Tuominen Sanna
Tuominen Sanna
Sanna Tuominen
Bachelor’s Thesis
Spring 2019
Information Technology
Oulu University of Applied Sciences
ABSTRACT
In the theory sections, this thesis considered the current state of OSINT and
evaluated its future. The popularity of OSINT is increasing, and the usage of
OSINT is expanding into new arenas. The main challenge with OSINT is the
trouble of finding the meaningful bits from massive data amounts. Hence, this
thesis introduced and demonstrated three OSINT solutions displaying the
nature and the differing attributes of the selected OSINT solutions. The study of
the solutions was conducted as a demonstration assessment, where the use
and the results of selected OSINT solutions were recorded and observed.
The thesis findings show that the range of OSINT solutions is wide and
scattered. The method of providing the results from OSINT data searches vary
significantly between solutions. Combining data from different OSINT solutions
for a comprehensive overview and analysis requires effort and use of multiple
disjointed solutions while lacking automation.
3
PREFACE
This thesis was done in Oulu during spring 2019. The topic for the study was
chosen based on the interest of the thesis worker. This thesis was written in
English as that was the primary language for the terminology around the subject
matter. Instructing teacher for the work was Eino Niemi, but support was also
received from Susanna Kujanpää, in initiating the thesis work, and Kaija Posio
for completing the thesis in English. I wish to thank all of you for your support,
and instructor Eino Niemi particularly for the trust and “free-hands” with the
thesis.
That said, it must be noted that none of this would have been possible without
the support from my family. The support, understanding, patience, and
encouragement I have received from my magnificent husband has been
invaluable throughout the study. Toni, you rock! Thank you.
Oulu, 6.5.2019
Sanna Tuominen
4
CONTENTS
ABSTRACT 3
PREFACE 4
CONTENTS 5
VOCABULARY 6
1 INTRODUCTION 7
1.1 Thesis Objectives and Research Questions 8
1.2 Research Methodology, and Limitations 10
1.3 Thesis Structure 10
2 DEFINITION OF OPEN SOURCE INTELLIGENCE 12
2.1 Sources of OSINT 12
2.2 Who needs OSINT? 18
2.3 Benefits and challenges of open source intelligence 20
2.4 Future of OSINT 23
3 STUDY OF OPEN SOURCE INTELLIGENCE TOOLS 26
3.1 Tinfoleak.com 27
3.2 Recon-ng 28
3.3 Maltego CE 30
3.4 Demonstration of the tools 32
3.4.1 Tinfoleak.com 32
3.4.2 Recon-ng 35
3.4.3 Maltego CE 45
3.5 Comparison of the tools 48
4 CONCLUSION 50
REFERENCES 53
APPENDICES 56
APPENDIX 1: Tinfoleak.com report of oamk_ouas user
APPENDIX 2: Installing recon-ng on VMware virtual server with ubuntu
APPENDIX 3: Maltego CE outputs from transforms run on oamk.fi domain
5
VOCABULARY
6
1 INTRODUCTION
The open source intelligence refers to all information and knowledge that can
be gathered from publicly available sources (1; 3, p.331; 2, p.129) and OSINT
has moved into the front of intelligence gathering disciplines (4, p.85). Open
source intelligence as a concept is old, as throughout the history societies have
valued available information over surrounding circumstances to derive better
conclusions (2, p.132). The gathered knowledge is critical as it often provides
an advantage over another, let it be a matter of solving a crime, winning a
battle, or succeeding better in business operations (4, p.85).
What has changed over time is the amount of available data and the methods to
collect it. When earlier open source intelligence focused on gathering
information from newspapers, public speeches, interviews, to name examples,
the data today is in the Internet and methodologies retrieving the data are
becoming much more sophisticated, technologically advanced and open for all.
7
(1) The use of OSINT is emerging to a wide range of different user groups such
as international organizations and corporate businesses (5)
The emerge of OSINT is a consequence of the following key drivers (2, p.132;
6, p.11-12):
Open source intelligence is a growing field in the security domain and beyond
(3, p.339). Hence, the topic is very current as a research area. To study open
source intelligence is meaningful also as future predictions forecast a further
rise of the OSINT (7). It is estimated that already now 80% of intelligence
comes from open sources (6). More focus should be turned into how to find the
best data and what is the best method to understand that information to derive
useful intelligence (6). As such, this thesis presents three OSINT tools to
demonstrate and evaluate their suitability for the purpose, aiming to provide a
good understanding and insight of possibilities and limitations of OSINT
solutions available today.
The objective of this paper is to study what open source intelligence is and to
demonstrate the use of selected OSINT tools. In the theory sections, this paper
also considers the current state of OSINT and evaluates its future. The
challenges of open source intelligence are also discussed. Overall, this thesis
aims to provide a good understanding on open source intelligence.
That said, the main research question of this thesis is formulated to encompass
the overall purpose of the study. The sub-research questions are then
formulated to divide the main research question into smaller entities for better
8
capturing the underlying contents in each, finally then bringing all together for
conclusions.
3b. What information can be collected by OSINT solutions and how the
information is provided?
9
1.2 Research Methodology, and Limitations
This study has limitations that should be considered when interpreting the
findings. The world of OSINT solutions is widespread and scattered, and the
biggest limitation of this study derives from that circumstance. This thesis can
only introduce and demonstrate a couple of available solutions to limit the scope
of the research. The limitation for the scope is required to conduct the study
within the available time and resourcing for the work.
It must also be noted that an assumingly large portion of OSINT solutions are
not accessible by a student and this should be acknowledged when considering
the findings. The world of OSINT solutions beyond this thesis might be at a
completely different level of what is presented here.
What should also be considered with the findings is that no API keys have been
acquired for the demonstrations performed in this thesis. The API keys would
allow more advanced data searches but are left out from the focus as the use of
them may reveal data that is out of scope of the demonstrations of this thesis.
10
findings of the study and summarizing the answers to the research questions.
The paper is finalized with suggestions for a future research in the topic area.
11
2 DEFINITION OF OPEN SOURCE INTELLIGENCE
The term open source intelligence is known to originate from military, security
and law enforcement agencies (3, p.331). There is a wide range of descriptions
and definitions provided to characterize open source intelligence, although with
a tendency of being broad and non-specific (4, p.87-89). Some view OSINT
more as a definition of ‘act’ to collect and process information from publicly
available sources (cf. 3, p.331), where some emphasize more the ‘outcome’ of
the data collection acts, i.e. the actual intelligence derived from the data
collection and analysis activities (cf. 2, p.129). The definitions of OSINT are
provided by academics and but also by different bodies utilizing the open
source intelligence. Hassan & Hijazi (1) provide one example based on the U.S.
Department of Defense’s definition of OSINT as follows:
The sources of intelligence in general can be divided into three different sources
(3, p.331-332) (figure 1.):
12
• Signal intelligence (SIGINT): intelligence gathered from different signal
intercepts, wire taps and similar.
• Human intelligence (HUMINT): intelligence from confidential human
sources.
• Open source intelligence (OSINT): intelligence gathered from publicly
available information.
From these three intelligence sources, OSINT is the only source where the
intelligence is gathered from publicly available sources. Sources and means to
gather SIGINT or HUMINT intelligence are often confidential (3). Best (3, p.331)
also highlights that during the last 10 years, there has been an enormous
growth in the OSINT area. Steele (2, p.129) adds that by applying OSINT more,
the use of other intelligence sources can be decreased as OSINT allows to
focus only on those questions that cannot be answered by open sources.
According to the NATO Open Source Intelligence Handbook (9, p.2-3), there
are four categories of open information and intelligence.
• Open source data (OSD) is raw data coming from a primary source, and
it can be a photograph, satellite image, or a personal letter (9).
• Open source information (OSINF) is comprised data, which has
undergone some filtering first. It can also be called a secondary source.
Newspapers, books, or daily reports as an example are part of the OSIF
world (2, p.132). Best (3, p.333) adds that OSINF data is not necessarily
free information but may include commercial subscription services and
13
commercial satellite imagery. To collect OSINF data, the best known
search engines such as Google are heavily utilized as main tools for the
purpose. CIA agents are said to gather 80% of intelligence from Google.
However, also dedicated web crawlers are developed to monitor web
sites of interest to detect and download updates on the pages. Most
blogs are available as RDD feeds allowing them to be monitored as well.
(3, p.333-338)
• Open source intelligence OSINT differs from the two above with its
ability to already answer to specific questions – it is the output of the
intelligence cycle. The open source material has been discovered,
filtered, processed to the extent that the processed information can be
used directly in the intelligence context. (9)
• Validated OSINT (OSINT-V) is one step further from the above where
the outcome of intelligence cycle is confirmed and verified by other,
possibly non-OSINT, sources. These validations are important in
ensuring that the open sources utilized in the intelligence process were
not misleading (9). The validation of the OSINT data can come from
supporting findings from confidential intelligence sources, of simply sheer
volume of same data publicly shared (e.g. same pictures all over the
Internet). (2, p.132).
