SlideShare a Scribd company logo

OSINT for Proactive Defense - RootConf 2019

•Download as PPTX, PDF•
•
RedHunt Labs
RedHunt Labs

A presentation about using Open Source Intelligence for proactive defense delivered at Rootconf 2019 Bangalore, India. RedHunt Labs https://redhuntlabs.com/

Technology
1 of 31
OSINT for Proactive Defense Rootconf 2019
# whoami ● Shubham Mittal ○ Director at RedHunt Labs ○ CFP Review Board Member - BlackHat Asia & InSEC World HongKong ○ Co-Founder - Recon Village (DEFCON Hacking Conference) ○ Project Lead - DataSploit (OSINT Framework) ○ 8+ Years Experienced Security and OSINT Enthusiast ○ Expertise in Offensive Security, Perimeter Security, OSINT ○ Speaker/Trainer/Presenter - BlackHat, DEFCON, Nullcon, c0c0n, IETF ○ Bike Rider, Beat Boxer ○ Twitter: @upgoingstar
Agenda ● Overview of OSINT ● Why Security Teams should use OSINT ● Continuous Discovery and Monitoring of Assets ● Use OSINT Data for Periodic Attack Simulation ● Discovering Sensitive Information Leakage ● Monitoring Breached Passwords ● Proactively Identifying Security Incidents using SOCMint ● OSINT Countermeasures
What I mean when I use these.. - Brute Force - Trial-and-error method used to obtain information such as a user password, bucket names, subdomains, PIN, OTP Codes, etc. - Black Box / White Box / Gray Box - No access to the information / Complete access to the information / Hybrid mode. - Patch - Fixing security vulnerabilities and other bugs.
What is OSINT? ● Open Source INTelligence (OSINT) is the collection and analysis of information gathered from publicly available sources. Intelligence Analysis Correlation Raw Information Actionable Intelligence https://en.wikipedia.org/wiki/Open-source_intelligence
Why OSINT?
Why Security Teams should do OSINT? Because, Hackers do.
Why Security Teams should worry about OSINT? ● Sensitive Info Leakage on Code Aggregators ● Untracked Assets running Easy Targets ● Frequent Release Cycles, Dynamic Cloud Environments ● Targeted attacks, less noisy. Sometimes, can’t be caught. ● Employees use personal breached passwords in Corporate Accounts. ● Full Patched Systems? How about credentials leak? Find it before Hackers do.
Why Security Teams should worry about OSINT? http://hackerone.com/hacktivity
How? ● Continuous Discovery and Monitoring of Assets ● Periodic Attack Simulation ● Discovering Sensitive Information Leakage ● Monitoring Breached Passwords ● Proactively Identifying Security Incidents using SOCMint
What is an Asset? ● Any resource of monetary value. ● Owned by individuals, companies, or governments. ● Example? ○ Servers, HDD, Network Devices, Laptops, Domains, Patents, etc. ● How about.. ○ Social Media Accounts, Source Code Repositories, Relevant Dumped Passwords, Cloud Storage objects (Buckets, Blobs, Spaces, etc.), Elastic IP Addresses, API Keys and Credentials and a lot more. ○ No monetary value, but can cause huge reputational and financial loss. https://redhuntlabs.com/blog/redifining-assets-a-modern-perspective.html
Continuous Discovery and Monitoring of Assets - IP Addresses (Dynamic and Elastic) - Domains - Subdomains - Cloud Storage Objects - Leaked Credentials / API Keys / etc. - Social Media Accounts - Third Party API Keys - Analytics Tags - Supply Chain (Vendors, Acquisitions, Mergers, etc.)
- IP Addresses ● Cloud API (WhiteBox) ● DC Administrators (WhiteBox) ● Internet Wide Scans (Project Sonar, Shodan, etc.) ● Using ASN ID (Autonomous Synchronization Number) ● Whois Reverse Search ● Reverse PTR Records
DEMO - WhoIs / ASN ID
