How to Use the Buscador OSINT VM for Conducting Online Investigations « Null Byte :: WonderHowTo

For anyone using open source information to conduct an investigation, a balance between powerful tools and privacy controls are a must. Buscador is a virtual machine packed full of useful OSINT tools and streamlined for online research. This program can easily be set up in VirtualBox, and once that's done, we'll walk you through some of the most useful tools included in it.OSINT InvestigationsWhen I showed employees at Uber research tools likeTheHarvesterandMaltego, the reaction ranged from wide-eyed amazement to suspicious questions about the legality of the programs being used. Most people have similar reactions to the amount and kind of information that can be pulled from open sources. OSINT research tools allow access to the incredible amount of data our society produces, often used as forensic clues to solve a crime or as a method of reconnaissance to allow a hacker to plan their attack.With all the data available in the digital world, the problem for a researcher is rarely whether or not the information exists; The amount of data that exists is overwhelming and difficult to sort through, but the right data almost always there. Instead, finding the most efficient path to the right data is one of the core challenges an investigator will face; This means using tools much more sophisticated than a Google search to hunt down clues relating to a target. There are a lot of great tools for this out there, but installing and configuring them all can be a pain.Don't Miss:Use Maltego to Fingerprint a Network Using Only a Domain NameAfter seeing glaring holes in the operational security of the way many police departments conduct OSINT research, experts Mike Bazzell and David Westcott set out to create a specialized VM specifically to bring together the most effective OSINT tools and customized scripts used by themselves and other investigators. Another focus of this VM was security, stealthiness, and the ability to easily save digital forensic evidence found during an investigation.Editor's note: Mike Bazzel's Buscador OS that's featured in this article was temporarilytaken downfrom his website due to increased DDoS-style attacks, but it's back up and running as normal. TheOSINT Toolson his website, however, will not be returning because of DMCAs and cease-and-desists from some of the tools.A VM for Hackers, Researchers & InvestigatorsHackers can think of the Buscador OSINT virtual machine like an OSINT-focused version ofKali Linux. Based on Ubuntu rather than Debian, Buscador does not include the formidable set of cyber weaponry that Kali boasts, instead hand-picking a collection of useful OSINT, privacy, and capture tools into one stealthy package. Because avoiding detecting is a goal of both investigators and hackers share, Buscador comes withTorpreinstalled and boasts other helpful privacy tools.Buscador VM is also capable of being booted from aUSB thumb driveon any available computer, as well as being loaded onto the hard disk and booted directly. This allows the flexibility of using it anywhere you have access to a computer, regardless of whether or not you have your personal device with you. At 3.5 GB, the VM image is compact and easy to carry on aflash drive that's 8 GB or more.Extensively documented in Mike Bazzell's book, "Open Source Intelligence Techniques," Buscador encourages good research habits and empowers researchers to find more clues in their investigations. Some familiar tools such asMaltego,Recon-ng, Creepy,Spiderfoot,TheHarvester,Sublist3r, and other tools we've covered on Null Byte are preinstalled.Get Bazzell's Book on Amazon:Open Source Intelligence Techniques: Resources for Searching and Analyzing Online InformationWhat You'll NeedTrying out Buscador is easy. You'll need to download the most current version ofBuscador from the IntelTechniques website. The most current VirtualBox version as of June 2019 isBuscador 2.0.Next, you'll need todownload VirtualBox, as well as theVirtualBox Extension Packto run the virtual machine. Make sure to install both before continuing, as running Buscador without the extension pack can make using Buscador more annoying by requiring you to hit an escape sequence to release the mouse from the VM.Once you've installed both VirtualBox and the VirtualBox Extension Pack, you can proceed to the first step of setting up Buscador. (Note: There is Buscador isalso available for VMWare.)Step 1: Import & Configure the Virtual ApplianceFirst, we will need to import the appliance and adjust a few settings. Open VirtualBox, and in the