Open source information consists of the following general categories (2, p.138):
To list all details of all possible sources for OSINT information today is rather a
consuming activity, yet the OSINT Framework provides a comprehensive
overview (figure 2.) (10)
15
FIGURE 2. An illustration of one fraction of possible OSINT sources (10)
As the volume of available data is expanding, also businesses are turning more
towards OSINT to gather market intelligence. The sources that businesses
utilize for OSINT are along the lines of the above listing but also entail the
company’s internal master data according to Fleisher (5, p.854). The company
master data refers to internal databases and systems (i.e. ERP, CRM) and
documents, such as minutes of meetings, business plans, reports, which bring
value to analyses when combined with external data sources. (5)
OSINT sources do not come alone from online sources as highlighted afore.
However, online sources comprise the largest segment of OSINT. In this
information age, most sources are turning their process into digital formats, not
forgetting the culture of sharing among Internet users. These days social media
sites are collecting a growing number of subscribers. A huge increase in volume
16
of data is expected also along the expansion of the Internet of Things (IoT) with
all sensors and equipment ending their data across the Internet. It is forecasted
that by 2020 there will be 20.4 billion IoT devices in use. Consequently, there is
a trend of most OSINT sources moving into online sources. (1)
The OSINT data collection can be on a small-scale with some targeted single
queries and a very large-scale OSINT that only larger organisations have
resources and capability to perform (e.g. CIA) (11).
A key with OSINT is to realize the difference between data, information and
knowledge; data is a set of facts (e.g. the price per potato kg $5), information is
a proper interpretation of data in a specific context (e.g. the price of potato kg
has raised from $5 to $7), and knowledge is a combination of information,
insight, and experience that could be used in similar contexts (e.g. when the
price of potato kg raises, the price of meat will raise too). (1)
17
2.2 Who needs OSINT?
From the above the government bodies are considered as the largest consumer
group of open source intelligence (3). The government uses OSINT for different
purposes, such as national security, counterterrorism, crime prevention, criminal
profiling, analysing domestic and foreign views and events on matters of
interest. They also use OSINT to support policy makers with supporting
information. (1).
Government bodies differ from the other OSINT user groups with their
possibility to combine OSINT intelligence with confidential intelligence they have
gathered by other means. Government bodies also tend to have more capacity
and resources for the data collection and analysis, compared to other user
groups, and this trend is also expected to continue in the future where
government bodies are seen putting even more focus and resources on OSINT.
Government organizations are also considered as best sources for OSINT
because of their resources and capability to derive an OSINT analysis. (1)
18
any other sources that may be providing analyses in favour of their own
interests. A good example of an international organization utilizing OSINT is
United Nations (UN) which uses OSINT for supporting peacekeeping operations
world-wide. (1)
Business corporations have also realized the power of information utilizing open
source intelligence in an ever-increasing manner. The rise of the OSINT among
this user group is explained by the Internet, and consequently the emerge of
available information, making OSINT available also for small businesses.
Earlier, it was possible only for businesses with the biggest budgets (5).
OSINT among business corporates is used for market and marketing activities
to investigate current and new markets, monitor competitors’ activities, evaluate
their operating environments and occurring trends and changes in it.
Businesses also use OSINT also for protecting against any data leakages
monitoring confidential data breaches, and for monitoring network behaviours
protecting against cyber threads. (5, p.852) Many private corporations have
developed advanced programs and techniques to gather data from public
sources for a commercial gain (1).
Penetration testers and black hat hackers utilize OSINT in a more targeted
manner. Their objective often is to gather intelligence about specific targets
online in preparation for penetration testing or social engineering attacks. (1)
Concerns of ordinary people’s online exposures and security of any private data
are guiding privacy-conscious people to utilize OSINT too. They utilize it for
monitoring their digital identities with the attempt of protecting their privacy. (1)
19
The typical cycle of intelligence gathering begins by identifying the need for an
additional insight, followed by planning of the activity and possible information
sources. The actual process then follows the pattern of (3, p.332-333):
In this information age, the benefits that open source intelligence provides
should not be underestimated, nor should the challenges of OSINT be
neglected. Like any other intelligence discipline, open source intelligence entails
both attributes. The benefits and challenges of OSINT are generally the same,
but with their own perspectives, for instance considering the volume of available
data; The amount of accessible data is in the core of OSINT benefits – the
whole emerge of OSINT is based on it. However, the same volume of data
enabling the open source intelligence is also its problem as the amount of data
is enormous creating true challenges to find meaningful bits from it, even for
professionals.
As the benefits of OSINT are mostly two-sided, the following table (table 1)
provides collections of OSINT elements describing in condensed manner all the
good that OSINT enable but displaying at the same the challenges that are
brought with the elements.
20
TABLE 1. The two-sided benefits and challenges of open source intelligence
Benefits of OSINT Challenges of OSINT
Volume of data
“The volume of available data translates in the “The sheer volume is daunting and separating
world of OSINT into ability to see, hear, know, meaningful information requires true effort to be
understand, decide, and act on ‘all information, all considered as valuable intelligence” (7).
languages, all the time’” (2, p.133)
“OSINT sources are always available, accessible, “The use of term ‘publicly available’ is misleading
and up-to-date, and can be utilized by different and open for interpretation as different user
parties to derive conclusions.” (1) groups do not have same authorization to all data
(military vs business as an example). Many data
“Information is always transparent, always open services and databases are open only for paying
access, always readily available, and treated more customers, and for restricted users and not
as a community resource than an individual available for wider public. One might also question
commodity” (12, p.679-680). whether it is ‘fair game’ collect personal data from
platform where users have shared their data
“Open information sources are not the exclusive behind ‘password’ -protection from the Internet.”
domain of intelligence staffs” (2, p.129). (4, p.87-89)
Reliability
“OSINT has one advantage over the other “OSINT sources, especially when used in the
sources: its exposure to millions of pairs of intelligence context, need to be verified thoroughly
eyeballs. As it commonly understood in the open by classified sources before they can be trusted”
source software world, put enough eyeballs on it (1).
and no bug is invisible. OSINT also offers
analytics frames of reference that have stood the “OSINT sources can also be manipulated to
test of time. This differentiates OSINT from other broadcast inaccurate information misleading
intelligence sources.” (2, p.139). OSINT outcomes” (5, p.856-857)
Cost-effectiveness
“Collecting OSINT is generally less expensive “Humans need to view the output of automated
compared with other intelligence sources. For tools to know whether the collected data is reliable
instance, using human sources or spying satellite and trustworthy; they also need to compare it with
to collect data is costly. Small businesses with some classified data (this is applicable for some
limited intelligence budgets can exploit OSINT military and commercial information) to assure its
sources with minimal costs.” (1) reliability and relevance. This will effectively
consume time and precious human resources.” (1)
“OSINT products can reduce the demands on
classified intelligence collection resources by “Constant changes in sources and content of the
limiting requests for information only to those sources require ability to archive targeted data for
questions that cannot be answered by open subsequent processing that requires applications,
sources” (2, p.129). time and effort from analysts, and cost of
additional memory resources” (5, p.856-857).
21
Ease of OSINT technologies
“Unlike other intelligence sources that may require “There is no one offering that meets the need for a
using spy satellite images or secret agents to fully integrated OSINT analyst toolkit. This is
collect information, all you need to gather OSINT partially because of the lack of agreement on
online resources is a computer and an Internet standards in the part, and partly because the lack
connection” (1). of coherence in government and corporate
contracting, there the emphasis has been
hardware and proprietary software instead of
generic functionality and ease of data integration.”
(2, p.138).
“OSINT resources can be shared between “OSINT has its legal concerns for instance in a
different parties without worrying about breaching case where someone acquires OSINT sources by
any copyright license as these resources are illegal means to justify an honest case, or when
already published publicly” (1). the OSINT sample is minimized or selected
according to the collector’s need effectively
discarding important sources purposely in favour
of bringing about a specific outcome.” (1)
The challenge that OSINT has yet to overcome is its equal standing between
other forms of intelligence. Wells and Gibson (4, p.86.) report OSINT
sometimes having a difficulty in being taken seriously. Whether being taken into
consideration with well-deserved seriousness or not, OSINT has a bidirectional
relationship with other intelligence disciplines providing a very robust foundation
for other intelligence disciplines enabling an alternative source to validating
findings generated by other means (2, p.129). This also works other way around
when other intelligence disciplines validate findings generated through open
source intelligence.
