1
00:00:00,000 --> 00:00:05,420
We had this lightning talk available. The speaker didn't turn up. He had some issues. So we asked

2
00:00:05,420 --> 00:00:10,520
a bunch of people, but then no one turned up. So we are, so Kunal will be speaking about a tool

3
00:00:10,520 --> 00:00:14,760
called DataSplit. It's an open source intelligence framework. Okay, so over to you, Kunal.

4
00:00:21,560 --> 00:00:29,980
Hello, good evening, guys. Audible? Yeah, hello. Yeah, what is? Okay. Okay, so we're

5
00:00:30,000 --> 00:00:37,800
here. Hello, better? A little like this. Yeah. Okay, so here I'm to present DataSplit, an open

6
00:00:37,800 --> 00:00:46,200
source intelligence tool. So we are the main three contributors to DataSplit. Right? So what is

7
00:00:46,200 --> 00:00:59,660
DataSplit? Okay. Okay. Better now? Okay. So it's an automated

8
00:00:59,660 --> 00:00:59,980
automation. It's a little bit more complicated. It's a little bit more complicated. It's

9
00:00:59,980 --> 00:01:05,100
OSINT framework. So basically we have four major modules called domain, email, username, and IP.

10
00:01:05,280 --> 00:01:11,180
So you feed in any of these things like domain test.com, email ID, an IP address, or username,

11
00:01:11,380 --> 00:01:16,220
and then it fetches these informations from a lot of data sources that we have configured behind

12
00:01:16,920 --> 00:01:21,960
all the modules. It's completely written in Python, and currently it runs either on a console

13
00:01:21,960 --> 00:01:27,460
or you can export the output that's there on a JSON format. So one of the major things for

14
00:01:27,460 --> 00:01:33,260
the major use case for this would be a pen test, probably, because let's say for a domain you get

15
00:01:33,260 --> 00:01:37,560
a list of subdomains. You might be interested in, you know, finding which of those domains might be

16
00:01:37,560 --> 00:01:43,400
vulnerable, right? So why data spread? So we have a lot of information that's available open source,

17
00:01:43,560 --> 00:01:48,400
something like username, passwords that might be accidentally posted to GitHub, then address,

18
00:01:48,700 --> 00:01:53,680
email ID, phone numbers, credentials, all this information, you know, might be available

19
00:01:54,580 --> 00:01:56,540
accidentally or on purpose sometimes.

20
00:01:57,460 --> 00:02:03,300
All right, so real time. So as you can see, these are some screenshots of how the information

21
00:02:03,300 --> 00:02:07,180
is available. If you do a Google search for, let's say, a site, Pastebin, you'll find some

22
00:02:07,180 --> 00:02:11,260
database leaks, you know, credentials that someone's done and then posted them online.

23
00:02:11,500 --> 00:02:16,740
Then you can either do an index of search, you know, use those Google search terms to find

24
00:02:16,740 --> 00:02:22,580
open indexes of different websites, then finding credentials on GitHub.

25
00:02:23,120 --> 00:02:26,660
All right, so finding credentials on GitHub.

26
00:02:27,460 --> 00:02:32,380
Then, you know, accidentally post. Then, so as I mentioned, we have four main components called

27
00:02:32,380 --> 00:02:38,440
domain OSINT. So these are basically the four main scripts that you use to actually trigger the

28
00:02:38,440 --> 00:02:44,420
various data sources. Domain OSINT, email OSINT, IP OSINT, and username OSINT. Then the work in

29
00:02:44,420 --> 00:02:50,100
progress for us is, you know, company scoping, basically, you know, making a whole profile for a

30
00:02:50,100 --> 00:02:55,880
company. Active modules, actually passing that information to active attack modules. Then CVE

31
00:02:55,880 --> 00:02:57,440
data aggregation, the CVE data aggregation, the CVE data aggregation, the CVE data aggregation, the CVE data

32
00:02:58,520 --> 00:02:59,420
aggregation, the CVE data aggregation, the CVE data aggregation, the CVE data aggregation. So these are all the

33
00:02:59,420 --> 00:03:06,220
auto-generated reports. So as I mentioned, we have multiple data sources. So as you can see from domain,

34
00:03:06,320 --> 00:03:12,600
we have about 10, 15 odd data sources. So this is how the data flows. From domain, you can get a lot of

35
00:03:12,600 --> 00:03:19,540
email IDs from the email harvester module. That gets passed to email module. That, again, can fetch a lot

36
00:03:19,540 --> 00:03:24,560
of information from these data sources. So it gets, let's say, enumerated usernames. So from those