Project Sonar ● By Rapid7 and MIT ● Periodic DNS Queries ● FDNS ○ A, AAAA, CNAME, TXT, SOA ● RDNS ○ PTR ● https://scans.io https://opendata.rapid7.com/about/
- Domains ● Reverse Whois on Email and Phone Numbers
- Subdomains ● Search Engines (Google/Yahoo/Bing/Yandex) ● Internet Wide Scans - Project Sonar ● Certificate Transparency Reports ● Brute Forcing Subdomains ● Reverse IP Lookup, etc. ● Tools ○ Sublist3r / Amass (Well maintained and good number of sources) ○ aio-dns-brute (Very quick) ~ Threat to Network Bandwidth https://github.com/aboul3la/Sublist3r https://github.com/blark/aiodnsbrute
DEMO - Open Data Querying (FDNS/RDNS DataSet)
- Cloud Storage Objects ● Buckets / Blobs / Spaces ● Stores Sensitive Data (Intentionally and Unintentionally) ● Misconfigured ACLs (Access Control Lists) ● How? ○ Spider, Fetch, Extract, Check for Permissions. ○ Create Possible bucket names (Common patterns) and try each one.
Custom Python Script https://digi.ninja/projects/bucket_finder.php
- Leaked Creds ● Identify leaked sensitive information. ● Passwords, API Keys, Third Party Access Tokens, DB Creds, Internal domains, etc. ● GitHub, BitBucket, Pastebin, .Onion Websites, etc. ● Identify Organization Repos / Identify Employees and their personal Repos. ● Google CSE (Custom Search Engine) ● Manual Search ○ GitHub Advanced Search ● Automated tools ○ Gitrob, TruffleHog, etc. https://github.com/search/advanced https://github.com/michenriksen/gitrob https://github.com/dxa4481/truffleHog
Manual Search Example
DEMO - TruffleHog
- Social Media Monitoring - Security Incidents - Organization Reputation - Keyword Based Monitoring - Streaming APIs / Scrapers - Google Alerts / Page Change Detection - Tweet-Monitor - Someone tweets, Alert on Email, Dump to ElasticSearch. - Dashboards (Users, Frequency, Relationships, Geolocations, etc.) - https://www.youtube.com/watch?v=OjLP5k5NIMY https://github.com/upgoingstar/TweetMonitor
- Identifying Relationships between Domains ● Third Party Tags for Analytics ● Admin holds one account. ● Same Tag used across different assets owned. ● Reverse Lookup can be done. https://builtwith.com/relationships/
Periodic Attack Simulation ● Create a list of assets. ● Classify the assets (IPs, Subdomains, Domains, Buckets, etc.) ● Run custom scans. ● Pass these assets to Vulnerability Scanners, Review Reports. ● New Release? New Acquisition? New Merger? ○ Check for new assets. ○ Check for vulnerability resurfacing. ○ Run a complete cycle.
OSINT Countermeasures - Do it yourself before someone else use it against you - OSINT Awareness Campaigns - MetaData Stripping - Data Loss Prevention - SIEM Integration with CIF - HoneyCreds - Identify the root cause, instead of fixing the issue.
Implement OSINT Countermeasures Identify Asset Data Sources Implement Asset Discovery Process Periodic Attack Simulation / Vulnerability Resurfacing Checks Security Team ● IP Addresses (Dynamic and Elastic) ● Domains ● Subdomains ● Cloud Storage Objects ● Leaked Credentials / API Keys / etc. ● Social Media Accounts ● Third Party API Keys ● Analytics Tags ● Supply Chain (Vendors, Acquisitions, Mergers, etc.)
What next? ● Awesome Asset Discovery List ○ https://github.com/redhuntlabs/Awesome-Asset-Discovery ● Awesome OSINT Resources ○ https://github.com/jivoi/awesome-osint ● DataSploit - OSINT Framework ○ https://github.com/DataSploit/datasploit ● Handpicked Weekly OSINT News ○ https://medium.com/week-in-osint ● Open Data - Internet Wide Scans ○ https://opendata.rapid7.com/about/
Q & A - Email: shubham@redhuntlabs.com - Twitter: @upgoingstar - Website: www.redhuntlabs.com - Would like to talk? Fix a meeting: https://calendly.com/shubham_mittal/short_meeting

