Information gathering is a crucial step in cybersecurity and research, and it can take weeks to collect all necessary details about a company, its clients, employees, emails 📧, potential leaks 🔓, recent updates 🆕, IP addresses 🌐, domains 🖥️, CIDR blocks 🧩, ASN, and more. This process helps to build a clear picture of the digital footprint of a target, making it easier to identify vulnerabilities and opportunities for improvement.
We will organize the data collected using the tool https://xmind.app/🧠, which is great for creating diagrams 🗺️ and handling large amounts of data in an organized manner.
Search for the company on Google 🔍
Start by researching the company online. Google is a great resource for uncovering general information 📚, news articles 📰, and any public details that might be available about the company.
Gather information about employees 📱
Check social media platforms like LinkedIn 💼, Twitter 🐦, and others to find employee names and their roles. This can help identify key personnel 👥 or uncover further connections. LinkedIn and Twitter are often goldmines for professional and personal information.
Visithttps://hunter.io/**🔑 (Paid)**
Hunter.io is a powerful tool for discovering email addresses 📧 related to a specific domain. It can be used to find professional contact information and is highly effective for gathering lead data.
Using Google Dorking 🔍💻
Google Dorking is a technique used to perform specific searches in Google. It allows you to find hidden information that is not readily accessible through normal search queries. Here's an example to show how it works:
Example:
You can use search operators like "site:example.com" filetype:pdf to search for PDF files within a specific website. There are numerous advanced search operators to help you fine-tune your research
<aside>
site:swisscom.ch
filetype:pdf machine learning
intitle: data privacy
link: password
intext:cyber threat
</aside>
Example From Visit https://hunter.io/
Here are some valuable websites for gathering information using OSINT (Open-Source Intelligence):
The OSINT Framework is one of the best for information gathering! It provides a comprehensive list of tools and websites to search for various types of data (usernames, email addresses, domain names, IP & MAC addresses, and more). 📊🔎
This is a classic tool for finding domain and IP information. It provides ownership details and domain registration information. 🖥️📑
Crunchbase helps you track company acquisitions. If you find a vulnerability inside a parent company, you can investigate further through this resource. 💼📈
Zone-H offers insights into historical defacements of websites. This can help identify vulnerabilities that may have been exploited in the past. ⚠️🛠️
https://www.dnsqueries.com/en/
A tool for querying DNS records. It's useful for looking up information about domain names, IPs, and related services. 🌍🔄
Soc Radar provides tools for threat intelligence, including monitoring data leaks and other cyber threats. 🛡️🧠
De hashed is a resource for searching compromised databases, giving you access to exposed usernames, emails, and more. 🔑💻