37
00:03:24,560 --> 00:03:27,440
usernames, you can pass it down to get details, profile, and then you can get a lot of information from

38
00:03:27,460 --> 00:03:33,240
pictures hashtags the conversation that the user has been posting and similarly from a domain you

39
00:03:33,240 --> 00:03:38,480
can get ip addresses which you can actually pass down to find out which all ports are open and the

40
00:03:38,480 --> 00:03:43,780
services that are accessible right so how do you set it up so we have two modes one is a manual

41
00:03:43,780 --> 00:03:48,760
mode which includes a git clone which is used to set up a standalone mode as a standalone tool

42
00:03:48,760 --> 00:03:54,900
in itself and the second way uh so how do you do it you do a git clone install the requirements

43
00:03:54,900 --> 00:03:59,420
there's a config.py that holds all your api keys because these data sources that we have

44
00:03:59,420 --> 00:04:03,560
configured most of them might require an api key for you to configure to actually

45
00:04:03,560 --> 00:04:11,100
uh use them then uh we have a structured uh structured uh you know folders basically

46
00:04:11,100 --> 00:04:15,980
holding each of your scripts so as you can see on the right we have folders called domain emails ip

47
00:04:15,980 --> 00:04:24,600
and then username so the domain has uh scripts specific to the domain osint and then we also

48
00:04:24,600 --> 00:04:24,780
have

49
00:04:24,780 --> 00:04:29,800
support pip recently so it can be installed as a python package and be used as a library in your

50
00:04:29,800 --> 00:04:35,200
projects then we also have a docker implementation you just do a docker pull and you have a data

51
00:04:35,200 --> 00:04:40,040
spread running then how do you write modules it's been recently converted to a framework

52
00:04:40,040 --> 00:04:46,200
so there's a single file that you call the template.py in each folder it has three major

53
00:04:46,200 --> 00:04:52,780
functions a banner a main and an output so banner displays some text about the module main does the

54
00:04:52,780 --> 00:04:53,980
logic behind uh

55
00:04:53,980 --> 00:04:59,400
uh uh you know the module some you know the processing that needs to be done and finally

56
00:04:59,400 --> 00:05:04,160
the data returned from the main is actually what gets passed to the output for printing on console

57
00:05:04,160 --> 00:05:12,060
in a you know human readable way then so we have a very nice uh documentation a very step-by-step

58
00:05:12,060 --> 00:05:17,320
documentation on how to set things up in both manual and automated ways and then how to writing

59
00:05:17,320 --> 00:05:23,800
your own modules and uh then the work in progress currently we support json we are planning to

60
00:05:23,800 --> 00:05:23,960
support json we are planning to support json we are planning to support json we are planning to

61
00:05:23,980 --> 00:05:29,400
support html reports and email uh text files that can be you know passed to another tools like

62
00:05:29,400 --> 00:05:36,480
emails and subdomain lists okay so the demo just to add to that uh the documentation also have

63
00:05:36,480 --> 00:05:40,940
step-by-step uh you know guidelines on how to generate your api keys how to sign up for

64
00:05:40,940 --> 00:05:45,300
different services which we use here yeah it tells you exactly how which things you have to copy and

65
00:05:45,300 --> 00:05:50,080
put back into basically the sites you need to visit how to sign up for them where to get an

66
00:05:50,080 --> 00:05:53,900
api key and paste it in the config.py yeah so

67
00:06:01,980 --> 00:06:06,360
is it visible at the back yeah yeah so as i am

68
00:06:07,220 --> 00:06:13,840
domain domain no that's fine okay so uh let's say we have an ip address you just pass it to

69
00:06:13,840 --> 00:06:18,640
the ipos in framework you can see it first searches for shodan so shodan has no information

70
00:06:18,640 --> 00:06:23,820
then virus total whether or not this ip address was listed as a you know compromised domain and

71
00:06:23,820 --> 00:06:30,140
then some who has information to get the as uh asn the autonomous system number to actually find

72
00:06:30,140 --> 00:06:36,980
out more uh related uh ip ranges for this so before we go ahead like suppose if you have got an email

73
00:06:36,980 --> 00:06:40,840
address okay you're tracing someone and you've got an email address what kind of what kind of

74
00:06:40,840 --> 00:06:43,420
information would you like to collect about any pointers

75
00:06:47,320 --> 00:06:51,660
yeah anything else you would like to like find out about a person you've got an email id of a