One major element with OSINT is the language. In order to utilize global data
interpreting properly sources in different languages translation capacity is
required. The translations also need to meet certain quality standards to enable
deriving any conclusions. This multilingual source environment creates a strong
need for translation skills and knowledge of cultural nuances. (5)
22
2.4 Future of OSINT
As open source intelligence is still quite young as a distinct practice, it faces few
challenges. First, there is the issue of scale. Compared to traditional broadcast
media, OSINT projects are still very small and the growth might not come easily
for many projects. Second, there is an issue of economics. Most OSINT
projects are pure volunteer projects and resources are donated. The Internet
economy does not necessarily make it easier to raise funds, which becomes
more important as the projects grow in size and the infrastructure/bandwidth
needs increase. Compared to traditional production and publishing models,
OSINT projects are outside of the traditional economy, thus new ways of
financing OSINT projects need to be found. It is likely that OSINT projects will
develop into a model of involving direct revenues (e.g. subscription,
advertisement), goodwill donations and volunteer efforts. Despite the
challenges of OSINT, there are strong believers in its future because it is
becoming the mainstream to process and learn from bigger data amounts,
OSINT tools and methods are becoming better known, and the threshold of
using them is getting lower. (13, p.9)
The use of OSINT within the military domain is expected only to increase. The
military cannot neglect the amount of information available online but will
continue to embrace the easy access to such information source. OSINT is also
seen as a prominent part of also e.g. NATO’s future vision. Intelligence based
on open, unclassified information is easy to develop and share between
member states and international operations, for organizations like NATO. With
OSINT intelligence there is no risk of sharing or revealing any confidential
23
intelligence collections methodologies. OSINT will continue to have a strong
role also in supporting the classified intelligence production. It has been stated
that “The Internet is now the default Command and Control, Communications,
Computing, and Intelligence (C4I) architecture for virtually the entire world (2,
p.129.)”.
That said, it reads that the focus is turning towards the available technologies to
produce intelligence from open sources. Steele (2, p.131) states that the focus
should be turned from maintaining a collection of open source materials into a
viable collection of OSINT sources: what are the best sources to be utilized to
answer certain questions, and what tools should be used to provide the best
search methods.
The growing data amounts require advanced software tools to allow coping with
the overflow of information (3, p.331). The development activities around the
OSINT arena are, however, dispersed as the emerging field of OSINT is made
up of numerous, independent projects (13, p.2), and also the number of
developers and marketers is growing in the commercial sector (5). There are
also new initiatives around the subject area from which the EUROSINT Forum
is one good example. The EUROSINT forum was established in 2016 for
coordinating EU level development activities on OSINT between government
agencies and businesses (14). The research community is also increasingly
putting focus on developing tools and techniques to support the OSINT process
(3, p.332). Best (3) predicts that the future research trend will also focus on
24
techniques to visualize a summary of textual information providing a better
insight from open source intelligence.
25
3 STUDY OF OPEN SOURCE INTELLIGENCE TOOLS
This chapter introduces and demonstrates three OSINT tools for gathering
intelligence from open sources. The set of selected tools presented here is a
good example of how OSINT tools differ from each other. The solutions
represent different types of OSINT applications, providing a wider view on the
scale of available OSINT solutions. The range of OSINT solutions is generally
very broad – solutions may be designed to focus only on single queries,
whereas more powerful OSINT solutions have an ability to perform inquiries of a
much larger scale (11).
Many of the larger scale OSINT solutions are custom made and designed with
huge budgets for governments and giant companies, and accessible naturally
only by the owner of the solutions. These solutions are powerful with automated
processes, with artificial intelligence and advanced filtering technics (1).
Consequently, the access to such solutions is restricted. However, the number
of tools and resources generally accessible by public is also remarkable
allowing for powerful searches (15).
However, as stated in the previous chapter, critical for the future of OSINT is the
capability of the tools for data search and analysis processes, and therefore it is
important to study and evaluate the solutions. Steele (2, p.138) concludes that
there is currently no solution that would comply with all fully-integrated-analyst-
toolkit requirements (exception larger organizations) and as a solution,
Glassman and Kang (12, p.679) provide that users may need to establish their
own sets of tools.
The demonstrated tools in this thesis are accessible by any Internet user. The
following paragraphs introduce each of the tools individually. The individual
introductions of the tools are followed by an actual demonstration of the
solutions. The Chapter 3.5 then summarizes the findings and compares the
solutions with each other.
26
3.1 Tinfoleak.com
To fetch user related data from Twitter with Tinfoleak, only a Twitter username
of the user of interest is required, and that is public information. As a result of a
query, Tinfoleak provides a detailed report on the Twitter user. The report
provides basic information (e.g. name, picture, location, followers) of the user
and information on devices, operating systems, applications and social
networks used by the Twitter user, place and geolocation coordinates of
locations visited by the Twitter user, allowing to download all pictures from a
Twitter user, showing also all hashtags, and topics used by the Twitter user
(with date and time), and also who the Twitter user has mentioned in their
27
tweets. Tinfoleak also utilizes the geo information from tweets and images
locating the places where the user has been tweeting. (16)
3.2 Recon-ng
Recon-ng is included in Kali Linux and is operated via Terminal in Linux (figure
4.)(18).
28
The list of build-in reconnaissance tools of Recon-ng is relatively long
containing currently 75 recon-, 8 reporting-, 2 importing-, 2 exploitation, and 2
discovery modules (figure 5.).
29
FIGURE 5. Available modules in Recon-ng
If one would like to perform any advanced reconnaissance with Recon-ng, the
API keys would be required for the tool. The API keys would allow listing all
server-side technologies, discover vulnerabilities and implemented technologies
with configurations, identify weaknesses in physical security, and search for
credentials. (17)
3.3 Maltego CE
From the two already introduced OSINT solutions, Maltego is the most powerful
tool providing also visual graphs of the findings and a link analysis between the
found records. The version of Maltego used in this thesis is Maltego CE.
Maltego CE is the community version of Maltego which is available for free after
an online registration. There are three versions of the Maltego available;
Maltego CE, Maltego Classic and Maltego XL, from which the Maltego CE is the
limited version from the other two commercial versions. The limitations apply to
a maximum number of findings displayed per inquiry and to restrictions of graph
export capabilities. Maltego is developed by a South-African company called
Paterva in 2008 and they claim to have 500,000 registered community users
and commercial clients from various industries; from law enforcement and
intelligence agencies to finance and banking. (20)
30
The strength and beauty of Maltego CE comes from its capability to identify
real-world relationships between the records it finds from various publicly
available data sources in the Internet. Maltego CE visually displays the findings
for the user allowing an easy interpretation of the results making the patterns
obvious. Maltego can query the Internet infrastructure (e.g. domains, DNS
names, netblocks, IP addresses), search information about people (e.g. names,
email addresses, aliases) and organizations. Maltego inquires these information
sources through whois records, search engines, social networks, online APIs
and from metadata. (20)
Maltego is an application which one must install locally. It uses Java and hence
runs on Windows, Mac, and Linux. Maltego CE also comes readily with Kali
Linux. Maltego comes with multiple different data partners in the solutions that
can be used to extend the data search capability (20). The user interface of
Maltego is clear, intuitive and easy to use (figure 6.).
31
3.4 Demonstration of the tools
The demonstration of the selected OSINT tools in this thesis was conducted
using Oamk.fi as an example case. The idea is to show what basic data can be
collected with OSINT tools of the subject of interest and how the data is
collected. The focus in this chapter is on showing how the tools are operated
and how the findings are displayed, rather than actively seeking and revealing
any vulnerabilities from Oamk.fi.
Oamk.fi acts as a starting point for the demonstration. It is the only data that is
needed for the tools to move forward with investigations. The demonstrations in
this chapter start from Tinfoleak, moving onwards to the use of Recon-ng, and
finalizing with Maltego CE demonstration.
3.4.1 Tinfoleak.com
FIGURE 7. Using a search engine to find Oamk’s official Twitter account name
The next step is to go to Tinfoleak.com and perform a query based on the found
Oamk Twitter user name; oamk_ouas. It is mandatory to provide an email
address for Tinfoleak to receive a link to the outcome of the query (figure 8.).
32
FIGURE 8. Requesting the report on oamk_ouas Twitter account
fromTinfoleak.com
The length of the Tinfoleak.com report varies per user depending on their
activity within Twitter. In case of oamk_ouas, the length of the report is
approximately 27 pages (A4 size) (APPENDIX 1.). The following paragraphs
show screenshots of the report to keep the length of this chapter reasonable.
33
The report lists hashtags which have been used in the Tweets (with date, time,
likes, and further details), hashtag details containing statistics per each hashtag
that has been used, a list of users that have been mentioned in the in the
Tweets, and details on the user mentions, including the top user mentions in the
tweets. The Tinfoleak report also provides user images and videos, not
forgetting geo-location information of the tweets if geo-location of the user is
enabled. It will also provide top locations for the tweets if available.
Based on the report, one can learn from oamk_ouas’s user equipment and
interfaces used for Tweets. The tweets are done with iPhone, Twitter Web
Client, TweetDeck or Twitter Web App (figure 10.). It is also visible in the report
that tweets have been done from Oulu, Finland, and Stavanger, Norway.
It is also interesting to see who Twitter user mentions in their Tweets. In case of
oamk_ouas, there are 150 users mentioned in the tweets altogether (figure 11.).
Now, one can imagine that in case of looking at individual person’s profile, this
report certainly allows to start understanding the social networks of the Twitter
users.
34
FIGURE 11. A partial screenshot of the list that users of oamk_ouas have been
mentioning in their tweets
3.4.2 Recon-ng
Recon-ng is used in this demonstration with its basic setup, meaning that after
installation no additional features or API keys are installed to the tool. The
installation process, environment, and set-up of the Recon-ng used in this
thesis are described in the APPENDIX 2.
