Texas A&M Cybersecurity Center
Lab Author: Judson Salinas, CSCE '26
Lab X: Open Source Intelligence
Lab Goals
- Understand the concept of Open Source Intelligence (OSINT)
- Learn advanced google search techniques to find publicly available information.
- Use OSINT tools and methods to extract useful data
- Understand the ethical considerations and potential risks associated with Google Dorking
Introduction
- Open Source Intelligence (OSINT) is the process of gathering and analyzing publicly available information to answer questions, make decisions, or assess threats. Open source data includes the internet, social media, public records, and more. OSINT is commonly used in cybersecurity, law enforcement, and journalism to gather information about individuals or organizations.
- Google Dorking is a technique used to narrow searches, and find specific information on the internet using advanced google queries. It involves using search operators to refine searches and uncover data that might not readily apparent.
Task 1: Finding Information Online
- Can you find the lab authors Texas A&M email?
- Hint: Does A&M Provide a way to search Students?
Deliverables: The Lab Authors Texas A&M Email
If you found it, congrats! You are already able to apply and use basic OSINT techniques for finding information online.
Using tools such as the Texas A&M Student Directory, or searching on an email service are all ways of using technology to gather and analyze information available to you. By querying these sources with information you do have (Name, Major, Class Year) you are able to extract information that may not be readily apparent online.
Task 2: Google Dorking
Google Dorking is a technique that uses advanced search queries to find specific information on the internet. This technique can reveal exposed databases, login portals, web cameras, and more. All of which are publicly available, but not easily discoverable.
Introduction
Some basic Google Dorking operators are,
- ‘site:’ , restricts search to a specific domain
- ‘filetype:’ , searches for files of a specific type (PDF, DOCX, etc)
- ‘intitle:’ , searches for words in the title of pages
- ‘inurl:’ , searches for words in the URL itself
These help narrow down search results making it easier to find information on a specific subject.
A search like,
site:tamu.edu filetype:pdf "Cybersecurity"
could help find specific pdf documents A&M has published on cybersecurity.
Another example is,
inurl:"ViewerFrame?Mode="
which can be used to find publicly available web cameras, using a common phrase in Panasonic camera’s web portal URL.
Deliverables
- Using the inurl:“ViewerFrame?Mode=” query, find and document 3 publicly available webcams
- Use Google Dorking operators to find login portals on the “tamu.edu” domain. Provide the URL and describe the Google query used to find it (Hint: what word would most LOGIN portals have in the url?)
Task 3: Reverse Image Search
Reverse Image Searching is a technique that allows you to trace the origin of an image using tools which crawl the internet to find identical or similar images. This can be useful for verifying the originality of an image, finding the original source, or where else the image was used online.
Introduction
Some tools that can be used for Reverse image searching are
- Google Lens: A built in reverse image searching feature by Google
- TinEye: A reverse image search engine that is often most accurate compared to other tools
- Yandex Images: Provides robust reverse search capabilities, finds more unrelated but similar images that others often miss.
Deliverables
- Preform A reverse image search using tools like Google Images or TinEye.
- List any websites where this images appears, or other edited versions of the image.
Task 4: Social Media
As our lives become more digital, Social Media accounts can often reveal answers to security questions or expose other sensitive details. The information we share, can be pieced together to reveal a detailed profile of a person that could be exploited by attackers.
Introduction
Online Accounts often use security questions for account recovery. These questions often use personal information such as your mothers maiden name, pet names, birth place, or favorite activities.
In this task, you will analyze your own social media presence to identify any personal information that could be exploited and learn how to better protect your information online.
Deliverables
- What potential security questions can be answered using information from your social media accounts?
- Based on what you found, what changes should you make to your profiles to better protect your sensitive information?
Task 5: Hidden Flag Search
I’ve hidden a secret flag on my website. The flag follows the format ‘tamuCYBR{flag_here}’.
Your task is to apply the techniques you’ve learned so far to find the secret flag hidden on judz.net, perhaps theres more than one…
Deliverables
- What is the Flag?
- Describe the methods used to find the flag.
- Were there any other secrets hidden in the webpage?