Recon: How to Research a Person or Organization Using the Operative Framework « Null Byte :: WonderHowTo

TheOperative Frameworkis a powerful Python-based open-source intelligence (OSINT) tool that can be used to find domains registered by the same email address, as well as many other investigative functions. This reconnaissance tool provides insight about your target through examining relationships in the domains they own.Today, I'll show you how to run a web domain through both a WHOIS query and through an email-to-domain query. This will let us build a profile on a target, and ultimately, link the results to entries in primary-source data (like business filings and government databases) that contain a wealth of information.The internet is a rich source of data about people, organizations, and the various records and registrations they leave behind through their journey on the web. The Operative Framework tags, collects, and correlates this information. Taken together, it becomes simple to create a complete picture of a person or business from within a familiar framework interface.An OSINT investigation shown querying the domains associated with a given email address to correlate more information.Image by SADMIN/Null ByteLightweight OSINT Scripts for Specific TasksThe amount of information that can be accessed with a few keystrokes often surprises people who submitted the information into the public domain in the first place, without knowing how easy it would be to find. Tools liketheHarvestercan turn up the personal and work email addresses of a target, which can be run through the Operative Framework to fingerprint and expand our knowledge of a person by mining the data for relationships.More OSINT Recon:How to Use Maltego to Do Network ReconnaissanceTools likeMaltegoare robust frameworks to conduct investigations, but lighter OSINT modules and scripts exist to accomplish more specific OSINT investigations.A favorite of mine is the Operative Framework (obviously), which provides a uniquely well-equipped suite to conduct reconnaissance on individuals or organizations from online databases. The Operative Framework allows you to conduct reverse WHOIS queries to email addresses and other information to correlate information. This creates a detailed overall picture by stitching together many details about a person or business from WHOIS and social directories.The Operative Framework for Domain ReconnaissanceThis tutorial will focus on installing the Operative Framework and running the email-to-domain tool to use found emails and discover other domains owned by an individual. While many people register their domains privately, domain registrars can leak the information anyway. Using research or scraping tools, or even just a person's business card, we will discover if they own any domains related to that email account.This tool is most useful to run against businesses, business owners, and anyone likely to own online domains. It is possible to determine what kind of business a person is in, what assets they own, and other information by examining the web domains they have purchased to support such projects.Step 1: Installing the Operative FrameworkWe will need Python to use the Operative Framework, but the benefit is that this allows the tool to run on macOS (aka Mac OS X), Windows, or Kali Linux. You can set it up by cloning the Git directory by typing the following into terminal.git clonehttps://github.com/graniet/operative-framework.gitcd operative-frameworkpip install -r requirements.txtpython operative.pyIf you don't havepip, you can get it by running the following and installing via thepython setup.py.git clonehttps://github.com/pypa/pip.gitStep 2: Running an Email to Find Associated DomainsThe Operative Framework is more similar toMetasploitthan it to theHarvester. You can run modules which require you to set variables to then execute the module. You can examine the list of modules by typingmodules.Modules in the Operative Framework.To select a module, you'll typeuse (the path of the module to use).In this case, we will be running an email-to-domain search. First, let's generate a sample to run through our list. We will run a domain through the WHOIS module to pull an email address and see if the registrar owns any other domains. To load the WHOIS module, type this into the terminal:use core/modules/whois_domainOnce we are in a module, we can see the available options by typing the following.show_optionsIt is fussy about the underscore, and doesn't understand any other way of asking about options. In this case, we're trying to learn some info about technology, so let's use the random exampletechnology.info.Here we see that "website" is the only unset option. Let's set this as the example with the following.set website=technology.infoBam! We get an email address for us to feed into the reverse domain tool. TypeControl Cto