76
00:06:51,660 --> 00:06:52,280
person yeah

77
00:06:54,840 --> 00:07:02,440
yeah good sorry what was that true name good exactly yeah so what we're trying to do with data

78
00:07:02,440 --> 00:07:06,760
exploit is you know it's it's no rocket science we're just the things which you'll do manually

79
00:07:06,760 --> 00:07:11,500
going on one site and finding out information we're just collecting bunch of such sites calling

80
00:07:11,500 --> 00:07:17,360
those apis getting it sorted like it goes in an automated manner there is a difference uh which

81
00:07:17,360 --> 00:07:23,640
data split brings in comparison to other tools because a lot of other tools you know uh they

82
00:07:28,200 --> 00:07:32,800
yeah so a lot of other tools you know they are really good but one thing which i really miss in

83
00:07:32,800 --> 00:07:37,220
other tools is like they do not have an automated approach you have to manually pick and use things

84
00:07:37,220 --> 00:07:41,940
sometimes you don't really know what modules you should use i mean for a person who do not

85
00:07:41,940 --> 00:07:46,460
you do ocean on a daily basis it becomes very difficult yeah so that's the problem we are

86
00:07:46,460 --> 00:07:50,160
trying to solve here we're trying to do everything in an automated manner so even if you do not know

87
00:07:50,160 --> 00:07:53,800
anything about ocean just configure your config configure pi and it will be fine so that's the

88
00:07:53,820 --> 00:07:58,260
it will do the things for you yeah so it gathers the relevant information displays them all you

89
00:07:58,260 --> 00:08:03,580
know very clear text format so as he mentioned so let's say you get a domain test.com and you need

90
00:08:03,580 --> 00:08:07,800
to find out what all information is available we have all this information punk spider the who

91
00:08:07,800 --> 00:08:13,220
the dns records that are there the email address harvested related to that domain so these email

92
00:08:13,220 --> 00:08:17,200
addresses you might be interested so let's say you find uh the combination of first name last

93
00:08:17,200 --> 00:08:22,240
name so you can figure out what kind of format the organization uses to actually name their

94
00:08:22,240 --> 00:08:23,680
employees then you can you know actually brute

95
00:08:23,820 --> 00:08:29,660
force them so after this then you get uh so basically where all this domain has been mentioned

96
00:08:29,660 --> 00:08:34,560
on github so let's say files where you know they might be username passwords or aws keys let's say

97
00:08:34,560 --> 00:08:39,900
suppose so you can see the files the specific file where this domain name was seen and

98
00:08:43,960 --> 00:08:49,660
okay and then uh some page links then the paste bin so as you can see for test.com you can

99
00:08:49,660 --> 00:08:53,360
have something like a email id and then a password

100
00:08:53,820 --> 00:09:13,340
so probably this email id password will mostly work on different websites that you find related to this email id so uh finding things on github and paste bin is something which i always do in my pen test you know so whenever i'm doing a pen test i come across any domain name i always make sure that i search these things on github and paste bin so you never know sometimes you might

101
00:09:13,340 --> 00:09:23,200
directly get a db connection string or you might get a domain domain credential so you don't even need to explore a vulnerability so it's pretty easy for me so yeah yeah then uh

102
00:09:23,820 --> 00:09:26,360
So that domain then gets searched on Shodan

103
00:09:26,360 --> 00:09:29,080
for, you know, the ports that are open, as you can see.

104
00:09:30,060 --> 00:09:32,180
So you might find something like open,

105
00:09:32,280 --> 00:09:36,200
an SSH open on an IP address related to test.com.

106
00:09:36,460 --> 00:09:38,080
So that might be exploitable.

107
00:09:38,400 --> 00:09:41,880
And then all that information, AD443,

108
00:09:41,960 --> 00:09:44,540
what services are running, what's the geolocation for that.

109
00:09:45,040 --> 00:09:47,640
And then, so that's, like, a lot of information.

110
00:09:47,940 --> 00:09:49,900
Then the subdomains that are there.

111
00:09:49,960 --> 00:09:51,480
As I mentioned, this might be interesting

112
00:09:51,480 --> 00:09:54,260
for a pentester guy to actually find subdomains

113
00:09:54,260 --> 00:09:56,100
that are there and might be exploitable.

114
00:09:58,020 --> 00:10:01,280
So not only pentester, but even if you are running a company,

115
00:10:01,480 --> 00:10:03,320
you are managing security for your company,

116
00:10:03,460 --> 00:10:04,460
you may check your parameter.

