How to Track Down a Tinder Profile with Location Spoofing on Google Chrome « Null Byte :: WonderHowTo

Dating websites allow you to see a person in a very intimate context, framing their successes and accomplishments in life to an important audience. The information contained in these profiles often can't be found elsewhere, offering a unique look into the personal life of the user.If you know where a person hangs out, you can use a GPS-spoofing extension in the Chrome browser to locate their Tinder profile from Windows or macOS.From the point of view of an open-source intelligence (OSINT) researcher or hacker conducting recon, dating websites are a unique collection of searchable databases. Researching a target via dating websites can reveal a few kinds of information that are useful for a hacker.Don't Miss:Use a Virtual Burner Phone to Protect Your Identity & SecurityPeople often use the same screen names, and you can often track a person across the internet just from finding a frequently used alias. Since many users also link theirInstagramprofile, intercepting a screen name can be the key to someone's entire online existence if they tend to reuse the same one.Google Image Search Is PowerfulAnother factor that you can use to dig deeper into a person's life is the profile pictures on Tinder. The dating app allows several photos to be posted, thus gives many opportunities to reverse image search each profile photo to locate other accounts, even if they have different screen names. This can lead to a break like another alias or other more official accounts.Image by Kody/Null ByteFinally, people don't tend to be very creative when it comes to their personal descriptions. Often, they will simply copy and paste them, which can make it easy to use the same mistakes or grammar in the text to locate them on other websites. Most people have mistakes they constantly make while typing, and these can tie them to other accounts when they reuse portions of text with unique misspellings and mistakes with a regular Google search.Dating Profiles Are a Lot More Public Than You ThinkWhile Tinder has long been available asa mobile app, most users aren't aware the site now allows access from a desktop computer in a web browser. We can use this access to quickly spoof our location in Google Chrome, allowing us to appear near where we expect a user to be and begin filtering through profiles. Since we can do this easily from anywhere, the only information we need to start this kind of attack is an idea of what the target looks like and a general idea of where they live, work, or hang out.Don't Miss:How to Keep Your Internet Traffic Private from AnyoneWhile many dating services can be rather creepily abused on the API level, Tinder allows us to do some basic investigations in a web browser that even a beginner can get started with. To get started, you'll need to have downloaded and installed the Google Chrome browser, as well as an extension calledManual Geolocation.Step 1: Install the Location Spoofing ExtensionThe first step will be enabling our computer to "lie" about its location to Tinder. This is important, as it gives us the ability to search a specific area for a person or persons. If our goal is simply to identify employees of a company, placing ourselves directly on their company headquarters to discover employees on Tinder might be the way we start.To do this, we'll need to download the Manual Geolocation extension from theChrome Web Store. Add the extension and accept any permissions it needs, and you'll see an icon appear in the top right of your add-ons bar.Step 2: Spoof Your Location to That of the TargetTapping the icon for Manual Geolocation will open a map that allows us to select the location our browser will report to any website it visits, in this case, Tinder. Select the location your target is in by double-clicking the location on the map.You can grab the map with the mouse and move it to refine your location. Lastly, click the on/off switch at the top right of the Manual Geolocation window to switch the extension on.Step 3: Register a Tinder Account from Our Spoofed LocationNow our browser will give this information as its location when we visit any website, and Tinder will think we are in the location we've specified. We can also adjust the accuracy here if you're less sure of the area.When this is done, navigate to Tinder and wait until the page below loads.Click on "Log in with phone number" to create our account. You can use a Google Voice number here, as services like Burner won't work.Don't Miss:How to Use Google Voice as a 'Burner' NumberOnce you enter your Google Voice number, it will send you a text with a