## OSINT Tools Workshop

Let's get hands-on with the essential toolkit.

### 1. Google Dorking
Using advanced search operators to uncover hidden data.
*   `site:`: Limit results to a domain.
*   `filetype:`: Look for specific files (pdf, docx, xlsx).
*   `inurl:`: Look for text in the URL.
*   `intitle:`: Look for text in the page title.

**recipes**:
*   *Find Sensitive Files*: `site:target.com filetype:xlsx "password"`
*   *Find Login Portals*: `site:target.com inurl:login`
*   *Find Open Directories*: `intitle:"index of /" "parent directory"`
*   *Public Trello Boards*: `site:trello.com "password" OR "credentials"`

### 2. Shodan.io
"Google for the Internet of Things". It scans the entire internet (IPv4) 24/7.
*   **Webcam**: `Server: SQ-WEBCAM`
*   **Industrial Control Systems**: `port:502` (Modbus)
*   **RDP (Remote Desktop)**: `port:3389`
*   **Vulnerability**: `vuln:CVE-2017-0144` (Finds EternalBlue vulnerable hosts).
*   **Filter**: `org:"Target Corp" port:443`

### 3. Maltego
A link analysis tool used to visualize relationships.
*   **Input**: A domain (e.g., `google.com`).
*   **Transform**: A script that runs on the input (e.g., "To MX Record").
*   **Output**: The mail server node.
*   **Use Case**: Mapping an entire criminal infrastructure from a single email address.

### 4. The Wayback Machine (Archive.org)
The internet never forgets.
*   **Defacement**: See if a site was hacked in the past.
*   **Job Posts**: Find old job descriptions listing specific software versions that are now vulnerable.
*   **Deleted Code**: Developers often post secrets (API Keys) to Pastebin or Github and then delete them. Archive sites might catch them.