Recommended

Empowering red and blue teams with osint c0c0n 2017
Empowering red and blue teams with osint c0c0n 2017Empowering red and blue teams with osint c0c0n 2017
Empowering red and blue teams with osint c0c0n 2017reconvillage
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and DefenseAndrew McNicol
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceDeep Shankar Yadav
 
Open Source Intelligence (OSINT)
Open Source Intelligence (OSINT)Open Source Intelligence (OSINT)
Open Source Intelligence (OSINT)festival ICT 2016
 
Osint
OsintOsint
OsintKamal Rathaur
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
OpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxOpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxanonymousanonymous428352
 
From OSINT to Phishing presentation
From OSINT to Phishing presentationFrom OSINT to Phishing presentation
From OSINT to Phishing presentationJesse Ratcliffe, OSCP
 

Recommended

Empowering red and blue teams with osint c0c0n 2017
Empowering red and blue teams with osint c0c0n 2017Empowering red and blue teams with osint c0c0n 2017
Empowering red and blue teams with osint c0c0n 2017reconvillage
 
OSINT for Attack and Defense
OSINT for Attack and DefenseOSINT for Attack and Defense
OSINT for Attack and DefenseAndrew McNicol
 
OSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceOSINT- Leveraging data into intelligence
OSINT- Leveraging data into intelligenceDeep Shankar Yadav
 
Open Source Intelligence (OSINT)
Open Source Intelligence (OSINT)Open Source Intelligence (OSINT)
Open Source Intelligence (OSINT)festival ICT 2016
 
Osint
OsintOsint
OsintKamal Rathaur
 
Introduction to red team operations
Introduction to red team operationsIntroduction to red team operations
Introduction to red team operationsSunny Neo
 
OpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxOpenSourceIntelligence-OSINT.pptx
OpenSourceIntelligence-OSINT.pptxanonymousanonymous428352
 
From OSINT to Phishing presentation
From OSINT to Phishing presentationFrom OSINT to Phishing presentation
From OSINT to Phishing presentationJesse Ratcliffe, OSCP
 
Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Tools for Open Source Intelligence (OSINT)
Tools for Open Source Intelligence (OSINT)Tools for Open Source Intelligence (OSINT)
Tools for Open Source Intelligence (OSINT)Sudhanshu Chauhan
 
Getting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsGetting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsOlakanmi Oluwole
 
OSINT - Open Source Intelligence
OSINT - Open Source IntelligenceOSINT - Open Source Intelligence
OSINT - Open Source Intelligencec0c0n - International Cyber Security and Policing Conference
 
Open source intelligence
Open source intelligenceOpen source intelligence
Open source intelligencebalakumaran779
 
Let’s hunt the target using OSINT
Let’s hunt the target using OSINTLet’s hunt the target using OSINT
Let’s hunt the target using OSINTChandrapal Badshah
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)phexcom1
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturityDNIF
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Frameworkn|u - The Open Security Community
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...Falgun Rathod
 
What is Open Source Intelligence (OSINT)
What is Open Source Intelligence (OSINT)What is Open Source Intelligence (OSINT)
What is Open Source Intelligence (OSINT)Molfar
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
OSINT
OSINTOSINT
OSINTApurv Singh Gautam
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
 
Osint presentation nov 2019
Osint presentation nov 2019Osint presentation nov 2019
Osint presentation nov 2019Priyanka Aash
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE - ATT&CKcon
 
OSINT: Open Source Intelligence - Rohan Braganza
OSINT: Open Source Intelligence - Rohan BraganzaOSINT: Open Source Intelligence - Rohan Braganza
OSINT: Open Source Intelligence - Rohan BraganzaNSConclave
 
Osint ashish mistry
Osint ashish mistryOsint ashish mistry
Osint ashish mistryn|u - The Open Security Community
 

More Related Content

What's hot

Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceDhruv Majumdar
 
Tools for Open Source Intelligence (OSINT)
Tools for Open Source Intelligence (OSINT)Tools for Open Source Intelligence (OSINT)
Tools for Open Source Intelligence (OSINT)Sudhanshu Chauhan
 
Getting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsGetting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsOlakanmi Oluwole
 
Open source intelligence
Open source intelligenceOpen source intelligence
Open source intelligencebalakumaran779
 
Let’s hunt the target using OSINT
Let’s hunt the target using OSINTLet’s hunt the target using OSINT
Let’s hunt the target using OSINTChandrapal Badshah
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)phexcom1
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturityDNIF
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onSplunk
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabTeymur Kheirkhabarov
 