117
00:10:05,000 --> 00:10:08,220
Sometimes what happens is there are some legacy subdomains,

118
00:10:08,260 --> 00:10:11,460
like abcd.xyz.com, and you are not aware of them.

119
00:10:11,760 --> 00:10:15,320
So most of the time, legacy code is very much vulnerable to things,

120
00:10:15,460 --> 00:10:17,920
and it gets very easy to pop up a shell out of it.

121
00:10:18,260 --> 00:10:21,000
So it's probably worth a while checking all the domains

122
00:10:21,000 --> 00:10:21,460
which are lying around.

123
00:10:21,480 --> 00:10:25,280
And then we also source that domain

124
00:10:25,280 --> 00:10:28,480
for any WikiLeaks documents that are related to that domain.

125
00:10:28,700 --> 00:10:30,440
Then ZoomEye, similar to Shodan,

126
00:10:30,540 --> 00:10:33,040
gets all that IP-related information,

127
00:10:33,320 --> 00:10:34,940
the services that are running,

128
00:10:35,100 --> 00:10:38,280
the header information that gets returned from those IPs.

129
00:10:38,380 --> 00:10:41,060
Then the next module we have is an email.

130
00:10:43,080 --> 00:10:44,980
Yeah, it's the wrong one.

131
00:10:45,380 --> 00:10:46,400
Pause the username.

132
00:10:46,780 --> 00:10:47,000
Yeah.

133
00:10:47,760 --> 00:10:50,580
So let's say a username.

134
00:10:50,580 --> 00:10:51,540
You get a username.

135
00:10:51,740 --> 00:10:54,680
And so Keybase is a very good source of information

136
00:10:54,680 --> 00:10:58,020
where a user actually has to verify his own accounts.

137
00:10:58,300 --> 00:11:02,740
So the information you get here is actually the profiles

138
00:11:02,740 --> 00:11:05,900
that it belongs to the same user.

139
00:11:06,060 --> 00:11:09,320
So you won't find data that is mismatching

140
00:11:09,320 --> 00:11:11,240
or, let's say, false positives.

141
00:11:11,860 --> 00:11:14,500
So here, this might be a very good information

142
00:11:14,500 --> 00:11:17,780
to find out all that accounts that are listed for this user.

143
00:11:17,900 --> 00:11:19,860
So let's say you found this username previously

144
00:11:19,860 --> 00:11:21,220
on, let's say, a pastebin

145
00:11:21,220 --> 00:11:23,360
and has a username-password combination

146
00:11:23,360 --> 00:11:24,400
in a pastebin document.

147
00:11:24,620 --> 00:11:27,380
You can go ahead on these sites and try that out.

148
00:11:27,520 --> 00:11:31,420
So obviously, that opens up a very good opportunity for you.

149
00:11:31,960 --> 00:11:34,080
And another thing which this could be used is

150
00:11:34,080 --> 00:11:35,900
a lot of people verify their devices

151
00:11:35,900 --> 00:11:40,020
and they leave their device name as they are.

152
00:11:40,220 --> 00:11:42,480
So what happens is you can actually use those device names

153
00:11:42,480 --> 00:11:43,840
to launch a phishing campaign

154
00:11:43,840 --> 00:11:47,100
or trick the user to do something stupid.

155
00:11:53,700 --> 00:11:56,800
So as I mentioned, we also allow you to...

156
00:11:56,800 --> 00:11:57,520
Sorry, yeah, question.

157
00:12:01,980 --> 00:12:04,960
So it's like, we're not grabbing from anywhere else.

158
00:12:05,000 --> 00:12:07,780
The person generally verifies their devices on Keybase.

159
00:12:08,040 --> 00:12:09,680
So the Keybase have an open API.

160
00:12:09,780 --> 00:12:11,160
You don't even need authentication for that.

161
00:12:11,300 --> 00:12:13,100
So it's pretty easy to get it out.

162
00:12:14,580 --> 00:12:15,020
Sure.

163
00:12:15,280 --> 00:12:18,100
You're doing a lot of stuff with, like, public dumps

164
00:12:18,100 --> 00:12:19,320
and all the cross-correlation.

165
00:12:19,860 --> 00:12:21,820
How are you verifying that any of this data is still fresh?

166
00:12:22,120 --> 00:12:22,880
Okay, so yeah.

167
00:12:23,740 --> 00:12:24,060
Yeah.

168
00:12:24,880 --> 00:12:25,580
That's a valid thing.

169
00:12:25,720 --> 00:12:26,840
I mean, so as of now,

170
00:12:26,880 --> 00:12:29,480
we are completely relying on information which exists online.