code to confirm you own the number. When you receive it, enter it in this field.Step 4: Create a Profile with Your Target in MindYou'll need to consider your target and enter information that will pass without a second glance if you only want to passively surveil the target. If you want the target to interact with you, then it's best to create a profile that will wildly excite them.Below, you'll see my secret template for the ultimate honeypot profile. In general, men like a woman who is classy, but approachable, experienced, and perhaps a little sad. Make sure to use a free-domain image to do this, as we've picked an image from Flickr that's free to use (photo byQuinn DombrowskiviaCC BY-SA 2.0).Once you've created a profile, click "Continue" to fire up your new identity. Edith hits the streets like a hustler, sweeping up the profiles of nearby lonely hearts and thrillseekers.Step 5: Get Specific with Discovery SettingsOur Edith profile will just grab anyone nearby, so we'll need to let Tinder in on what our profile is interested in seeing. Click on "My Profile" on the top left corner to open our filter settings.Once we're in our discovery settings, you need to let Tinder know that Edith is here to meet people exactly like your target, so input the age of the person you're looking for here. You'll need to specify a range, so try to put the actual age of the target in the middle.Set the maximum distance to 1 unless you're monitoring a very large area, as you'll sweep up a lot of random profiles otherwise. Click on the back button in the top left to send Edith on patrol.Step 6: Start Sweeping the LocationWe'll start to see the profiles of anyone in the area that meets our filter settings. Each profile will allow you to expand it to see more information, which can be very useful for correlating a person to another site. If we're a hacker monitoring a company for employees in Tinder, this gives us the opportunity to find a variety of different vectors to attack.If we're searching for a specific person, we'll need to exhaust the options the current filter set gives us until we're sure our target isn't there. We can do this by swiping left or right, it doesn't really matter. The point is to keep looking until we find our target. If we don't, we can also try looking in another location or wait for a while to see if the target logs on.Step 7: Corrolate Target Data from a ProfileWhen we find our target, you can click on their profile to pull up more information. This is where you will find additional photos to reverse image search and link to other profiles. As you can see below, the stock photo we used turned up a lot of results. Finding other places an image exists can also frequently locate screen names and other correlating information that will lead you to other breadcrumbs of online data.If you made your account interesting enough to the target, your subject may even contact you. This allows you to ask questions or take a more active role in finding information, but that would also make you a catfish. Edith is just here to look, not touch, so once you cross that line, you're no longer conducting passive surveillance.If, however, you're concerned about a profile being legitimate or not, or if it's simply a torso picture that could be your target, a direct line of contact to test if they are who they say they are might be your best shot to confirm the information you've found. Since this is a more active technique, it falls outside the scope of this guide.Step 8: Change Location & Sweep a New AreaIf your target has moved location or updates social media by tagging themselves somewhere known, you can adjust your location on Tinder by clicking the Manual Geolocation extension icon in the browser toolbar again and selecting the new location the way you did before.Rather than just refreshing, we'll need to close the tab and open a new one. Then, navigate to Tinder again, and your location should be updated with the new location Chrome has supplied it. We can repeat this process to send Edith on a search of each one-mile radius area we suspect the target may be lingering in, pulling in anyone who matches the age of our target.Think About Prying Eyes When Writing Your ProfileAnyone can create a Tinder profile, but most people forget that they can be found by anyone interested in them specifically (or somewhere they work). While we covered simply finding a profile in a way that should leave the target no indication they've been found, many hackers see dating profiles as a legitimate point of entry for phishing and social engineering attacks. If someone can find you, they can contact you too.When writing a profile, ask yourself