The first step with Recon-ng before commencing data searches is to create a
workspace where the findings are collected. This can be done with the following
steps in terminal:
Adding a workspace
To start using the oamk.fi workspace, the following commands are used,
followed by commands to add oamk.fi as a domain of interest for that
workspace (figure 13.):
• recon/domains-contacts/whois_pocs
• recon/domains-hosts/bing_domain_web
• recon/domains-hosts/brute_hosts
36
• recon/domains-hosts/google_site_web
• recon/hosts-hosts/resolve
• recon/hosts-hosts/reverse_resolve
• discovery/info_disclosure/interesting_files
RECON/DOMAINS-CONTACTS/WHOIS_POCS
Checking contact info per domain using whois_pocs. Whois_pocs uses the
ARIN Whois RWS to harvest POC data from whois queries for the given
domain. This updates the recon-ng 'contacts' table with the results. Running
Whois_pocs to search Oamk.fi does not find any contacts (figure 14.), thus
moving on to the next query.
RECON/DOMAINS-HOSTS/BING_DOMAIN_WEB
37
[The list not pasted here due its length]
RECON/DOMAINS-HOSTS/BRUTE_HOSTS
Brute_hosts can be used to force host names using DNS. This updates the
Recon-ng 'hosts' table with the results. As a result, it finds 52 new hosts, the
38
overall result now totalling to 83 hosts found proving some host and IP
addresses information on oamk.fi (figure 16.).
39
FIGURE 16. Results of searching oamk.fi with brute_force module
RECON/DOMAINS-HOSTS/GOOGLE_SITE_WEB
40
RECON/HOSTS-HOSTS/RESOLVE AND REVERSE_RESOLVE
41
FIGURE 18. Hosts updated with IP addresses by using Recon/hosts-
hosts/resolve
The overall result after these five queries on oamk.fi hosts and IP addresses is
101 entities (figure 19.). To move forward to find, for instance, geolocation
information for the collected hosts, some API keys would be required, thus the
demonstration is finalized here. It is believed that this demonstration is
adequate to show how to operate Recon-ng and complete some information
gathering.
42
43
FIGURE 19. The complete table of ‘host’ records after conducting the last recon
with Recon/hosts-hosts/resolve
DISCOVERY/INFO_DISCLOSURE/INTERESTING_FILES
To give one more example of Recon-ng, this demonstration also shows how to
check any related interesting files. Module ‘interesting_files’ with Recon-ng
checks hosts for interesting files in predictable locations. The files can be in a
format of robots.txt, sitemap.xml, sitemap.xml.gz, crossdomain.xml,
phpinfo.php, test.php, elmah.axd. server-status, jmx-console/, admin-console/,
web-console/. As a result, Recon-ng finds 21 interesting files (figure 20.).
44
3.4.3 Maltego CE
Once Maltego is installed, the application is ready for use. Similarly, as with
Recon-ng, Maltego can perform more powerful queries if the user is able to
provide API keys. However, in these demonstrations no API keys are fed into
the system, and queries are performed with the basic setup.
After the selected transformations are run (in this demonstration, all that was
possible without API keys), Maltego CE displays the results on the
graph/canvas as an illustration. The details for each record can be viewed on
the side bar of the Maltego user interface by activating the record of interest.
The transformations that were run, together with their results, are also provided
in a written list format in one of the sub-windows on the user interface. For the
oamk.fi domain search, there were altogether 142 notions on run
transformations (APPENDIX 3). The graph created from the oamk.fi domain
45
search is shown in the below figure (figure 21.). Each different icon in the graph
illustrates a different type of finding, whether it is a linked domain, IP address,
DNS name, netblocks, NS record, MX record (mail exchanger record), email
address, person, phone number, webpage, or linked organization or company.
Maltego found 64 linked records simply based on the domain name oamk.fi.
The user can choose any of the displayed records to drill-down further and find
additional data. This is done simply by clicking on a record and running the
transformations again (commands can be found by mouse right-click). The
records that are found are drawn to the graph as extensions (figure 22.). Links
between records are identified with arrows.
46
FIGURE 22. Extending the search from found records in Maltego CE
It should be noted that the user can also choose the style of the displayed
graphs. The same data can be shown in multiple different formats with Maltego
(figure 23.).
FIGURE 23. Different format of displaying the records and the links between
them in Maltego
47
It must be noted that Maltego can perform more extensive searches as well
when all API keys and all possible transforms would be enabled. The Maltego
tool contains a hub for the reviewing and adding an additional transformation
capacity in the solution (figure 24.).
The following table (table 2.) is comparing the solutions with the selected
attributes that were found meaningful for the comparison and describing the
differing nature of the solutions.
48
Operating Web-based Linux Windows, Mac, Linux
platform
Type of inquiries Automated Command line Automated, GIU
based
Type of inquiry Passive Semipassive-Active, Semipassive-Active,
method depending on used depending on used
query method within query method within
the tool the tool
Scale of Single-inquiry at once Medium, collects Large-scale
inquiries results from multiple automated queries
queries together, but
each query must be
run individually
Provided data Narrow – provides data Large, can fetch data Large, can fetch data
set on individual Twitter from multiple from multiple
user different sources different sources
utilizing multiple utilizing multiple
different search different search
methods methods
Format of HTML report with listing Text view Visual graph of all
results of details summarizing all found records and
findings per category their links with other
(export to CSV and found records
HTML possible)
Main benefits +Quick and easy to use +Range of available +Visual illustration of
+Good overview on searches the results
individual user +Open-source, free +Illustration of the
to use links between
+Strong community records
of supportive users +Multiple searches
performed at once
Main Challenges -Limited to single -Requires -Commercial version
queries familiarization and chargeable
reading through
tutorials to get
started
-Only Linux-based
49
4 CONCLUSION
The availability and the quality of the nets tossed out into the ocean of
information, including the how fine the mesh, are critical to the search
process. (12, p.678)
The objective of this thesis was to study what open source intelligence is and
demonstrate the use of selected OSINT tools. In the theory sections, this paper
considered the current state of OSINT and evaluated its future. The main
research question of this thesis was formulated to encompass the overall
purpose of the study and it was further divided into sub-research questions for
capturing the underlying contents in each. Finally, they all were brought for
conclusions. Hence, in this chapter the conclusions are drawn moving from sub-
research questions towards the main.
50
solutions that are possibly accessible without any further authorizations or
payment fees. The questions were:
3b. What information can be collected by OSINT solutions and how the
information is provided?
This thesis introduced and demonstrated three available OSINT solutions and
displayed to some extent the nature and the differing attributes of available
solutions. The range of the OSINT solutions seems to be rather wide and there
are no standardized approaches to build up such applications. However, each
of the solutions did their assigned part in the data search function and that leads
to the main research question of the study:
The presented OSINT applications certainly found information from the subject
of the search. The searches were also automated so that searches performed
the data retrieval they were designed to do. None of the tools however provided
access or visibility to modify any search logic within the tools (Recon-ng might
be an exception), hence optimizing the searches for the user’s tastes was not
possible.
The wide range of the solutions and their disjointedness became rather obvious
based on this study. Each performs their own tasks, in their own designed way,
providing their results in their own way. Combining the data from different
OSINT solutions for a comprehensive overview and analysis is a challenge at
least to some extent. Where Steele (2, p.138) concluded that there is currently
no solution that would compline with all fully-integrated-analyst-toolkit
requirements (exception larger organizations), it seems to be the case based on
the findings of this study as well. Glassman and Kang (12, p.679) conclude that
users may need to establish their own sets of tools, and this would be
51
supported by the findings of this study as well. The word ‘set-of-tools’ might be
the key in the OSINT arena due to the disjointedness of separate solutions.
Interestingly, Hassan & Hijazi (1) argued in the theory chapters that
semipassive and active data collection methods are not usually seen in OSINT
as they can be seen infringing the essence of open source intelligence. The two
of the used OSINT tools in this thesis were characterised as semipassive or
active, hence one could argue these not being compliant OSINT solutions at all.
I could assume that quite many of the OSINT solutions available in the market
are in this grey area – what is the “openness” of the data they acquire and is it
collected by utilizing only passive methodologies?
How did the applications help in understanding the retrieved information varied
per solution – mostly the found records were simply listed and the conclusions
were left for the user, whereas the most advanced solution in representation of
results visually aided the user to understand linkages between different data
records. The visualization of the findings should be where to put focus on with
the OSINT solutions development in the future. Supported also by Best (3), the
focus of the future research in this OSINT arena should be on techniques of
visualizing summaries. The future focus should also be put on individuals’ skills
on data search and processing, whether it is for the ability to utilise the available
OSINT solutions better, but more so for an ability to develop more sophisticated
OSINT solutions in the future.
As a final note for the study, it could be concluded that the importance of OSINT
contributing to our understanding of the world in this era of information age is
becoming rather fundamental.