171
00:12:29,660 --> 00:12:31,560
But I guess I'm just curious, like,

172
00:12:31,560 --> 00:12:33,680
are you doing active checks or are you just...

173
00:12:33,680 --> 00:12:34,440
As of now, no.

174
00:12:34,600 --> 00:12:35,380
As of now, no.

175
00:12:35,780 --> 00:12:37,560
Because, you know, we thought of doing that,

176
00:12:37,620 --> 00:12:39,580
but it becomes really tricky to verify

177
00:12:39,580 --> 00:12:41,220
because we will have to do a lot of correlation.

178
00:12:41,740 --> 00:12:43,460
We have to do match images and stuff.

179
00:12:43,640 --> 00:12:43,860
Yeah.

180
00:12:44,040 --> 00:12:45,400
So you make, like, a best effort.

181
00:12:45,560 --> 00:12:45,880
Yeah.

182
00:12:46,060 --> 00:12:47,680
Right now, we are making the best effort,

183
00:12:47,740 --> 00:12:49,420
but we are trying to work on those things.

184
00:12:49,860 --> 00:12:50,220
Yeah.

185
00:12:50,400 --> 00:12:50,980
Follow-up question.

186
00:12:51,680 --> 00:12:54,220
Are you doing anything to actively notify users

187
00:12:54,220 --> 00:12:55,640
that you're leveraging...

188
00:12:55,640 --> 00:12:55,800
Exactly.

189
00:12:55,880 --> 00:12:56,560
So if you...

190
00:12:56,560 --> 00:12:57,920
We'll be coming on the roadmap.

191
00:12:58,380 --> 00:12:59,620
Those things are in the roadmap,

192
00:12:59,740 --> 00:13:02,380
so you can schedule the things.

193
00:13:02,540 --> 00:13:02,900
I'm writing it out.

194
00:13:03,040 --> 00:13:03,280
Okay.

195
00:13:04,160 --> 00:13:05,540
No, we don't have, as of now.

196
00:13:06,160 --> 00:13:07,500
That's awesome that it's on your roadmap.

197
00:13:07,600 --> 00:13:07,980
That's fine.

198
00:13:09,220 --> 00:13:09,580
Yeah.

199
00:13:09,920 --> 00:13:10,920
So as I mentioned,

200
00:13:10,980 --> 00:13:13,280
we also support DataSploit as a library.

201
00:13:13,500 --> 00:13:15,520
So let's say if you do a simple import DataSploit,

202
00:13:15,620 --> 00:13:17,840
you have it available to use in your own Python project.

203
00:13:17,960 --> 00:13:19,740
And let's say if you do a DataSploit,

204
00:13:19,860 --> 00:13:21,840
I'll just show a quick demo for it.

205
00:13:22,520 --> 00:13:22,920
.username.

206
00:13:23,400 --> 00:13:24,900
That's our main module for...

207
00:13:24,900 --> 00:13:25,220
Oh, sorry.

208
00:13:25,700 --> 00:13:26,100
Username.

209
00:13:27,680 --> 00:13:29,960
And then let's say the module that's in there

210
00:13:29,960 --> 00:13:31,400
is called username underscore git scrape.

211
00:13:33,200 --> 00:13:33,600
Right?

212
00:13:33,640 --> 00:13:35,980
And then we have a main function for each module

213
00:13:35,980 --> 00:13:37,640
that needs to be implemented.

214
00:13:38,160 --> 00:13:40,020
And then you pass in the actual username.

215
00:13:40,060 --> 00:13:41,840
Let's say I'll pass in my colleagues.

216
00:13:42,160 --> 00:13:43,420
Oh, this is not going to use it.

217
00:13:43,800 --> 00:13:44,580
That might, yeah.

218
00:13:44,640 --> 00:13:45,200
That might use it.

219
00:13:45,460 --> 00:13:45,860
Yeah.

220
00:13:46,960 --> 00:13:47,700
Just single it.

221
00:13:47,760 --> 00:13:48,040
Single it.

222
00:13:50,020 --> 00:13:52,320
Oh, so user...

223
00:13:53,360 --> 00:13:53,760
Typo.

224
00:13:55,500 --> 00:13:55,900
User...

225
00:13:56,840 --> 00:13:58,020
What's happening to your keyboard?

226
00:13:58,340 --> 00:13:58,940
I don't know.

227
00:13:59,120 --> 00:13:59,920
You messed it up.

228
00:14:00,840 --> 00:14:01,720
You just messed it up.