go back to the main menu, and then load the email to domain module by entering the text below.use core/modules/email_to_domainshow_optionsWe will set our sample email the same way we set the website in the last module. Run the following.set email=rights.domainmanager@futurenet.comRunshow_optionsto confirm the variable is set and then typerunto begin the search. Here, we can see the results of the module. If the target does not own any domains, you can expect to see no results.In this case, our results suggest a publishing business.Step 3: Building a Profile from the ResultsIn our example, our search brings us back to an umbrella of domains owned by a single entity. When the website for the active entity on the domain is visited, it seems the business is a domain management portfolio specializing in technology-related domains.This is the point at which we can make some decisions about where further information can be found to definitively correlate a person behind an email or domain. The Operative Framework contains a fingerprinting framework database to help collect and organize details about a target, which I will teach in future tutorials.To expand our search, we should combine our domain pull with a query to a city, state, or local government agency database to provide primary source information.Step 4: Cross-Referencing Results for a FixIn our example domain, I narrowed the search to target the director of the business. Via the main domain, I see they have a California subsidiary, which means it's worth running a check with the California Secretary of State database.No luck there for corporations or LLCs, butthe UK equivalentfor their home office has a bounty of information including corporate filings and other information about the current staff and directors. In those documents, I was able to find the executive director's personal details including date of birth and individual email address for contacting.An email led to an umbrella company owning the domain, which led us to corporate filings.OSINT Is an Investigation, the Question MattersThe Operative Framework is a tool to help you pull clues together to fill in pieces of an investigation. By running queries on who owns a domain, and an email-to-domain query to assess what other domains they own, you can quickly assess a target.A target business's operations, locations, and other information is easy to infer from this data. Here, we were able to go from a randomly selected domain to the ability to contact the director of the company who owns it through a series of database pulls.An important note about OSINT tools — you must have a goal with your investigation, and the question you are answering must make sense. If it doesn't, your answer will not make sense either.You can ask me questions here or @sadmin2001 onTwitterorInstagram.Don't Miss:How to Scrape Target Email Addresses with TheHarvesterFollow Null Byte onTwitterandGoogle+Follow WonderHowTo onFacebook,Twitter,Pinterest, andGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by SADMIN/Null ByteRelatedHow To:Conduct Recon on a Web Target with Python ToolsHow To:Use Maltego to Fingerprint an Entire Network Using Only a Domain NameHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)News:Disney Research Creates Avatars That Can Strike a Pose to Match a Person's Movements in Augmented RealityHow to Hack Like a Pro:Getting Started with MetasploitVideo:How to Use Maltego to Research & Mine Data Like an AnalystHow To:Track Down a Tinder Profile with Location Spoofing on Google ChromeHow To:Beat Ghost Recon Advanced Warrior 2How To:Scrape Target Email Addresses with TheHarvesterHow To:Identify Web Application Firewalls with Wafw00f & NmapHow To:Top 10 Exploit Databases for Finding VulnerabilitiesHow To:Probe Websites for Vulnerabilities More Easily with the TIDoS FrameworkHow To:Conduct OSINT Recon on a Target Domain with Raccoon ScannerHow To:Tips for Tackling Your Dream ProjectHow To:Play the Recon sniper character class in Battlefield Bad Company 2: VietnamHow To:Use a DVR unit for trans-communicationHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHow To:Use Photon Scanner to Scrape Web OSINT DataHow To:Use dowsing rods for paranormal researchNews:Researchers Discover Key Proteins Malaria Uses to Infect the Liver—A Key Step in Stopping the ParasiteNews:Healthinnovations researching Google + for healthNews:Economic Reform in the CommunityNews:Why we shouldn't rush the job searchHow To:Keep Stroke Patients Active at Home w/ Wii FitHow To:Don't Know How YOU Can Help? We Do!News:Capturing insights of introvertsNews:Super Mega Slip N' Slide!Omegaville research (aka:mgabrys' underground challenge submission)News:Street Poets Inc. (nonprofit organization)News:Urban Environmental OrganizationsNews:Uganda's Reaction to Kony 2012News:Print 3D Models of Your Minecraft Creations with MinewaysNews:YouthSportTravel.com