52
REFERENCES
1. Hassan N.A., Hijazi R. 2018. The Evolution of Open Source Intelligence. In:
Open Source Intelligence Methods and Tools. Apress, Berkeley, CA
53
9. NATO Open Source Intelligence Handbook (2001). Date of retrieval
5.5.2019.
https://archive.org/details/NATOOSINTHandbookV1.2?q=NATO+Open+Sou
rce+Intelligence+Handbook+V1.2
11. Raittila, A. 2010. OSINT verkossa eli laillisen nettitiedustelun perusteet. Date
of retrieval 15.3.2019. http://nettibisnes.info/osint-verkossa-eli-laillisen-
nettitiedustelun-perusteet/
12. Glassman, M., & Kang, M. J. 2012. Intelligence in the internet age: The
emergence and evolution of Open Source Intelligence (OSINT). Computers
in Human Behavior, 28(2), 673-682.
13. Stalder, F. & Hirsh, J. 2002. Open Source Intelligence. First Monday, Vol
7(6). ISSN 13960466. Date of retrieval: 15.4.2019.
https://ojphi.org/ojs/index.php/fm/article/view/961/882
19. Wonderhowto (29.3.2016). NULL Byte: Hack like a pro. Date of retrieval
4.5.2019. https://null-byte.wonderhowto.com/how-to/hack-like-pro-
reconnaissance-with-recon-ng-part-1-getting-started-0169854/
54
20. Paterva (N/A). Maltego CE. Date of retrieval 27.4.2019.
https://www.paterva.com/web7/buy/maltego-clients/maltego-ce.php
55
APPENDICES
56
APPENDIX 1/1
Client Applications
Total: 4 results.
Social Networks
APPENDIX 1/2
Total: 1 results.
Hashtags
Hashtags in Tweets
Profile
Date Time RT's Likes Tweet User Location #Hashtags
Img
#vappu #kesääkohti
04/30/2019 10:20:12 1 4 view @oamk_ouas Oulu, Finland
#munkkiajasimaa
Oulu,
04/04/2019 12:51:20 4 7 view @ErjaSormunen #sote
Työterveyslaitos
#oamk #epooki
04/03/2019 10:08:29 0 1 view @oamk_ouas Oulu, Finland
#musiikkipedagogit
#minnacanthinpäivä
03/19/2019 08:03:57 1 2 view @oamk_ouas Oulu, Finland
#tasaarvo #oamk #koulutus
#viitearkkitehtuurityö #oamk
03/12/2019 13:11:26 1 2 view @oamk_ouas Oulu, Finland #ePooki #oulunyliopisto
#viitearkkitehtuuri
#oamk #luotaitseesi
03/01/2019 12:10:40 0 14 view @oamk_ouas Oulu, Finland
#ylpeästiAMK #YTHS
#oamk #AR
02/14/2019 09:45:11 0 2 view @oamk_ouas Oulu, Finland
#lisättytodellisuus
01/17/2019 12:35:11 0 3 view @oamk_ouas Oulu, Finland #oamk #ePooki #hot #hops
#oamk #yhteiskampus
01/09/2019 13:14:04 10 17 view @oamk_ouas Oulu, Finland
#luotaitseesi
#oamk #yhteiskampus
01/08/2019 12:48:19 10 17 view @oamk_ouas Oulu, Finland
#luotaitseesi
#oamk #ylpeästiAMK
12/21/2018 06:00:53 6 9 view @oamk_ouas Oulu, Finland #insinööri #koulutus
#automaatio
#oamk #koulutus #yhteistyö
12/19/2018 13:48:08 0 2 view @oamk_ouas Oulu, Finland
#YlpeästiAMK
#sukupolvenvaihdos #oamk
12/05/2018 12:23:22 0 0 view @oamk_ouas Oulu, Finland #ePooki #maatalousyritykset
#maatilat #omistajanvaihdos
Haukipudas,
11/29/2018 06:54:03 1 14 view @SAlaluusua #fiilis
Suomi
#elintarvikevienti #vienti
11/27/2018 10:47:28 2 2 view @Export_team Suomi
#ruokavienti
#bioanalytiikka
11/12/2018 13:16:13 0 1 view @oamk_ouas Oulu, Finland
#henkilöstövaihto
#talotekniikka #oamkelsa
10/03/2018 05:29:58 1 4 view @jokaaria Oulu, Suomi
#yritysyhteistyö
Oulu, Pohjois-
09/13/2018 14:13:14 2 5 view @Kaleva_fi #Oulu
Pohjanmaa
#oamk #luotaitseesi
09/06/2018 10:56:13 0 2 view @oamk_ouas Oulu, Finland
#ylpeästiAMK
#toiminnallinen_opinnäytetyö
08/17/2018 11:41:17 0 1 view @oamk_ouas Oulu, Finland #oamk #ePooki
#opinnäytetyöt #video
#ammattietiikka #etiikka
06/18/2018 07:15:11 0 0 view @oamk_ouas Oulu, Finland
#hoitoala
#radiography
06/14/2018 09:44:40 0 0 view @oamk_ouas Oulu, Finland
#radiationtherapy
Total: 94 results.
Hashtag Detail
APPENDIX 1/8
Top Hashtags
APPENDIX 1/11
Total: 10 results.
User Mentions
R
Profi
T Lik Twe
Date Time User le Location Mentions
' es et
Img
s
05/02/201 vie
11:22:08 9 9 @TeknologiaTytot @TeknologiaTytot
9 w
@BiotaloudenERKO
@JAMK_fi
05/02/201 vie @BiotaloudenER
11:21:35 3 2 @SeAMK
9 w KO
@oamk_ouas
@LapinAMKbio
04/30/201 1 vie @Ammattikorkeaa
11:08:31 12 @Ammattikorkeaan
9 0 w n
04/24/201 vie
06:37:06 3 10 @PaiviLaajala Oulu, Suomi @PaiviLaajala
9 w
@ppliitto
04/24/201 vie
06:29:09 2 6 @ppliitto @oamk_ouas
9 w
@UniOulu
04/24/201 vie
05:57:47 2 15 @OamkAmok Oulu, Suomi @OamkAmok
9 w
APPENDIX 1/12
04/24/201 vie
05:34:49 1 4 @UASjournal Finland @UASjournal
9 w
04/23/201 vie
08:48:52 9 21 @TeknologiaTytot @TeknologiaTytot
9 w
04/23/201 vie
05:47:26 2 10 @oamk_ouas Oulu, Finland @UniOulu
9 w
04/18/201 vie
07:49:43 7 11 @TeknologiaTytot @TeknologiaTytot
9 w
@j_johanna_29
04/17/201 vie
07:04:57 3 10 @j_johanna_29 Oulu, Suomi @OamkRaksa
9 w
@Oamkenergyautom
04/15/201 vie
07:28:51 8 15 @TeknologiaTytot @TeknologiaTytot
9 w
04/12/201 1 vie
09:54:27 39 @Arene_ry Helsinki @Arene_ry
9 7 w
@Osuuskauppani
04/11/201 vie
09:55:50 4 11 @Osuuskauppani Oulu, Suomi @UniOulu
9 w
@oamk_ouas
04/09/201 vie Sotkamo, @Hirsikoti
12:34:00 2 6 @Hirsikoti
9 w Suomi @oamk_ouas
04/09/201 vie
05:13:32 1 5 @OamkAmok Oulu, Suomi @OamkAmok
9 w
03/27/201 vie
11:05:22 4 7 @Kuutosaika Suomi @Kuutosaika
9 w
03/25/201 vie
14:28:26 1 3 @oamk_ouas Oulu, Finland @KitchenOulu
9 w
03/19/201 vie
13:36:59 1 3 @oamk_ouas Oulu, Finland @KitchenOulu
9 w
@LukeFinland
@TAMK_UAS
03/19/201 vie @JAMK_fi
10:01:48 5 10 @LukeFinland Suomi
9 w @SeAMK
@oamk_ouas
@SavoniaAMK
03/19/201 vie
10:01:31 7 12 @TeknologiaTytot @TeknologiaTytot
9 w
03/19/201 vie
06:00:33 3 7 @oamk_kone Oulu, Suomi @oamk_kone
9 w
03/12/201 vie
06:34:38 1 3 @oajry @oajry
9 w
03/01/201 vie
12:10:40 0 14 @oamk_ouas Oulu, Finland @YTHS_FIN
9 w
02/28/201 vie
06:38:18 1 3 @OamkAmok Oulu, Suomi @OamkAmok
9 w
02/21/201 vie