229
00:14:01,760 --> 00:14:04,640
Okay, so he hasn't defined any API keys for it,

230
00:14:04,700 --> 00:14:06,560
but let's say if he had,

231
00:14:06,720 --> 00:14:08,860
you'll have that data returned to you

232
00:14:08,860 --> 00:14:09,980
in a native Python object,

233
00:14:10,080 --> 00:14:11,240
probably a dictionary, a list,

234
00:14:11,340 --> 00:14:13,460
whatever, you know, is relevant to that module.

235
00:14:13,660 --> 00:14:15,060
So for git scrape,

236
00:14:15,160 --> 00:14:18,020
you'll probably find the repositories that the user have,

237
00:14:18,160 --> 00:14:19,560
and in those, you'll find the commits.

238
00:14:19,860 --> 00:14:22,840
So you can find out which all are the most active,

239
00:14:22,960 --> 00:14:25,860
you know, repositories that the user contributes to,

240
00:14:25,920 --> 00:14:27,260
and probably in that, you can find something,

241
00:14:27,400 --> 00:14:30,220
you know, similar like a password username combination

242
00:14:30,220 --> 00:14:31,000
that might be there.

243
00:14:31,240 --> 00:14:31,480
Yeah.

244
00:14:32,580 --> 00:14:33,540
And then...

245
00:14:35,820 --> 00:14:37,260
The last one might be...

246
00:14:37,260 --> 00:14:38,040
So similarly,

247
00:14:39,020 --> 00:14:42,560
so rather than, you know, using the consolidated script

248
00:14:42,560 --> 00:14:45,120
called domain OSINT or even email OSINT,

249
00:14:45,300 --> 00:14:47,400
the individual modules themselves are callable.

250
00:14:47,480 --> 00:14:48,740
You can just say a Python domain,

251
00:14:48,940 --> 00:14:49,840
then the specific...

252
00:14:49,840 --> 00:14:50,960
the specific module that you need to call

253
00:14:50,960 --> 00:14:52,240
domain-subdomains.py,

254
00:14:52,420 --> 00:14:55,700
and then just pass in the domain name that's there,

255
00:14:55,820 --> 00:14:58,180
you'll find all the specific subdomains that are there.

256
00:15:00,820 --> 00:15:01,660
Quick question.

257
00:15:01,840 --> 00:15:02,080
Yeah.

258
00:15:02,180 --> 00:15:03,800
What are you using for your subdomain integration?

259
00:15:04,220 --> 00:15:05,860
What are your sources for your subdomains?

260
00:15:06,400 --> 00:15:07,700
Okay, so for subdomain,

261
00:15:07,720 --> 00:15:09,320
right now we are using DNS dumpster,

262
00:15:09,440 --> 00:15:10,520
we are using NetGraph,

263
00:15:10,660 --> 00:15:13,040
and we are using certificate transparency from Google.

264
00:15:13,400 --> 00:15:16,820
And we plan to introduce LDS walking later on,

265
00:15:16,920 --> 00:15:18,300
but that's in the plan.

266
00:15:23,340 --> 00:15:24,660
I have a question.

267
00:15:24,860 --> 00:15:25,340
Yeah.

268
00:15:25,400 --> 00:15:27,140
Do you guys ever run into problems with, like,

269
00:15:27,140 --> 00:15:28,140
connection limitations?

270
00:15:28,840 --> 00:15:29,160
Yeah, yeah.

271
00:15:29,220 --> 00:15:31,540
So most of the APIs might have a throttling there,

272
00:15:31,720 --> 00:15:34,480
so they obviously return, you know,

273
00:15:34,560 --> 00:15:36,580
rate limit exceeded, something like that.

274
00:15:37,020 --> 00:15:39,340
And here's this one script called emailOSINT.py.

275
00:15:39,920 --> 00:15:40,400
No?

276
00:15:40,840 --> 00:15:41,500
Okay, I'm sorry.

277
00:15:41,660 --> 00:15:42,760
Sorry, was that your...

278
00:15:42,760 --> 00:15:43,620
what you were asking?

279
00:15:43,940 --> 00:15:46,560
Are you making an effort to subvert that?

280
00:15:47,500 --> 00:15:48,800
So we can't,

281
00:15:48,800 --> 00:15:49,680
but obviously we can, you know,

282
00:15:49,840 --> 00:15:51,600
get in touch with the, you know,

283
00:15:52,720 --> 00:15:53,080
specific...

284
00:15:53,080 --> 00:15:53,760
Yeah, exactly.