drop-down menu, click on "File" and then "Import Appliance" to select the Buscador .OVA file you downloaded previously. Then, select "Continue."Go ahead and click "Import" to load the virtual machine.Next, click on "Settings," and in the "General" tab, rename the Buscador VM to something you will remember. Under "Advanced," change "Shared Clipboard" to "Bi-Directional" to allow copying and pasting between the guest and host system.Click on the "System" tab, and under "Motherboard," add about half of the total system RAM to the virtual machine. Then, click the "Display" tab and then "Screen" to increaseVideo Memoryto at least 128 MB, to allow for video and other digital evidence to be displayed properly.When this is done, click on the "Storage" tab, then click on the plus-shaped icon in the lower-left corner, select "Add Optical Drive," and then select the "Leave Empty" option.Finally, click on the "Shared Folders" tab, and select the plus-shaped icon on the right. Now, you can create or select which folder you want to use to save evidence from Buscador onto your computer. Once this is selected, make sure the folder is set to "Auto-mount."With this complete, you're ready to run Buscador for the first time. Click "OK" to save the settings, and then select the Buscador VM from the list of VMs in VirtualBox, and click the green "Start" button.Step 2: Run Buscador for the First TimeAfter Buscador boots, you should find yourself at a login menu with a spooky OSINT guy, possibly a self-portrait of Mike Bazzell, as the wallpaper. The default username isosint, and you can log in with the passwordosint.Once you've logged in and the desktop has booted, click on the "Devices" tab at the top of the VirtualBox menu, and then select "Insert Guest Additions CD Image" to show the CD in Buscador. If it doesn't auto-run, select the CD on the desktop, then click "Run Software" to auto-run the Guest Additions installer. Once it's finished installing, restart the virtual machine.After logging in again and loading the desktop, open a terminal window. We'll need to add the "osint" user to the "vboxsf" user group, and to do so, we'll type the following and pressReturn/Enter.sudo adduser osint vboxsfSupply the password (osint) and then reboot the VM again when the process is complete.Now that these steps are complete, your Buscador is set up and ready to use!Step 3: Take Advantage of Browser ExtensionsBuscador offers a number of browsers preconfigured with the most useful add-ons and extensions for investigators. This curated list focuses on capturing clues you find for further review and analysis, and we'll jump into some of the most useful ones included for Firefox first.Don't Miss:How to Organize Your Tools by Pentest StagesFirefox Browser Add-OnsFirefox is a fast and powerful browser that comes packed with eight browser add-ons installed in Buscador. You'll see the icons tucked into the top right of the browser. The first two,Nimbus CaptureandFireShot, are for taking detailed screenshots of pages of interest, allowing you to archive them, make notes on them, or even make PDF copies of websites.Next up are two browser extensions for collecting video and audio posted online. These allow you to save any video files either individually or in bulk usingVideo DownloadHelperandBulk Media Downloader, respectively.Ublock Originshould be a familiar sight to anyone who doesn't want to be tracked or see ads in their content, but theUser-Agent Switchermight be an interesting new toy for many researchers. The User-Agent Switcher add-on changes the operating system and browser type your browser sends each time it makes a request, allowing you to pretend to be any kind of device you want. This is useful for getting the mobile version of a webpage or doing something you can't do on a desktop device (like posting a photo to Instagram).Don't Miss:Find Anyone's Private Phone Number Using FacebookThe last two add-ons for Firefox are Google Translate, to provide a quick translation of pages in other languages, and the super-helpfulResurrect Pages, which can find old versions of webpages that have been changed or taken down, allowing you to see what people try to hide.Chrome Browser ExtensionsGoogle Chrome, which opens by default into Incognito mode, is also included in Buscador. It boasts even more extensions than Firefox, including Ublock Origin, Fireshot, and 15 other extensions.TheLightshotscreen capture extension replaces Nimbus in Chrome, with 360social andProphetadding tools for searching social websites for more information about a person, like email addresses.For analyzing websites, Chrome has aUser-Agent