12:01:15 3 13 @oamk_ouas Oulu, Finland @ramboll_fi
9 w
@LempinenPetri
02/19/201 vie
07:07:35 1 13 @LempinenPetri Helsinki @oamk_ouas
9 w
@Arene_ry
@Oamkenergyautom
02/18/201 vie @Oamkenergyaut
06:31:43 3 9 Oulu, Suomi @oamk_ouas
9 w om
@AlisaHast
02/11/201 vie
13:41:01 3 3 @KitchenOulu Oulu @KitchenOulu
9 w
02/11/201 vie
06:30:08 7 15 @JyrkiLaitinen @JyrkiLaitinen
9 w
02/08/201 1 vie
13:49:04 44 @Arene_ry Helsinki @Arene_ry
9 2 w
02/08/201 vie
06:39:06 0 0 @oamk_ouas Oulu, Finland @tiiahnkm_
9 w
02/07/201 vie
12:12:12 1 8 @oamk_ouas Oulu, Finland @UniOulu
9 w
01/29/201 vie
09:08:04 3 6 @BusinessOulu_ Oulu, Suomi @BusinessOulu_
9 w
01/23/201 vie
07:29:29 0 0 @oamk_ouas Oulu, Finland @ValioFi
9 w
01/23/201 vie
06:32:31 5 11 @OamkAmok Oulu, Suomi @OamkAmok
9 w
01/23/201 vie
06:31:31 5 12 @ulla_v @ulla_v
9 w
01/18/201 vie
09:37:06 2 7 @JNiinimki @JNiinimki
9 w
@Arene_ry
01/18/201 vie
06:33:27 2 12 @Arene_ry Helsinki @Arene_ry
9 w
@LempinenPetri
APPENDIX 1/15
01/17/201 vie
12:46:46 9 23 @Arene_ry Helsinki @Arene_ry
9 w
01/17/201 vie
06:38:51 2 2 @Digiohjaus Oulu, Suomi @Digiohjaus
9 w
01/16/201 vie
11:24:39 1 15 @JNiinimki @JNiinimki
9 w
01/16/201 vie
11:21:40 2 2 @oamk_kone Oulu, Suomi @oamk_kone
9 w
01/11/201 vie
11:38:20 4 25 @honkamakila @honkamakila
9 w
01/09/201 vie
07:16:44 3 7 @lauralaaveri Oulu, Suomi @lauralaaveri
9 w
01/08/201 vie
14:00:23 1 9 @mizmaaps Finland @mizmaaps
9 w
01/08/201 1 vie
12:48:19 17 @oamk_ouas Oulu, Finland @UniOulu
9 0 w
01/08/201 vie
06:06:12 1 8 @oamk_ouas Oulu, Finland @Cision
9 w
@KitchenOulu
01/07/201 vie @oamk_ouas
06:48:51 3 4 @KitchenOulu Oulu
9 w @osaotweet
@UniOulu
01/04/201 vie
09:07:47 3 7 @OamkAmok Oulu, Suomi @OamkAmok
9 w
01/03/201 1 vie
08:33:52 24 @Demolanet Suomi @Demolanet
9 1 w
APPENDIX 1/16
@LempinenPetri
@Arene_ry
12/27/201 1 vie
09:36:45 47 @LempinenPetri Helsinki @metropolia
8 0 w
@HAAGAHELIAa
mk
12/27/201 vie @Oamkenergyaut @Oamkenergyautom
09:34:11 2 4 Oulu, Suomi
8 w om @okmfi
12/21/201 vie
06:00:53 6 9 @oamk_ouas Oulu, Finland @KemijokiOy
8 w
12/19/201 vie
13:48:08 0 2 @oamk_ouas Oulu, Finland @Atria_Oyj
8 w
12/19/201 vie
13:44:26 1 5 @oamk_ouas Oulu, Finland @PoyrySuomi
8 w
12/17/201 vie
08:34:11 0 5 @oamk_ouas Oulu, Finland @Nordea
8 w
12/17/201 vie
08:26:36 0 3 @oamk_ouas Oulu, Finland @liikesivistys
8 w
12/05/201 vie
06:22:41 2 8 @Kuutosaika Suomi @Kuutosaika
8 w
12/03/201 vie
11:58:33 0 0 @oamk_ouas Oulu, Finland @Kaleva_fi
8 w
11/30/201 vie
07:34:05 1 1 @oamk_ouas Oulu, Finland @Kaleva_fi
8 w
11/26/201 vie
12:46:07 1 6 @oamk_ouas Oulu, Finland @JoukoPaaso
8 w
@KitchenOulu
11/20/201 vie
15:19:41 2 7 @KitchenOulu Oulu @oamk_ouas
8 w
@UniOulu
APPENDIX 1/17
11/20/201 vie
15:12:39 1 6 @OamkRaksa Oulu, Suomi @OamkRaksa
8 w
11/06/201 vie
15:56:21 1 4 @OamkRaksa Oulu, Suomi @OamkRaksa
8 w
11/06/201 vie
08:02:48 1 6 @OamkRaksa Oulu, Suomi @OamkRaksa
8 w
11/05/201 vie
13:43:08 0 4 @oamk_ouas Oulu, Finland @Osuuskauppani
8 w
10/08/201 vie
11:43:30 1 5 @oamk_ouas Oulu, Finland @UASjournal
8 w
10/04/201 vie
12:38:28 1 7 @OamkRaksa Oulu, Suomi @OamkRaksa
8 w
APPENDIX 1/18
@jokaaria
10/03/201 vie
05:29:58 1 4 @jokaaria Oulu, Suomi @UponorSuomi
8 w
@oamk_ouas
10/02/201 vie
09:42:04 1 11 @OamkRaksa Oulu, Suomi @OamkRaksa
8 w
10/01/201 vie
12:04:12 1 3 @oamk_ouas Oulu, Finland @caritaslaiset
8 w
10/01/201 vie
12:01:10 2 8 @rtotter Oulu @rtotter
8 w
09/28/201 vie
16:54:35 1 8 @oamk_ouas Oulu, Finland @PiiMega
8 w
09/28/201 vie
16:51:46 1 8 @oamk_ouas Oulu, Finland @nokia
8 w
09/27/201 vie
08:29:30 0 4 @oamk_ouas Oulu, Finland @Kaleva_fi
8 w
09/27/201 vie
08:28:08 1 6 @johannalaitala Oulu / Nivala @johannalaitala
8 w
09/27/201 vie
08:27:57 7 0 @LukeFinland Suomi @LukeFinland
8 w
09/20/201 vie
12:47:25 1 1 @oamk_ouas Oulu, Finland @Kaleva_fi
8 w
09/19/201 vie
10:21:52 3 4 @KitchenOulu Oulu @KitchenOulu
8 w
09/19/201 vie
06:14:27 1 3 @insinoorilehti @insinoorilehti
8 w
@pekkarahko
09/17/201 vie
11:06:10 1 2 @pekkarahko @UniOulu
8 w
@oamk_ouas
Oulu,
09/13/201 vie
14:13:14 2 5 @Kaleva_fi Pohjois- @Kaleva_fi
8 w
Pohjanmaa
APPENDIX 1/19
@Arene_ry
09/13/201 vie
12:30:19 1 3 @Arene_ry Helsinki @Talenom
8 w
@oamk_ouas
09/13/201 vie
08:20:45 0 3 @oamk_ouas Oulu, Finland @Kaleva_fi
8 w
09/12/201 vie
11:34:28 1 2 @oamk_ouas Oulu, Finland @Talenom
8 w
09/12/201 vie
07:56:43 1 3 @oamkit Oulu, Suomi @oamkit
8 w
09/06/201 vie
07:41:57 2 9 @oamk_kone Oulu, Suomi @oamk_kone
8 w
09/04/201 vie
09:33:12 1 6 @oamk_ouas Oulu, Finland @osakoweb
8 w
09/03/201 vie
10:11:07 0 3 @oamk_ouas Oulu, Finland @MindBusiness_fi
8 w
09/03/201 vie
08:32:59 0 1 @oamk_ouas Oulu, Finland @Kaleva_fi
8 w
08/30/201 vie
07:14:28 2 5 @CityIoT1 @CityIoT1
8 w
08/28/201 vie
09:40:12 0 8 @oamk_ouas Oulu, Finland @LapinAMK
8 w
@Vormanen
@JNiinimki
@OYYtwiittaa
08/24/201 vie
11:10:47 3 4 @oamk_ouas Oulu, Finland @UniOulu
8 w
@oulunkaupunki
@JoukoPaaso
@PaiviLaajala
08/21/201 vie @Oamkenergyaut @Oamkenergyautom
05:51:46 1 13 Oulu, Suomi
8 w om @oamk_ouas
08/20/201 vie
05:46:58 2 6 @oamkit Oulu, Suomi @oamkit
8 w
APPENDIX 1/20
@LempinenPetri
08/10/201 vie
05:04:38 8 15 @LempinenPetri Helsinki @helsinkiuni
8 w
@AaltoUniversity
08/08/201 vie
05:33:47 2 5 @oamkit Oulu, Suomi @oamkit
8 w
07/30/201 vie
08:59:49 4 4 @dimmyoamk Oulu, Suomi @dimmyoamk
8 w
07/27/201 vie
13:56:37 0 0 @oamk_ouas Oulu, Finland @TiinaGall
8 w
07/27/201 vie
07:34:13 0 0 @oamk_ouas Oulu, Finland @kaaiia
8 w
07/27/201 vie
07:21:54 0 1 @oamk_ouas Oulu, Finland @kaaiia
8 w
07/26/201 vie
10:48:05 0 3 @oamk_ouas Oulu, Finland @Qstock
8 w
07/26/201 vie