285
00:15:54,420 --> 00:15:55,740
So about the emailOSINT,

286
00:15:56,900 --> 00:15:57,780
this is what we do.

287
00:15:59,000 --> 00:15:59,560
Yeah, so...

288
00:15:59,560 --> 00:16:00,320
So the very first thing,

289
00:16:00,340 --> 00:16:01,820
it will check for some basic things.

290
00:16:02,020 --> 00:16:04,220
For example, if you are running a phishing campaign,

291
00:16:04,400 --> 00:16:06,460
it will tell you whether it's a disposable email or not,

292
00:16:07,220 --> 00:16:09,100
whether this domain can receive emails or not.

293
00:16:09,200 --> 00:16:10,560
So if you are trying to send emails,

294
00:16:10,700 --> 00:16:11,680
it will tell you those things.

295
00:16:12,120 --> 00:16:14,440
It will tell you search information from Clearbit.

296
00:16:14,600 --> 00:16:15,820
It will tell you a bunch of information

297
00:16:15,820 --> 00:16:16,920
about the person, the name,

298
00:16:17,060 --> 00:16:18,400
the tentative location,

299
00:16:19,000 --> 00:16:20,880
or the profile, or whatever things.

300
00:16:21,120 --> 00:16:22,500
So as mentioned by you,

301
00:16:22,700 --> 00:16:24,760
so for an email, you get the true name that's there,

302
00:16:24,900 --> 00:16:26,280
the usernames that are there.

303
00:16:26,700 --> 00:16:28,060
Then it goes to full contact.

304
00:16:28,160 --> 00:16:29,740
We are not relying on just one source.

305
00:16:29,840 --> 00:16:31,100
There are other sources called full contact.

306
00:16:31,300 --> 00:16:32,100
We're using them.

307
00:16:32,200 --> 00:16:32,860
It tells you the name.

308
00:16:33,000 --> 00:16:35,720
It tells you the designation of the person,

309
00:16:35,800 --> 00:16:36,340
social profiles.

310
00:16:36,860 --> 00:16:38,900
We have got, like, 500 profiles,

311
00:16:39,000 --> 00:16:39,720
which we check for.

312
00:16:40,680 --> 00:16:41,960
But we are trying to get more.

313
00:16:42,460 --> 00:16:43,280
And then Twitter,

314
00:16:43,800 --> 00:16:45,660
and it will download all the images

315
00:16:46,520 --> 00:16:48,000
from these respective places.

316
00:16:48,000 --> 00:16:49,560
What you can do is you can use these images

317
00:16:49,560 --> 00:16:51,760
to do Google reverse image search and stuff.

318
00:16:52,000 --> 00:16:53,260
So you can get more information.

319
00:16:53,520 --> 00:16:55,320
Then it goes and checks on have I been pawned,

320
00:16:55,320 --> 00:16:57,380
whether this email ID was a part of a compromise or not.

321
00:16:57,600 --> 00:17:01,400
So as you see, my email ID was part of three compromises.

322
00:17:01,500 --> 00:17:04,120
So what you can do is you can go back to, you know,

323
00:17:04,180 --> 00:17:07,020
other places where you can get these database dumps.

324
00:17:07,040 --> 00:17:09,380
You might get correct thread hashes or passwords.

325
00:17:09,700 --> 00:17:10,920
And then there might be chances

326
00:17:10,920 --> 00:17:12,440
that I'm using the same password somewhere else.

327
00:17:12,520 --> 00:17:14,100
So it gets an easy win.

328
00:17:14,860 --> 00:17:17,780
It checks for paste on other places.

329
00:17:18,000 --> 00:17:19,160
So right now my API is expired.

330
00:17:19,400 --> 00:17:19,680
So, yeah.

331
00:17:20,180 --> 00:17:21,160
And then skip documents.

332
00:17:21,160 --> 00:17:22,300
So that's probably what you were asking, right?

333
00:17:22,920 --> 00:17:23,620
Slide shares.

334
00:17:23,640 --> 00:17:25,780
When API send us a forbidden.

335
00:17:26,480 --> 00:17:26,900
Slides.

336
00:17:26,900 --> 00:17:28,380
Any slides which I published

337
00:17:28,380 --> 00:17:31,340
and, you know, associated subdomains for me.

338
00:17:31,460 --> 00:17:32,360
So this is the information

339
00:17:32,360 --> 00:17:34,220
which you are getting from email ID.

340
00:17:34,540 --> 00:17:35,440
I think that's it.

341
00:17:35,480 --> 00:17:37,000
That's what we have for the demonstration.

