domain similar to your target
  • Using categorized domains
  • Certificates
  • Customized signatures

​

​

​

What Doesn’t Work (most of the time)

​

  • Spoofing a domain that uses protections �(IE SPF, DKIM and DMARC)
  • Overly-lengthy
  • Non-customized signatures

18 of 25

What Works? - (Harvesting Credentials)

19 of 25

What Doesn’t Work? - (Harvesting Credentials)

20 of 25

What Works? - (Execute Payload)

21 of 25

What Doesn’t Work? - (Execute Payload)

22 of 25

SMB IMG Tags to Harvest Creds!!

​

Include it on Phishing emails to capture creds,

Include it on Landing pages to capture creds,

Include it on Everything!!

​

​

​

​

​

23 of 25

Other Tips and Tricks

  1. Porfect grammerr
  2. Using SSL + cert
  3. Domain categorization
  4. Connect with your inner marketer
  5. Host malicious things in the cloud: AWS is your best friend

24 of 25

Free Pretexts

https://github.com/L4bF0x/PhishingPretexts

Free Pretexts!

25 of 25

Questions? �

Émilie St-Pierre

Emilie_St-Pierre@Rapid7.com

Twitter: @L4bF0x

Robert Stewart

Robert_Stewart@Rapid7.com

Twitter: @RizzyRong

​

Free Pretexts: https://github.com/L4bF0x/PhishingPretexts

Slides: https://goo.gl/U6qiiy