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...Falgun Rathod
 
What is Open Source Intelligence (OSINT)
What is Open Source Intelligence (OSINT)What is Open Source Intelligence (OSINT)
What is Open Source Intelligence (OSINT)Molfar
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentTeymur Kheirkhabarov
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshopArpan Raval
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat HuntingGIBIN JOHN
 
Osint presentation nov 2019
Osint presentation nov 2019Osint presentation nov 2019
Osint presentation nov 2019Priyanka Aash
 
Threat Hunting
Threat HuntingThreat Hunting
Threat HuntingSplunk
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE - ATT&CKcon
 

What's hot (20)

Effective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat IntelligenceEffective Threat Hunting with Tactical Threat Intelligence
Effective Threat Hunting with Tactical Threat Intelligence
 
Tools for Open Source Intelligence (OSINT)
Tools for Open Source Intelligence (OSINT)Tools for Open Source Intelligence (OSINT)
Tools for Open Source Intelligence (OSINT)
 
Getting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigationsGetting started with using the Dark Web for OSINT investigations
Getting started with using the Dark Web for OSINT investigations
 
OSINT - Open Source Intelligence
OSINT - Open Source IntelligenceOSINT - Open Source Intelligence
OSINT - Open Source Intelligence
 
Open source intelligence
Open source intelligenceOpen source intelligence
Open source intelligence
 
Let’s hunt the target using OSINT
Let’s hunt the target using OSINTLet’s hunt the target using OSINT
Let’s hunt the target using OSINT
 
Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)Open source intelligence information gathering (OSINT)
Open source intelligence information gathering (OSINT)
 
Threat hunting and achieving security maturity
Threat hunting and achieving security maturityThreat hunting and achieving security maturity
Threat hunting and achieving security maturity
 
MITRE ATT&CK Framework
MITRE ATT&CK FrameworkMITRE ATT&CK Framework
MITRE ATT&CK Framework
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
PHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On LabPHDays 2018 Threat Hunting Hands-On Lab
PHDays 2018 Threat Hunting Hands-On Lab
 
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
OSINT - Open Source Intelligence "Leading Intelligence and Investigation Tech...
 
What is Open Source Intelligence (OSINT)
What is Open Source Intelligence (OSINT)What is Open Source Intelligence (OSINT)
What is Open Source Intelligence (OSINT)
 
Hunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows EnvironmentHunting for Credentials Dumping in Windows Environment
Hunting for Credentials Dumping in Windows Environment
 
OSINT
OSINTOSINT
OSINT
 
Cyber Threat hunting workshop
Cyber Threat hunting workshopCyber Threat hunting workshop
Cyber Threat hunting workshop
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
Osint presentation nov 2019
Osint presentation nov 2019Osint presentation nov 2019
Osint presentation nov 2019
 
Threat Hunting
Threat HuntingThreat Hunting
Threat Hunting
 
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
MITRE ATT&CKcon 2018: Summiting the Pyramid of Pain: Operationalizing ATT&CK,...
 

Similar to OSINT for Proactive Defense - RootConf 2019

OSINT: Open Source Intelligence - Rohan Braganza
OSINT: Open Source Intelligence - Rohan BraganzaOSINT: Open Source Intelligence - Rohan Braganza
OSINT: Open Source Intelligence - Rohan BraganzaNSConclave
 
Kono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdf
Kono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdfKono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdf
Kono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdfAnant Corporation
 
The Hacking Game - Think Like a Hacker Meetup 12072023.pptx
The Hacking Game - Think Like a Hacker Meetup 12072023.pptxThe Hacking Game - Think Like a Hacker Meetup 12072023.pptx
The Hacking Game - Think Like a Hacker Meetup 12072023.pptxlior mazor
 
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELKThreat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELKElasticsearch
 
Datasploit - An Open Source Intelligence Tool
Datasploit - An Open Source Intelligence ToolDatasploit - An Open Source Intelligence Tool
Datasploit - An Open Source Intelligence ToolShubham Mittal
 
APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)
APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)
APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)apidays
 
hacking techniques and intrusion techniques useful in OSINT.pptx
hacking techniques and intrusion techniques useful in OSINT.pptxhacking techniques and intrusion techniques useful in OSINT.pptx
hacking techniques and intrusion techniques useful in OSINT.pptxsconalbg
 
Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,
Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,
Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,Sigma Software
 
technical-information-gathering-slides.pdf
technical-information-gathering-slides.pdftechnical-information-gathering-slides.pdf
technical-information-gathering-slides.pdfMarceloCunha571649
 
2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open StandardsAPIsecure_ Official
 
BSides Cincy: Active Defense - Helping threat actors hack themselves!
BSides Cincy: Active Defense - Helping threat actors hack themselves!BSides Cincy: Active Defense - Helping threat actors hack themselves!
BSides Cincy: Active Defense - Helping threat actors hack themselves!CiNPA Security SIG
 
Arron daniels 1 pager researching the tech talent market
Arron daniels 1 pager researching the tech talent marketArron daniels 1 pager researching the tech talent market
Arron daniels 1 pager researching the tech talent marketTalent42
 
EMFcamp2022 - What if apps logged into you, instead of you logging into apps?
EMFcamp2022 - What if apps logged into you, instead of you logging into apps?EMFcamp2022 - What if apps logged into you, instead of you logging into apps?
EMFcamp2022 - What if apps logged into you, instead of you logging into apps?Chris Swan
 
Introduction To ICT Security Audit OWASP Day Malaysia 2011
Introduction To ICT Security Audit OWASP Day Malaysia 2011Introduction To ICT Security Audit OWASP Day Malaysia 2011
Introduction To ICT Security Audit OWASP Day Malaysia 2011Linuxmalaysia Malaysia
 
Information security - what is going on 2016
Information security - what is going on 2016Information security - what is going on 2016
Information security - what is going on 2016Tomppa Järvinen
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptxChi En (Ashley) Shen
 
Social Media Data Collection & Analysis
Social Media Data Collection & AnalysisSocial Media Data Collection & Analysis
Social Media Data Collection & AnalysisScott Sanders
 

Similar to OSINT for Proactive Defense - RootConf 2019 (20)

OSINT: Open Source Intelligence - Rohan Braganza
OSINT: Open Source Intelligence - Rohan BraganzaOSINT: Open Source Intelligence - Rohan Braganza
OSINT: Open Source Intelligence - Rohan Braganza
 
Osint ashish mistry
Osint ashish mistryOsint ashish mistry
Osint ashish mistry
 
Kono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdf
Kono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdfKono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdf
Kono.IntelCraft.Weekly.AI.LLM.Landscape.2024.02.28.pdf
 
The Hacking Game - Think Like a Hacker Meetup 12072023.pptx
The Hacking Game - Think Like a Hacker Meetup 12072023.pptxThe Hacking Game - Think Like a Hacker Meetup 12072023.pptx
The Hacking Game - Think Like a Hacker Meetup 12072023.pptx
 
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELKThreat Hunting with Elastic at SpectorOps: Welcome to HELK
Threat Hunting with Elastic at SpectorOps: Welcome to HELK
 
Datasploit - An Open Source Intelligence Tool
Datasploit - An Open Source Intelligence ToolDatasploit - An Open Source Intelligence Tool
Datasploit - An Open Source Intelligence Tool
 
APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)
APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)
APIsecure 2023 - API Security - doing more with less, Nir Paz (Standard.ai)
 
hacking techniques and intrusion techniques useful in OSINT.pptx
hacking techniques and intrusion techniques useful in OSINT.pptxhacking techniques and intrusion techniques useful in OSINT.pptx
hacking techniques and intrusion techniques useful in OSINT.pptx
 
Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,
Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,
Байки із пожежного депо або як працює Big Data в Sigma Software, Денис Пишьєв,
 
technical-information-gathering-slides.pdf
technical-information-gathering-slides.pdftechnical-information-gathering-slides.pdf
technical-information-gathering-slides.pdf
 
2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards2022 APIsecure_Securing APIs with Open Standards
2022 APIsecure_Securing APIs with Open Standards
 
BSides Cincy: Active Defense - Helping threat actors hack themselves!
BSides Cincy: Active Defense - Helping threat actors hack themselves!BSides Cincy: Active Defense - Helping threat actors hack themselves!
BSides Cincy: Active Defense - Helping threat actors hack themselves!
 