10:33:10 0 4 @oamk_ouas Oulu, Finland @Qstock
8 w
08/21/201 05/02/201
78 261 35 Oamk @oamk_ouas
8 9
05/02/201 05/02/201
3 2 1 Lapin AMK Biotalous @LapinAMKbio
9 9
04/30/201 04/30/201 Ammattikorkeakouluu
10 12 1 @Ammattikorkeaan
9 9 n
08/24/201 04/24/201
6 14 2 Päivi Laajala @PaiviLaajala
8 9
04/24/201 04/24/201 Pohjois-Pohjanmaan
2 6 1 @ppliitto
9 9 liitto
06/25/201 04/24/201
45 128 16 University of Oulu @UniOulu
8 9
09/03/201 04/24/201
13 44 7 Oamk Amok @OamkAmok
8 9
10/08/201 04/24/201
2 9 2 UAS Journal @UASjournal
8 9
04/17/201 04/17/201
3 10 1 Johanna Jalas @j_johanna_29
9 9
10/02/201 04/17/201
9 47 7 Oamk_raksa @OamkRaksa
8 9
08/21/201 04/17/201 Oamk_energyautomati
24 85 12 @Oamkenergyautom
8 9 o
08/31/201 04/12/201
58 200 10 Arene @Arene_ry
8 9
11/05/201 04/11/201
4 15 2 Osuuskauppa Arina @Osuuskauppani
8 9
04/09/201 04/09/201
2 6 1 Hirsitaloteollisuus ry @Hirsikoti
9 9
10/05/201 04/09/201
6 60 4 Kati Mäenpää @Kamielisa
8 9
04/04/201 04/04/201
4 7 1 Erja Sormunen @ErjaSormunen
9 9
04/04/201 04/04/201
2 1 1 Anne Rännäli @AnneRannali
9 9
03/28/201 03/28/201
4 11 1 Talotekniikka @tateteollisuus
9 9
03/28/201 03/28/201
4 11 1 OAMK @OAMK
9 9
10/03/201 03/28/201
4 25 3 Jouni Kääriäinen @jokaaria
8 9
12/27/201 03/27/201 Opetus- ja
40 61 3 @okmfi
8 9 kulttuuriministeriö
12/05/201 03/27/201
6 15 2 Kuutosaika @Kuutosaika
8 9
APPENDIX 1/22
09/19/201 03/25/201
13 24 6 Business Kitchen @KitchenOulu
8 9
09/27/201 03/19/201
12 10 2 Luonnonvarakeskus @LukeFinland
8 9
03/19/201 03/19/201
5 10 1 TAMK @TAMK_UAS
9 9
03/19/201 03/19/201
5 10 1 SavoniaAMK @SavoniaAMK
9 9
09/06/201 03/19/201
13 32 5 oamk_kone @oamk_kone
8 9
03/12/201 03/12/201
1 3 1 OAJ @oajry
9 9
03/01/201 03/01/201
0 14 1 YTHS @YTHS_FIN
9 9
06/11/201 02/26/201
8 22 9 Kaleva @Kaleva_fi
8 9
02/21/201 02/21/201
3 13 1 Ramboll Finland @ramboll_fi
9 9
08/10/201 02/19/201
21 87 4 Petri Lempinen @LempinenPetri
8 9
02/18/201 02/18/201
3 9 1 Alisa H. @AlisaHast
9 9
02/11/201 02/11/201
7 15 1 Jyrki Laitinen @JyrkiLaitinen
9 9
02/08/201 02/08/201
0 0 1 Tiia Honkamaa @tiiahnkm_
9 9
01/29/201 01/29/201
1 3 1 poliisilauri @poliisilauri
9 9
01/29/201 01/29/201
3 6 1 BusinessOulu @BusinessOulu_
9 9
01/23/201 01/23/201
0 0 1 Valio @ValioFi
9 9
01/23/201 01/23/201
1 3 1 stephan Savic @Buildpoint
9 9
01/23/201 01/23/201
5 12 1 Ulla Virranniemi @ulla_v
9 9
01/21/201 01/21/201
0 3 1 Insinööriliitto @insinooriliitto
9 9
01/21/201 01/21/201
0 3 1 Oulun Insinöörit ry. @OulunInsinoorit
9 9
01/18/201 01/18/201
0 1 1 Henna Määttä @HennaMaa
9 9
08/24/201 01/18/201
10 45 4 Jouko Niinimäki @JNiinimki
8 9
APPENDIX 1/23
01/17/201 01/17/201
1 1 1 Niklas Hagel @HagelNiklas
9 9
01/17/201 01/17/201
2 2 1 Digiohjausta kaikille! @Digiohjaus
9 9
11/12/201 01/16/201 Oulun seudun
7 18 3 @osaotweet
8 9 ammattiopisto OSAO
01/11/201 01/11/201
4 25 1 Hanna Honkamäkilä @honkamakila
9 9
01/09/201 01/09/201
3 7 1 Laura Lääveri @lauralaaveri
9 9
01/08/201 01/08/201
1 9 1 Maria Mappes @mizmaaps
9 9
01/08/201 01/08/201
1 8 1 Cision @Cision
9 9
01/03/201 01/03/201
11 24 1 Demola Global @Demolanet
9 9
12/27/201 12/27/201
10 47 1 Metropolia @metropolia
8 8
12/27/201 12/27/201 @HAAGAHELIAam
10 47 1 Haaga-Helia amk
8 8 k
12/21/201 12/21/201
6 9 1 Kemijoki Oy @KemijokiOy
8 8
12/19/201 12/19/201
0 2 1 Atria Oyj @Atria_Oyj
8 8
12/19/201 12/19/201
1 5 1 Pöyry Suomi @PoyrySuomi
8 8
12/17/201 12/17/201
0 5 1 Nordea @Nordea
8 8
12/17/201 12/17/201
0 3 1 Liikesivistysrahasto @liikesivistys
8 8
12/11/201 12/11/201
1 9 1 Taru Pulkkinen @arvuuttelija
8 8
12/05/201 12/05/201
2 4 1 eAMK @eamkhanke
8 8
11/29/201 11/29/201
1 14 1 Susanna Alaluusua @SAlaluusua
8 8
08/24/201 11/26/201
4 10 2 Jouko Paaso @JoukoPaaso
8 8
08/24/201 11/20/201
3 21 2 Oulun kaupunki, Oulu @oulunkaupunki
8 8
11/06/201 11/06/201
9 12 1 MMM @mmm_fi
8 8
10/19/201 10/19/201
2 9 1 Aija Salo @AijaSalo
8 8
APPENDIX 1/24
10/15/201 10/15/201
2 15 1 Tytti Tuppurainen @TyttiTup
8 8
10/15/201 10/15/201
2 15 1 Antti Rinne @AnttiRinnepj
8 8
10/03/201 10/03/201
1 4 1 Uponor Suomi @UponorSuomi
8 8
10/01/201 10/01/201
1 3 1 Caritaslaiset @caritaslaiset
8 8
10/01/201 10/01/201
2 8 1 Riitta Tötterström @rtotter
8 8
09/28/201 09/28/201
1 8 1 PiiMega Oy @PiiMega
8 8
09/28/201 09/28/201
1 8 1 Nokia @nokia
8 8
09/27/201 09/27/201
1 6 1 Johanna Laitala @johannalaitala
8 8
09/26/201 09/26/201
3 8 1 Pentik Oy @PentikOy
8 8
09/19/201 09/19/201 PohjoisPohjanmaanEL
3 12 1 @POPELYkeskus
8 8 Y
09/19/201 09/19/201
1 3 1 Insinööri-lehti @insinoorilehti
8 8
09/17/201 09/17/201
1 2 1 Pekka Rahko @pekkarahko
8 8
09/12/201 09/13/201
2 5 2 Talenom @Talenom
8 8
08/08/201 09/12/201
5 14 3 Oamk IT - OUAS IT @oamkit
8 8
06/25/201 09/04/201
3 19 3 Student Union OSAKO @osakoweb
8 8
09/03/201 09/03/201
0 3 1 MindBusiness @MindBusiness_fi
8 8
09/03/201 09/03/201
0 0 1 Marja-Liisa Kettunen @Marliisi
8 8
08/31/201 08/31/201
2 1 1 EHK @Ehkeskus
8 8
08/30/201 08/30/201
2 5 1 CityIoT @CityIoT1
8 8
08/28/201 08/28/201
0 8 1 Lapin AMK @LapinAMK
8 8
08/24/201 08/24/201
3 4 1 Valtteri Törmänen @Vormanen
8 8
06/25/201 08/24/201
4 14 2 OYY @OYYtwiittaa
8 8
APPENDIX 1/25
08/10/201 08/10/201
8 15 1 University of Helsinki @helsinkiuni
8 8
08/10/201 08/10/201
8 15 1 Aalto University @AaltoUniversity
8 8
07/30/201 07/30/201
4 4 1 DIMMY-hanke @dimmyoamk
8 8
07/27/201 07/27/201
0 0 1 Tiina Gallén @TiinaGall
8 8
07/27/201 07/27/201
0 1 2 Katariina @kaaiia
8 8
07/26/201 07/26/201
0 7 2 Qstock Festival @Qstock
8 8
06/25/201 06/25/201
1 10 1 Jenny Vaara @jennyvaaa
8 8
Total: 99 results.