SwitcherandWappalyzer, which will break down and tell you the underlying technology any website is built on.Shodanas a browser extension is also extremely helpful, allowing discovery of information in Shodan about a particular website you're on. Privacy tools likeHTTPS EverywhereandWebRTC Leak Preventaim to keep the investigator insulated from malicious websites or possible detection.These browser tools can be used together in clever ways to pull off attacks liketracking down a user's Tinder profile.Step 4: Use the Helpful Included ToolsAside fromMaltego Community Edition, there are several tools that have been well-documented on Null Byte which are included in Buscador. You should check out these OSINT staples to get a feel for what Buscador has to offer.For email scraping, Buscador comes withTheHarvester, which allows you to search for all email addresses on a domain you're interested in.Spiderfoot, a powerful cross-platform OSINT tool, is also included. Spiderfoot autonomously gathers information about a target and transforms the results into an easy to understand report.Based on Metasploit,Recon-ngis a complete Python module forreconnaissancedeveloped by Tim Tomes which is popular with hackers and investigators.Don't Miss:How to Conduct Passive OS Fingerprinting with p0fWhile we haven't covered all the tools available in Buscador on Null Byte, there are many useful customized scripts for downloading videos and images from targeted social media accounts and other places people share information about themselves. These tools allow us to intake, process, and analyze impressively large amounts of data with only a few clicks.We'll cover some of these tools in more detail in an upcoming tutorial, but if you'd like to learn more about Mike Bazzell's OSINT techniques, you cancheck out his book.Buscador Can Help You Follow the CluesAfter setting up Buscador, I recommend checking out one of Null Byte's guides on the included OSINT tools to get a head start on conducting your first investigation. It's important to practice using these tools to answer a question rather than fishing for information. Without doing so, you're likely to get lost in the sea of information OSINT tools can return. There is little value in all of this data if it cannot clearly answer a question which guides the investigator's understanding of the situation forward.Because no investigation can succeed without answering well-posed questions, the goal of this specialized VM is to support a researcher by bringing together all the tools and data they need to decide which questions to ask. If you need a powerful and convenient system for conducting investigations beyond the scope of a Google search, Buscador will help you find the answers you're looking for.I hope you enjoyed this guide to setting up the Buscador OSINT virtual machine! If you have any questions about this tutorial on Buscador or you have a comment, feel free to reach me on Twitter@KodyKinzie.Don't Miss:How to Find Vulnerabilities for Any Website Using NiktoWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Find Identifying Information from a Phone Number Using OSINT ToolsRecon:How to Research a Person or Organization Using the Operative FrameworkHow To:Hunt Down Social Media Accounts by Usernames with SherlockHow To:Find OSINT Data on License Plate Numbers with SkiptracerVideo:How to Use Maltego to Research & Mine Data Like an AnalystHow To:Use Photon Scanner to Scrape Web OSINT DataHow To:Use Google Search Operators to Find Elusive InformationHow To:Top 10 Browser Extensions for Hackers & OSINT ResearchersHow To:Mine Twitter for Targeted Information with TwintHow To:Use Maltego to Target Company Email Addresses That May Be Vulnerable from Third-Party BreachesHow To:Exploit Recycled Credentials with H8mail to Break into User AccountsHow To:Brute-Force SSH, FTP, VNC & More with BruteDumHow To:Find Passwords in Exposed Log Files with Google DorksHow To:Uncover Hidden Subdomains to Reveal Internal Services with CT-ExposerHow To:Spy on SSH Sessions with SSHPry2.0How To:Catch an Internet Catfish with Grabify Tracking LinksHow To:Use Maltego to Fingerprint an Entire Network Using Only a Domain NameNews:Augmented Reality Helps Dutch Police Out on Crime ScenesNews:Police Admit To Drugging Occupy Wall Street Protesters; Suspend ProgramVaccine bombshell:Baby monkeys develop autism after routine CDC vaccinationsHow To:Run Windows from Inside LinuxNYTimes:"Feds Intensify Investigation Armstrong"News:Obama and Congress Approve Resolution that Supports UN Internet TakeoverNews:Fantasia 2000 (2000)News:On the road with Macallan & Masters of Photography