Arron daniels 1 pager researching the tech talent market
Arron daniels 1 pager researching the tech talent marketArron daniels 1 pager researching the tech talent market
Arron daniels 1 pager researching the tech talent market
 
We are Digital Puppets
We are Digital PuppetsWe are Digital Puppets
We are Digital Puppets
 
EMFcamp2022 - What if apps logged into you, instead of you logging into apps?
EMFcamp2022 - What if apps logged into you, instead of you logging into apps?EMFcamp2022 - What if apps logged into you, instead of you logging into apps?
EMFcamp2022 - What if apps logged into you, instead of you logging into apps?
 
Introduction To ICT Security Audit OWASP Day Malaysia 2011
Introduction To ICT Security Audit OWASP Day Malaysia 2011Introduction To ICT Security Audit OWASP Day Malaysia 2011
Introduction To ICT Security Audit OWASP Day Malaysia 2011
 
Publishing Linked Data using Schema.org
Publishing Linked Data using Schema.orgPublishing Linked Data using Schema.org
Publishing Linked Data using Schema.org
 
Information security - what is going on 2016
Information security - what is going on 2016Information security - what is going on 2016
Information security - what is going on 2016
 
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
[HITCON 2020 CTI Village] Threat Hunting and Campaign Tracking Workshop.pptx
 
Social Media Data Collection & Analysis
Social Media Data Collection & AnalysisSocial Media Data Collection & Analysis
Social Media Data Collection & Analysis
 

Recently uploaded

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Drew Madelung
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationRadu Cotescu
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Igalia
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...apidays
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityPrincipled Technologies
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CVKhem
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024The Digital Insurer
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdfhans926745
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Servicegiselly40
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsJoaquim Jorge
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘RTylerCroy
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024The Digital Insurer
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Scriptwesley chun
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationSafe Software
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerThousandEyes
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUK Journal
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsMaria Levchenko
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)Gabriella Davis
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking MenDelhi Call girls
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processorsdebabhi2
 

Recently uploaded (20)

Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
Strategies for Unlocking Knowledge Management in Microsoft 365 in the Copilot...
 
Scaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organizationScaling API-first – The story of a global engineering organization
Scaling API-first – The story of a global engineering organization
 
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
Raspberry Pi 5: Challenges and Solutions in Bringing up an OpenGL/Vulkan Driv...
 
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
Apidays Singapore 2024 - Building Digital Trust in a Digital Economy by Veron...
 
Boost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivityBoost PC performance: How more available memory can improve productivity
Boost PC performance: How more available memory can improve productivity
 
Real Time Object Detection Using Open CV
Real Time Object Detection Using Open CVReal Time Object Detection Using Open CV
Real Time Object Detection Using Open CV
 
Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024Finology Group – Insurtech Innovation Award 2024
Finology Group – Insurtech Innovation Award 2024
 
[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf[2024]Digital Global Overview Report 2024 Meltwater.pdf
[2024]Digital Global Overview Report 2024 Meltwater.pdf
 
CNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of ServiceCNv6 Instructor Chapter 6 Quality of Service
CNv6 Instructor Chapter 6 Quality of Service
 
Artificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and MythsArtificial Intelligence: Facts and Myths
Artificial Intelligence: Facts and Myths
 
🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘🐬 The future of MySQL is Postgres 🐘
🐬 The future of MySQL is Postgres 🐘
 
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
Bajaj Allianz Life Insurance Company - Insurer Innovation Award 2024
 
Automating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps ScriptAutomating Google Workspace (GWS) & more with Apps Script
Automating Google Workspace (GWS) & more with Apps Script
 
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time AutomationFrom Event to Action: Accelerate Your Decision Making with Real-Time Automation
From Event to Action: Accelerate Your Decision Making with Real-Time Automation
 
How to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected WorkerHow to Troubleshoot Apps for the Modern Connected Worker
How to Troubleshoot Apps for the Modern Connected Worker
 
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdfUnderstanding Discord NSFW Servers A Guide for Responsible Users.pdf
Understanding Discord NSFW Servers A Guide for Responsible Users.pdf
 
Handwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed textsHandwritten Text Recognition for manuscripts and early printed texts
Handwritten Text Recognition for manuscripts and early printed texts
 
A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)A Domino Admins Adventures (Engage 2024)
A Domino Admins Adventures (Engage 2024)
 
08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men08448380779 Call Girls In Friends Colony Women Seeking Men
08448380779 Call Girls In Friends Colony Women Seeking Men
 
Exploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone ProcessorsExploring the Future Potential of AI-Enabled Smartphone Processors
Exploring the Future Potential of AI-Enabled Smartphone Processors
 

OSINT for Proactive Defense - RootConf 2019

  • 1. OSINT for Proactive Defense Rootconf 2019
  • 2. # whoami ● Shubham Mittal ○ Director at RedHunt Labs ○ CFP Review Board Member - BlackHat Asia & InSEC World HongKong ○ Co-Founder - Recon Village (DEFCON Hacking Conference) ○ Project Lead - DataSploit (OSINT Framework) ○ 8+ Years Experienced Security and OSINT Enthusiast ○ Expertise in Offensive Security, Perimeter Security, OSINT ○ Speaker/Trainer/Presenter - BlackHat, DEFCON, Nullcon, c0c0n, IETF ○ Bike Rider, Beat Boxer ○ Twitter: @upgoingstar
  • 3. Agenda ● Overview of OSINT ● Why Security Teams should use OSINT ● Continuous Discovery and Monitoring of Assets ● Use OSINT Data for Periodic Attack Simulation ● Discovering Sensitive Information Leakage ● Monitoring Breached Passwords ● Proactively Identifying Security Incidents using SOCMint ● OSINT Countermeasures
  • 4. What I mean when I use these.. - Brute Force - Trial-and-error method used to obtain information such as a user password, bucket names, subdomains, PIN, OTP Codes, etc. - Black Box / White Box / Gray Box - No access to the information / Complete access to the information / Hybrid mode. - Patch - Fixing security vulnerabilities and other bugs.
  • 5. What is OSINT? ● Open Source INTelligence (OSINT) is the collection and analysis of information gathered from publicly available sources. Intelligence Analysis Correlation Raw Information Actionable Intelligence https://en.wikipedia.org/wiki/Open-source_intelligence
  • 7. Why Security Teams should do OSINT? Because, Hackers do.
  • 8. Why Security Teams should worry about OSINT? ● Sensitive Info Leakage on Code Aggregators ● Untracked Assets running Easy Targets ● Frequent Release Cycles, Dynamic Cloud Environments ● Targeted attacks, less noisy. Sometimes, can’t be caught. ● Employees use personal breached passwords in Corporate Accounts. ● Full Patched Systems? How about credentials leak? Find it before Hackers do.
  • 9. Why Security Teams should worry about OSINT? http://hackerone.com/hacktivity
  • 10. How? ● Continuous Discovery and Monitoring of Assets ● Periodic Attack Simulation ● Discovering Sensitive Information Leakage ● Monitoring Breached Passwords ● Proactively Identifying Security Incidents using SOCMint
  • 11. What is an Asset? ● Any resource of monetary value. ● Owned by individuals, companies, or governments. ● Example? ○ Servers, HDD, Network Devices, Laptops, Domains, Patents, etc. ● How about.. ○ Social Media Accounts, Source Code Repositories, Relevant Dumped Passwords, Cloud Storage objects (Buckets, Blobs, Spaces, etc.), Elastic IP Addresses, API Keys and Credentials and a lot more. ○ No monetary value, but can cause huge reputational and financial loss. https://redhuntlabs.com/blog/redifining-assets-a-modern-perspective.html
  • 12. Continuous Discovery and Monitoring of Assets - IP Addresses (Dynamic and Elastic) - Domains - Subdomains - Cloud Storage Objects - Leaked Credentials / API Keys / etc. - Social Media Accounts - Third Party API Keys - Analytics Tags - Supply Chain (Vendors, Acquisitions, Mergers, etc.)
  • 13. - IP Addresses ● Cloud API (WhiteBox) ● DC Administrators (WhiteBox) ● Internet Wide Scans (Project Sonar, Shodan, etc.) ● Using ASN ID (Autonomous Synchronization Number) ● Whois Reverse Search ● Reverse PTR Records
  • 14.
  • 15. DEMO - WhoIs / ASN ID
  • 16. Project Sonar ● By Rapid7 and MIT ● Periodic DNS Queries ● FDNS ○ A, AAAA, CNAME, TXT, SOA ● RDNS ○ PTR ● https://scans.io https://opendata.rapid7.com/about/
  • 17. - Domains ● Reverse Whois on Email and Phone Numbers