342
00:17:38,520 --> 00:17:40,540
We have a Twitter account called DataSplit

343
00:17:40,540 --> 00:17:43,340
where we post in tweets and announcement about this.

344
00:17:43,600 --> 00:17:45,020
The same feed goes into Facebook.

345
00:17:45,040 --> 00:17:45,560
Facebook also.

346
00:17:46,720 --> 00:17:47,840
This is a small roadmap.

347
00:17:48,000 --> 00:17:49,760
Which we think of.

348
00:17:49,800 --> 00:17:50,360
We plan to.

349
00:17:50,580 --> 00:17:51,480
We are not lazy.

350
00:17:51,760 --> 00:17:52,800
We'll try to get this coded.

351
00:17:53,920 --> 00:17:55,260
It's like an ad hoc tool.

352
00:17:55,460 --> 00:17:56,860
So you run it as and when you want.

353
00:17:56,980 --> 00:17:58,920
So probably you want to integrate it with automated tools.

354
00:17:59,020 --> 00:17:59,880
So you want, let's say,

355
00:18:00,480 --> 00:18:01,700
incremental change that's happening

356
00:18:01,700 --> 00:18:03,740
to find out the difference between a previous run

357
00:18:03,740 --> 00:18:04,960
and a next run, right?

358
00:18:05,200 --> 00:18:05,400
Yep.

359
00:18:07,040 --> 00:18:07,360
Yeah.

360
00:18:07,380 --> 00:18:08,460
I don't know if this is a dumb question or not.

361
00:18:08,540 --> 00:18:09,900
Do you plan to integrate

362
00:18:11,380 --> 00:18:14,760
any kind of a multi-go platform or anything like that?

363
00:18:14,880 --> 00:18:15,340
Yeah, we can.

364
00:18:15,520 --> 00:18:16,400
I mean, we can.

365
00:18:16,600 --> 00:18:17,240
What we can do.

366
00:18:17,300 --> 00:18:17,840
I mean, there's no.

367
00:18:18,000 --> 00:18:19,280
There's no point writing the same code for multi-go

368
00:18:19,280 --> 00:18:20,980
because any of you are writing in our tool.

369
00:18:21,080 --> 00:18:21,860
What we can do is

370
00:18:21,860 --> 00:18:24,800
we can write code which generates an output

371
00:18:24,800 --> 00:18:26,520
which could be directly used by multi-go.

372
00:18:26,620 --> 00:18:27,760
I mean, that would be a better way.

373
00:18:27,940 --> 00:18:29,820
Otherwise, there's no point reinventing the wheel, right?

374
00:18:30,280 --> 00:18:32,280
So, yeah, we can work on that line.

375
00:18:32,700 --> 00:18:34,940
So far, the tool has been covered on multiple places,

376
00:18:35,340 --> 00:18:36,940
but I don't want to brag about it right now.

377
00:18:37,040 --> 00:18:37,100
Yeah.

378
00:18:37,480 --> 00:18:40,780
But the point what I wanted to raise

379
00:18:40,780 --> 00:18:42,060
is how you can contribute.

380
00:18:42,220 --> 00:18:42,820
You can test the tool.

381
00:18:42,920 --> 00:18:43,960
You can write blogs about the tool.

382
00:18:44,860 --> 00:18:46,020
You can promote the tool.

383
00:18:46,140 --> 00:18:47,460
So now, since it's a framework,

384
00:18:47,460 --> 00:18:49,920
we, you know, encourage you to actually

385
00:18:49,920 --> 00:18:51,620
go through the framework that's there

386
00:18:51,620 --> 00:18:53,260
and actually implement the function.

387
00:18:53,400 --> 00:18:56,020
So, you know, write modules, send us a pull request.

388
00:18:56,100 --> 00:18:57,120
We'll try to integrate it there.

389
00:18:58,300 --> 00:18:59,680
So, we are the core contributors.

390
00:18:59,820 --> 00:19:00,280
I'm Shubham.

391
00:19:00,360 --> 00:19:02,460
So, Dhanushu, Kunal, and Nuthan is missing.

392
00:19:02,560 --> 00:19:03,560
He's in the other room.

393
00:19:04,320 --> 00:19:05,480
And if you've got any questions,

394
00:19:05,720 --> 00:19:06,580
please shoot.

395
00:19:08,040 --> 00:19:08,480
That's it.

396
00:19:08,540 --> 00:19:08,820
Thanks.

397
00:19:08,840 --> 00:19:08,920
Thank you.