Managed OSINT

From email address and social media websites like LinkedIn, details about the staff would be obtained. This would include -

• Employee full names, job roles, as well as the software they use.
• Obtain details about personal and corporate blogs
• Identify all social networks used by the target user or company.
• Obtain employee email addresses, telephone extension / mobile number details, personal interests from social media sites like Instagram, Twitter.

In this phase, we obtain details about the organisation and their staff using various online sources. This includes (and is not limited to)

• Use of multiple search engines such as Censys, Shodan, Google, Wayback machine, archives and cached search results. 
• Job postings on the corporate website as well as on job networks.
• Infrastructure Reconnaissance - Information such as network blocks, infrastructure components, websites, networks & DNS is collected from online sources.
• WhoIS, Domain Search Results such as registrant information, domain squatting.
• Review threat intelligence feeds related to the network blocks obtained.
• Web archive / time machine to obtain data posted in the past on the corporate website.
• Obtain data from past compromises, postings on Pastebin and GitHub.

• Corporate information from the official website and other online financial information databases
• Investments information, supply chain network partnerships and vendors, network providers, software in use, and other facilities. 
• Metadata information leakage from official documents released online. This information often contains staff usernames, software in use, installation paths of software in use and file system/operating system information. 

A complete address including building and postal code of the organisation including details of ownership (rental, owned, shared) from which it operates. This will also include any international offices or branches that are distributed geographically around the world.

Further, where possible information about the location of cameras, gates, fences, backdoors, anti-tailgating doors and other physical security measures that are posted online or that can be found via Google maps and other online resources. This includes data obtained from Google Street view as well.