  • 18. - Subdomains ● Search Engines (Google/Yahoo/Bing/Yandex) ● Internet Wide Scans - Project Sonar ● Certificate Transparency Reports ● Brute Forcing Subdomains ● Reverse IP Lookup, etc. ● Tools ○ Sublist3r / Amass (Well maintained and good number of sources) ○ aio-dns-brute (Very quick) ~ Threat to Network Bandwidth https://github.com/aboul3la/Sublist3r https://github.com/blark/aiodnsbrute
  • 19. DEMO - Open Data Querying (FDNS/RDNS DataSet)
  • 20. - Cloud Storage Objects ● Buckets / Blobs / Spaces ● Stores Sensitive Data (Intentionally and Unintentionally) ● Misconfigured ACLs (Access Control Lists) ● How? ○ Spider, Fetch, Extract, Check for Permissions. ○ Create Possible bucket names (Common patterns) and try each one.
  • 22. - Leaked Creds ● Identify leaked sensitive information. ● Passwords, API Keys, Third Party Access Tokens, DB Creds, Internal domains, etc. ● GitHub, BitBucket, Pastebin, .Onion Websites, etc. ● Identify Organization Repos / Identify Employees and their personal Repos. ● Google CSE (Custom Search Engine) ● Manual Search ○ GitHub Advanced Search ● Automated tools ○ Gitrob, TruffleHog, etc. https://github.com/search/advanced https://github.com/michenriksen/gitrob https://github.com/dxa4481/truffleHog
  • 25. - Social Media Monitoring - Security Incidents - Organization Reputation - Keyword Based Monitoring - Streaming APIs / Scrapers - Google Alerts / Page Change Detection - Tweet-Monitor - Someone tweets, Alert on Email, Dump to ElasticSearch. - Dashboards (Users, Frequency, Relationships, Geolocations, etc.) - https://www.youtube.com/watch?v=OjLP5k5NIMY https://github.com/upgoingstar/TweetMonitor
  • 26. - Identifying Relationships between Domains ● Third Party Tags for Analytics ● Admin holds one account. ● Same Tag used across different assets owned. ● Reverse Lookup can be done. https://builtwith.com/relationships/
  • 27. Periodic Attack Simulation ● Create a list of assets. ● Classify the assets (IPs, Subdomains, Domains, Buckets, etc.) ● Run custom scans. ● Pass these assets to Vulnerability Scanners, Review Reports. ● New Release? New Acquisition? New Merger? ○ Check for new assets. ○ Check for vulnerability resurfacing. ○ Run a complete cycle.
  • 28. OSINT Countermeasures - Do it yourself before someone else use it against you - OSINT Awareness Campaigns - MetaData Stripping - Data Loss Prevention - SIEM Integration with CIF - HoneyCreds - Identify the root cause, instead of fixing the issue.
  • 29. Implement OSINT Countermeasures Identify Asset Data Sources Implement Asset Discovery Process Periodic Attack Simulation / Vulnerability Resurfacing Checks Security Team ● IP Addresses (Dynamic and Elastic) ● Domains ● Subdomains ● Cloud Storage Objects ● Leaked Credentials / API Keys / etc. ● Social Media Accounts ● Third Party API Keys ● Analytics Tags ● Supply Chain (Vendors, Acquisitions, Mergers, etc.)
  • 30. What next? ● Awesome Asset Discovery List ○ https://github.com/redhuntlabs/Awesome-Asset-Discovery ● Awesome OSINT Resources ○ https://github.com/jivoi/awesome-osint ● DataSploit - OSINT Framework ○ https://github.com/DataSploit/datasploit ● Handpicked Weekly OSINT News ○ https://medium.com/week-in-osint ● Open Data - Internet Wide Scans ○ https://opendata.rapid7.com/about/
  • 31. Q & A - Email: shubham@redhuntlabs.com - Twitter: @upgoingstar - Website: www.redhuntlabs.com - Would like to talk? Fix a meeting: https://calendly.com/shubham_mittal/short_meeting

Editor's Notes

  1. Teams keep launching new instances, security misconfigurations public ip being assigned wrong security group being attached and hence sensitive port exposed These should be monitored
  2. Setup Security Team OSINT Countermeasures Identify Asset Data Sources Implement Asset Discovery Process Automated Vulnerability Scanning and Reporting Continuous Monitoring and Alerting