a few things. Where else do I use this photo? Google image search is a powerful tool. Where else do I use this profile text? And finally, do I mention a screen name that I use in many other places?If you work somewhere important and mention it, this can also create additional risk. Both hackers and penetration testers love finding a profile stuffed full of information, so don't make yourself an easy target for a malicious stranger.Dating Websites Were Never Off-LimitsIt's no secret that dating websites have been used by police, spies, criminals, researchers, and various others for things other than originally intended since their inception. This is undesirable behavior on a site like Tinder, but when done in the context of a researcher, a light touch can go a long way in revealing information about a target.Building a profile to a human target is multi-faceted. The best way to thinking about it is finding far-flung but connected puzzle pieces of data to fill in an overall picture of what that person's actual and perceived life is like.Some people may feel very differently about their position in life than the data about them suggests, either because they perceive their own situation radically different than it is or because we have incomplete data to understand important details about their outlook. Many times, data found within dating profiles can provide that missing context to understand how a person thinks.Don't Miss:How to Research a Person or Organization Using the Operative FrameworkIf you're interested in learning more about these kinds of research techniques, check out open-source research (OSINT) resources like "Open Source Intelligence Techniques: Resources for Searching and Analyzing Online Information."The OSINT community is awesome and has inspired me to keep doing these tutorials. The best way to be involved is to be part of the conversation on ourTwitter,YouTube, and in the comments below. If you have any questions about this tutorial, feel free to leave a comment or reach me on Twitter@KodyKinzie. We'll be doing more guides on OSINT research techniques, so stay tuned.Follow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHow To:Reorder Profiles & Reset Matches in TinderNews:Tinder's New Update Puts the Emphasis on LooksHow To:Fake Your Location if Your Parents Installed a GPS Tracker on Your Android PhoneHow To:Set Privacy-Focused DuckDuckGo as Chrome's Default Search Engine on Your PhoneHow To:Top 10 Browser Extensions for Hackers & OSINT ResearchersNews:Tinder Gold Allows Users to See Everyone Who 'Likes' Their ProfileHow To:Get Real-Time Info on Friends Around You (Including Exact Location) Using Your iPhoneHow To:Get Back Avatars in Chrome to Switch User Profiles More EasilyHow To:Change Downloading Location from Google ChromeHow To:Fake Your GPS Location on Android to Trick Apps & Targeted AdsHow To:Your Chrome Extensions May Be Stealing Your Personal Info: Here's How to Stop ThemHow To:Stop Retail Stores from Tracking You While Shopping with Your Galaxy Note 3How To:Get the Chrome Experience on Android Without Google Tracking YouChrome 101:How to Set Your Privacy & Choose Which Data to Share with GoogleHow To:Change Google Chrome's Default Search Engine on Your iPhone or Android PhoneHot or Not:The Original Ego Scaler Is Now on Android, iOS, & WindowsHow To:Chrome Shares Your Activity with Google - Here's How to Use Comodo Dragon to Block ItHow To:Search for Google+ Profiles and Posts Using Chrome's Search Engine SettingsHow To:The Official Google+ Insider's Guide IndexNews:Google Chrome Web Store Gets New LookHow To:Search for Google+ Posts & Profiles with GoogleNews:Shooting an X-Men Spoof with the New Canon DSLR Technicolor CineStyleGoogle+ Pro Tips Round Up:Week 4News:Add your Facebook stream to Google+How To:Prevent Social Networks from Tracking Your Internet ActivitiesNews:Fix Your Google+ Frustrations with 18 More Chrome ExtensionsNews:Getting to Know Google's Community ManagersNews:Google+ Pro Tips Weekly Round Up: Google+ Is GoogleHow To:Hide the Facebook News Ticker in Firefox and Google ChromeHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android DeviceNews:Google+ Pro Tips Weekly Round Up: Google Adds Google+ ExtensionsThe Anonymous Search Engine:How to Browse the Internet Without Being TrackedHow To:Reduce the Noise in Your Social StreamsGoogle+ Pro Tips Round-Up:Week 1News:10 Chrome Extensions to Jumpstart Your Google+ WishlistNews:X-Men - Shot with Technicolor CinestyleHow To:Use Google's New Privacy Tools to Stop Them from Tracking YouGoogle+ Pro Tips Round Up:Week 6News:22 Google Chrome Extensions to Make Google+ Even BetterHow To:Stop "Liking" and Start Google +1ing