Top Mentions
Date Date RT' Like Coun
Name Mention
(since) (until) s s t
08/21/201 05/02/201
78 261 35 Oamk @oamk_ouas
8 9
06/25/201 04/24/201
45 128 16 University of Oulu @UniOulu
8 9
08/21/201 04/17/201 Oamk_energyautomati @Oamkenergyauto
24 85 12
8 9 o m
08/31/201 04/12/201
58 200 10 Arene @Arene_ry
8 9
06/11/201 02/26/201
8 22 9 Kaleva @Kaleva_fi
8 9
09/03/201 04/24/201
13 44 7 Oamk Amok @OamkAmok
8 9
10/02/201 04/17/201
9 47 7 Oamk_raksa @OamkRaksa
8 9
09/19/201 03/25/201
13 24 6 Business Kitchen @KitchenOulu
8 9
09/19/201 05/02/201
43 80 6 Sinä osaat! @TeknologiaTytot
8 9
09/06/201 03/19/201
13 32 5 oamk_kone @oamk_kone
8 9
Total: 10 results.
Tweets
APPENDIX 1/26
Date Time User Profile Img Name Location Tweet (filter: '['ok']')
Total: 0 results.
METADATA
Profile Image
Pic Description
Images Directory
/home/tinfoleak/scripts2/files/oamk_ouas
Media Resources
In
Media App Reply RT Likes Source User RT User Tweet
To
Twitter @oamk_ouas
Web 1 4 04/30/2019 view
Client 10:20:12
• Size:
1162x1200
px
APPENDIX 1/27
Twitter @oamk_ouas
Web 0 2 03/28/2019 view
Client 08:36:40
• Size:
1200x900
px
• Platform:
Microsoft
Corporation
• ICC Date:
1998/02/09
06:49:00
Twitter @oamk_ouas
Web 1 2 03/19/2019 view
Client 08:03:57
• Size:
1067x1067
px
Twitter @oamk_ouas
Web 10 17 01/08/2019 view
Client 12:48:19
• Size:
1200x1200
px
• Size:
1200x900
px
APPENDIX 1/28
• Size:
1200x900
px
Twitter @oamk_ouas
for 0 2 09/06/2018 view
iPhone 10:56:13
• Size:
1200x900
px
Total: 7 results.
Geolocation Information
Total: 2 results.
User route
Tweets Date-Time (since) Date-Time (until) Days Location Coordinates
1 [ 1 ] 2018-11-02 17:23:04 2018-11-02 17:23:04 1 Oulu ,
1 [ 1 ] 2018-09-25 12:26:21 2018-09-25 12:26:21 1 Stavanger ,
Total: 2 results.
Top Locations
Tweets Date Time Mo Tu We Th Fr Sa Su Coordinates Place
Total: 0 results.
APPENDIX 1/29
www.vicenteaguileradiaz.com
Recon-ng exercises in this thesis were done by using VMvare virtual server with UBUNTU
Linux OS. In order to get it Recon-ng working it had to be installed by using Linux terminal
with following commands. It should be noted also that actions need to be done as root user
– simply type sudo –s in the Linux terminal.
Install Recon-ng
Then adding proper dependencies packets which are needed Recong-ng tool.
and then installing python installer in order to get pip tool working properly.
Once dependencies and pip are installed, pip can be used to install requirements by
following command.
APPENDIX 2/2
Then start program simply giving the following command inside of the folder where tool is
installed.
After that you Recon-ng main window pop-up and you are ready to go and start using the
tool:
Guidelines to install Recon-ng are available all over Internet. The following where utilized to
guide in the Thesis workers installation process:
https://bitbucket.org/LaNMaSteR53/recon-ng/wiki/Usage%20Guide#!usage-notes
https://www.youtube.com/watch?v=6T8ps088gPg
APPENDIX 3/1
Running transform To Website mentioning domain [Bing] on 1 entities (from entity "oamk.fi")
Transform [Censys] Details returned with 0 entities (from entity "oamk.fi")
Transform [Censys] Details done (from entity "oamk.fi")
Running transform To DNS Name - SOA (Start of Authority) on 1 entities (from entity "oamk.fi")
Transform To Domains [DNS] returned with 1 entities (from entity "oamk.fi")
Transform To DNS Name [Robtex] returned with 12 entities (from entity "oamk.fi")
Bing Transforms can only be used with paid versions of Maltego (from entity "oamk.fi")
Transform To Website mentioning domain [Bing] returned with 0 entities (from entity "oamk.fi")
Transform To Website mentioning domain [Bing] done (from entity "oamk.fi")
Transform To DNS Name [Robtex] done (from entity "oamk.fi")
Transform To Domains [DNS] done (from entity "oamk.fi")
Running transform [Securitytrails] DNS History Field A on 1 entities (from entity "oamk.fi")
Running transform To DNS Name - NS (name server) on 1 entities (from entity "oamk.fi")
Running transform To Website using domain [Bing] on 1 entities (from entity "oamk.fi")
Transform To DNS Name - SOA (Start of Authority) returned with 2 entities (from entity "oamk.fi")
Transform To DNS Name - SOA (Start of Authority) done (from entity "oamk.fi")
Running transform To Email addresses [using Search Engine] on 1 entities (from entity "oamk.fi")
Transform [Securitytrails] DNS History Field A returned with 0 entities (from entity "oamk.fi")
Transform [Securitytrails] DNS History Field A done (from entity "oamk.fi")
Running transform To Files (Interesting) [using Search Engine] on 1 entities (from entity "oamk.fi")
Bing Transforms can only be used with paid versions of Maltego (from entity "oamk.fi")
Transform To Email addresses [using Search Engine] returned with 0 entities (from entity "oamk.fi")
Transform To Email addresses [using Search Engine] done (from entity "oamk.fi")
Running transform To Website [Quick lookup] on 1 entities (from entity "oamk.fi")
Transform To DNS Name - NS (name server) returned with 3 entities (from entity "oamk.fi")
Transform To DNS Name - NS (name server) done (from entity "oamk.fi")
Running transform To Emails @domain [using Search Engine] on 1 entities (from entity "oamk.fi")
Bing Transforms can only be used with paid versions of Maltego (from entity "oamk.fi")
Transform To Files (Interesting) [using Search Engine] returned with 0 entities (from entity "oamk.fi")
Transform To Files (Interesting) [using Search Engine] done (from entity "oamk.fi")
Bing Transforms can only be used with paid versions of Maltego (from entity "oamk.fi")
Transform To Website using domain [Bing] returned with 1 entities (from entity "oamk.fi")
Transform To Website using domain [Bing] done (from entity "oamk.fi")
Running transform To DNS Name [Attempt zone transfer] on 1 entities (from entity "oamk.fi")
Running transform [Censys] Search in IPv4 on 1 entities (from entity "oamk.fi")
Transform To Website [Quick lookup] returned with 1 entities (from entity "oamk.fi")
Transform To Website [Quick lookup] done (from entity "oamk.fi")
Running transform [Securitytrails] DNS History Field MX on 1 entities (from entity "oamk.fi")
Bing Transforms can only be used with paid versions of Maltego (from entity "oamk.fi")
Transform To Emails @domain [using Search Engine] returned with 0 entities (from entity "oamk.fi")
Transform To Emails @domain [using Search Engine] done (from entity "oamk.fi")
Transform [Censys] Search in IPv4 returned with 0 entities (from entity "oamk.fi")
Transform [Censys] Search in IPv4 done (from entity "oamk.fi")
Running transform To DNS Name - MX (mail server) on 1 entities (from entity "oamk.fi")
Running transform [Securitytrails] WHOIS Details on 1 entities (from entity "oamk.fi")
Transform [Securitytrails] DNS History Field MX returned with 0 entities (from entity "oamk.fi")
Transform [Securitytrails] DNS History Field MX done (from entity "oamk.fi")
Running transform To DNS Name [Find common DNS names] on 1 entities (from entity "oamk.fi")
The server ns3.oamk.fi doesn't allow IXFR transfers (from entity "oamk.fi")
The server ns2.oamk.fi doesn't allow AXFR transfers (from entity "oamk.fi")
The server ns3.oamk.fi doesn't allow AXFR transfers (from entity "oamk.fi")
The server ns2.oamk.fi doesn't allow IXFR transfers (from entity "oamk.fi")
The server ns.oamk.fi doesn't allow AXFR transfers (from entity "oamk.fi")
The server ns.oamk.fi doesn't allow IXFR transfers (from entity "oamk.fi")
Transform To DNS Name [Attempt zone transfer] returned with 0 entities (from entity "oamk.fi")
Transform To DNS Name - MX (mail server) returned with 1 entities (from entity "oamk.fi")
APPENDIX 3/3