How to Catch an Internet Catfish with Grabify Tracking Links « Null Byte :: WonderHowTo

Featured on MTV'sCatfishTV series, inseason 7, episode 8, Grabify is a tracking link generator that makes it easy to catch an onlinecatfishin a lie. With the ability to identify the IP address, location, make, and model of any device that opens on a cleverly disguised tracking link, Grabify can even identify information leaked from behind a VPN.Whether it's an online apartment ad that seems too good to be true or a person online you have a strange feeling about, identifying red flags can save a lot of trouble early on. If you live in Canada, and an IP address in Africa lists the apartment you're checking out, you might not want to send a security deposit.The ability to verify details like the originating device, country, or even the time zone can prove incredibly useful for identifying whether a person is honest or not about the details they share about themselves online. Combined with information likeEXIF data, it's easy to compare a geotagged photo or the hard-coded device information in a file against the device that opens a Grabify tracking link.Don't Miss:Research a Person or Organization Using the Operative FrameworkTo track someone with Grabify, you first pick a link that would be natural to send. Then, you disguise the nature of the link by making it appear to be anything from a regular shortened link to a torrent or image file. When the target clicks or taps on the link, you capture their information as they pass through the link to the decoy.What Can You Learn from a Tracking Link?The kind of information you can learn from a tracking link depends on the type of link you're using. There are two types of tracking links that Grabify can create, the default being a lightweight and nearly undetectable redirect to a decoy URL. This default option looks and acts like a URL shortener, and the average person wouldn't notice it.From this kind of link, you can expect to get the IP address, country, browser, operating system, hostname, and internet service provider. For someone that's harassed online, that alone may be enough to file a police report or press charges.If you want to use the advanced tracking link that Grabify offers, the target will see a brief redirect page that looks like this:Because the average user wouldn't recognize this as something to be suspicious of, it's generally safe to use when you need more information. Because we're rendering a page this time, we can learn a lot more information about the user.With the advanced tracking, we can see the battery level and whether or not the device is plugged in. We can see the make and model of the device, the internal network IP address, the time zone, screen size, and even which way the user is holding their device. This level of detail can get downright creepy and can give you the upper hand in proving someone isn't really who they say they are.What You'll NeedGrabify is a web-based project byjLynxthat can beaccessed on any browser. While you don't need to sign up for an account to use Grabify, it's free, and there are some extra options available after doing so. If you like Grabify, you might like some of jLynx's other projects, so make sure to check those out onhis website.Step 1: Find a Plausible Link to SendFor this attack to work, we need to create a scenario where it makes sense for the target to click or tap a link. There are two different kinds of links we can send, one loads a fake referral page that grabs more information, and the other is a simple pass-through link that is less visible but also records less information.The less obvious link is the default choice, so unless we want to grab everything we can at the risk of tipping off the target, we can focus on finding a reason to entice the target to click or tap on something. Unlikea canary token, which takes you to a suspicious dead-end page, Grabify lets you choose where you want the victim to end up after they click or tap the link, making it a lot easier to prevent your target from knowing you're setting up a trap.Don't Miss:Track a Target Using Canary Token Tracking LinksThere are many ways to get the link to the target, and a common one is to leave the link in a chat or email on your account, making it look like the link is important or personal. If someone accesses your account and clicks or taps on the link, you'll immediately know.In another scenario, you could trick someone into clicking or tapping a link by creating a plausible context, where sharing a link makes sense. Usually, tactics like "Is this your profile?" with a link that goes back to their profile are the least suspicious,as shownin MTV'sCatfishepisode.Step 2: Create a Tracking URLThe first step in tracking a target with a Grabify link is to find a link you think your target would expect to receive. It should be something unsuspicious when the target ends up at the URL, and it will serve as a cover for the tracking link you create. You want to pretend like you're sending them a regular innocent URL shortened version of whatever decoy link you pick.In my example, I'll be shorteningslowhotcomputer.com.Navigate tograbify.link, and put your URL into the filed. Next, click "Create URL," then agree to the terms, to create your tracking URL link.Grabify will generate a tracking page, complete with a tracking link and interface with information about each time someone has clicked or tapped on the link. When you first start, it should be empty, although some URL shorteners will use bots to preview the link you're shortening, and that data might show up.Now that we have a functional tracking link, it's time to start making it look more like something our target would click or tap.Step 3: Shorten & Hide Your Tracking LinkGrabify isn't exactly a subtle URL name, so part of successfully getting your target to click or tap on a link is providing a link that doesn't look too out of place. You can obscure the link with any number of URL shorteners, some of which are available right in Grabify.Don't Miss:Use SpiderFoot for OSINT GatheringBelow, you can see the list of URL shorteners Grabify supports. Click on "View Other link Shorteners" next toOther Linkson the log page.If the included shortener options don't suit your situation, you can always create a custom link that looks like an image file, GIF, CSV, HTML, Torrent, or ISO file.Click on either "Click here" besideSelect Domain Nameor "Change domain/Make a custom link" in theNew URLbox, then check out the "Extension" drop-down. You can make it look like you're sharing a file rather than a referral link, which may work better to trick the target into clicking or tapping on your link.In this custom link menu, there are also options to a different domain from one of the ones provided by Grabify, provide a custom path, and give a custom parameter.Once you generate a shortened link or a custom URL disguise, you're ready to present it to the target. Once the target clicks or taps the link, an entry will appear under the "Results" section of your log page.Step 4: Interpret the Tracking InformationNow, open your target link and see what you get. In the default configuration, you don't use a fake referral page, so you don't get the most information possible.You should see a detection on your management portal (you may need to refresh the page), and you can select it to view more details. As you can see in my example below, I have the essentials, like the location, IP address, and information such as the internet service provider and operating system.Don't Miss:Use the Buscador OSINT VM for Conducting Online InvestigationsTo kick things up a notch, you can enable the "Smart Logger" feature by clicking the toggle switch on the web interface. The toggle enables a fake tracking page that will be able to extract a lot more information.Once "Smart Logger" is enabled, open the link again and take a look at the recorded information. This time, you should see a lot more information.This extra information can tell us a lot. For one, in my example, the internal IP address tells us that this person is likely connected to a VPN, as a standard local IP address would probably look like "192.168.0.2" or something similar. We can also see more information about the specific device that made the request, as well as the screen size and browser extensions installed.You'll also notice that you can learn if the battery is charging and what battery level is. It could allow you to track a person over a short period, with their battery level either increasing if charging or decreasing if not charging, which could identify the device uniquely. Another overlooked value is the language and time zone, which are often set by the system.Don't Miss:Use Facial Recognition for OSINT on Individuals & CompaniesIn some cases, we can see the make and model of the device making the request, allowing us to pinpoint the hardware used by the target. Any of these details may be enough to bust a catfish, either by revealing them to be in the wrong state or country, showing a device different from the one the person uses in their (probably fake) photos, or by showing a time zone that makes no sense for where they claim to be.Defeating Grabify TrackingThe tracking technology behind Grabify and other online trackers is powerful, but it isn't impossible to defeat. Much of the information obtained by Grabify is from the user-agent string, so using browser add-ons to change your user-agent string can make you look like a different type of device. With a different user agent, you can hide a lot of your details from a Grabify tracking link. Using a VPN and browser extensions, I was able to mask the country, IP address, and other information about my device.What I wasn't able to immediately change was my time zone and language, which are set by the system and weren't affected by the VPN or the browser extensions. Because my internal IP address showed a VPN connection, it's likely someone tracking me would assume my information is fake except for my time zone and language. That alone would narrow down my origin to the US and Canada, undoing much of the hard work I put into faking my location and IP address. Because of those types of leaks, it's essential to be aware of the way links like Grabify track you on the internet and what kind of details can give you away.I hope you enjoyed this guide to using Grabify to generate tracking links! If you have any questions about this tutorial on catching catfish or you have a comment, ask below or feel free to reach me on Twitter@KodyKinzie.Don't Miss:Stealing Wi-Fi Passwords with an Evil Twin AttackFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by Justin Meyers/Null Byte; Screenshots by Kody/Null ByteRelatedHow to Hack with Arduino:Defeat VPNs & Track a MacOS Computer RemotelyHow To:Make homemade catfish bait to catch catfishHow To:Catch a sharptooth catfishHow To:Troll with planer bobbers to catch catfishHow To:Catch more catfish on a fishing tripHow To:Hack Web Browsers with BeEF to Control Webcams, Phish for Credentials & MoreHow To:A Hitchhiker's Guide to the Internet: Today and Now, How It All ConnectsHow To:Make catfish bait at homeHow to Make Indian food:Fried catfishHow To:Prepare Betty's Southern oven-broiled catfish dinnerHow To:Make Thai hot and sour catfish soupHow To:Remove Facebook Ads from Internet Explorer 10 on Your Microsoft SurfaceHow To:Make your own catfish chumHow To:Make a catfish sandwich with Food NetworkHow To:Galaxy Vibrates Randomly? Use This App to Figure Out WhyHow To:Siri & Shazam Team Up to Help You Identify Songs Quicker on Your iPhone in iOS 8How To:Turn JavaScript on in Internet ExplorerHow To:Shorten links with bit.lyNews:Verizon Is Giving Away the iPhoneXSvia Snapchat AR Scavenger HuntHow To:Yahoo! Ignores IE10's "Do Not Track" Option in Windows 8—Stop Them with These Add-OnsNews:Catfish (2010)The Anonymous Search Engine:How to Browse the Internet Without Being TrackedHow To:Chain Proxies to Mask Your IP Address and Remain Anonymous on the WebHow To:Fish for catfish using flavored dip bait pasteHow To:Bait a Hook with Catfish Punch BaitNews:OutrightNews:Convicted Pervert Back in Jail for Internet Luring in SCRABBLE Chat RoomNews:Anonymity, Darknets and Staying Out of Federal Custody, Part One: Deep WebHow To:Criminal Psychology - how stalkers and pedophiles can use the internet to track youNews:SEO - Ugly Vs Popular - Just Like Highschool!How To:A Hitchhiker's Guide to the Internet: A Brief History of How the Net Came to BeNews:Robot Unicorn AttackNews:Building Links With OnlywireNews:Was Google Reader Already a Great Google Social Network?News:Affiliate Marketing Can Be A Good Way To Earn Money On The InternetNews:Catch Me If You CanHow To:Use Google's New Privacy Tools to Stop Them from Tracking YouNews:Juggling Enhances Connections In The BrainHow To:Create a Super Speed Track in MinecraftNews:A WORD TO THE WISE ABOUT REMOVING INTERNET EXPLORER