One of the best sources
of open-source intelligence these days is social media.
Many people tend to let their guard down
when they're posting on social media, whether it's Twitter,
Facebook, LinkedIn, YouTube, Instagram, Reddit,
or even TikTok.
By analyzing what the organization or its employees
are posting on social media,
you're going to be able to find a lot of information
that can really help in your engagements.
When you're using social media to search
for information, you should start
with the organization's own social media profiles
and their accounts.
The organization is usually going to
post marketing information
on their social media profiles, but often companies
are now providing some sort of behind the scenes type
of pictures and videos.
These more candid posts can often capture things
in the background that the organization didn't realize
was there when they recorded that video
or took that picture.
For example, I've seen an organization
who had one of their employees making a post
to their Instagram account showing
what an average day looked like,
and when the employees snapped that picture
with their front facing camera, they didn't realize
that people could actually read the computer screen
that was located behind them.
By zooming in on that picture, people were able to read
the contents of a sensitive corporate document
that was being drafted by the employee at the desk next
to the posters.
These days, it seems that everybody is on social media.
And that means you can scour and scrape social media sites
for details about an organization's employees,
from the CEO all the way down to the person working
in the proverbial mail room.
Now, some employees are going to have multiple social media
accounts as well, and this is to divide their professional,
or work accounts from their personal account.
For example, all of my employees
have a personal Facebook account
and a work Facebook account,
and they're going to use that work account
whenever they're posting on behalf of our company,
while their personal one is used
for everything else they do on Facebook.
Now, that means that most employees will be proper
and professional on their work accounts,
but if you find their personal account,
you can find the real person behind that employee,
including their interests, habits, behaviors, friends,
spouses, children, and much more.
Now, some employees even publish
their own personally identifiable information online,
including things like their full name, their birthdate,
their address, their phone number, and much more.
When it comes to social media sites, my personal favorite
for open-source intelligence research is LinkedIn,
and this is because I can find out so much
about an organization by reviewing their pages there.
First, you can find the company's own page on LinkedIn.
Let's take for example Udemy,
the massively popular E-learning company.
From their LinkedIn page, I can see
they have 5,562 employees
that have claimed a relationship with Udemy on LinkedIn.
Now, if I go to the 'Posts' tab,
I'm going to find a lot of marketing things,
and press releases and things like that.
Now, this could be helpful,
but usually it isn't really what I'm focused on
when I'm looking at LinkedIn for open-source intelligence.
Instead, I like to focus on the insights tab, the life tab,
the people tab, and the jobs tab.
First, let's look at the 'Insights' tab.
Under this tab, we can see some key data about the company,
including its total number of employees and the growth
of that employee number over past two years.
Now, in this case, I can see in the last two years
that the company has grown 62%,
but in the last six months they've only grown 5%.
Now, why is that important to understand?
Well, if the company is rapidly growing,
that's usually a time when they have worse security,
especially due to the number of new users
who aren't fully or properly trained.
Additionally, if they have a very high growth rate,
that means it's common that new people
are joining the team all the time,
and this could be a good chance for you
to conduct a social engineering campaign
that relies on impersonation, where you might pretend
to be a new hire at the company.
As you continue to look through the insights tab,
there's other valuable information here for you to see too.
For example, we can look at the distribution
of their workforce, and I can see here that the majority
of their employees are in education,
and the next highest area is engineering.
This could indicate that they're spending a lot of money
on their technical employees who might be better trained
and less likely to fall for things like a phishing attempt.
Next, I'm going to move on to the life tab.
Now, this tab is used by the company to tell their own story
about why somebody would want to work for them,
what their culture is like,
and even some of the employee testimonials
and company photos.
Next, I'll move over to the 'People' tab.
From here I can find out the breakdown of where people live,
what colleges they went to, and more importantly,
a list of the people who are currently working for Udemy.
This can be your springboard into a deeper dive
on an individual that you might want to target
as part of your engagement, or you might try
to identify their system administrators,
their engineers, and their security professionals,
and see if they regularly post to LinkedIn.
Now, many people in technical careers like to post
to LinkedIn about the challenges they're facing at work,
and if they're having a work-related project
that's challenging or they overcame it,
they may go ahead and post about that to celebrate
how they overcame that challenge and maybe even detail
the solution they used.
This can be great information
for a penetration tester to have,
especially when it comes from the technical personnel
of that targeted organization.
Finally, I'm going to move into the 'Jobs' tab,
and this is my favorite tab.
As we look at the jobs tab, we can see every job posted
by this organization.
Currently, there are 307 job openings available,
and I can search through all of them with a few keywords
to find what I'm looking for.
For example, let's say I want to determine
which cloud service provider Udemy is relying
on to provide their infrastructure,
I can simply type in the word "cloud,"
and see that it filters down from 307 postings
down to a more reasonable number of 29 postings.
Next, I want to start clicking
through some of the positions.
The first position is listed as a 'Senior Systems Engineer.'
As I look at that job description, I don't see anything
that mentions whether they're using AWS, Azure
or Google Cloud, but I do see that they're using JAMF,
and Intune for Windows OS patching
and that they're seeking somebody who has experience
in Mac OS X device management,
and this tells me they're not just a Windows only company,
so we're going to have to conduct
some vulnerability scanning
and exploitations against their Mac systems too.
All right, let's move on to another position.
Let's say, for example,
we look at the 'Security Architect' position.
In this position description, I can see they're focused
on programming and development experience,
but they're not very specific
in which single language they're using.
Instead, they list out things like Python, Go, Ruby, Java,
JavaScript, et cetera.
Now, this isn't as helpful, unfortunately
because it's really too vague for me
to know exactly what they're using
in their system development.
As we keep looking, though,
we're also going to see they want experience
with cloud service provider platforms such as AWS, GCP,
Azure, and automation tools.
Now, again, this is really vague as well,
so it's not that helpful.
Now, there's really two reasons a company
would be this broad on their job description.
The first is that they are very security conscious
and they don't want to let attackers and penetration testers
know what type of tech stack they have
and what all their different languages look like
that they're using in their software development,
and so they're trying to prevent us
from gaining enough information
by looking at these job postings.
Now, personally, I don't think that's the reason
because most companies aren't that smart,
and so as we continue to look at other job postings,
we can probably find one that tells us a little more
about what we're looking for.
Now, the second reason that they're going to be this broad
and vague, and this is probably the more accurate one
in the case of Udemy, is that finding security architects
and programmers in the San Francisco California area
is really challenging, so the company
is probably being very open to anybody
who has the basic skillset needed.
Since once you learn a language like Java or Ruby,
you can pick up another one and it's not too difficult.
The same holds true for cloud platforms.
Once you use AWS or Azure,
learning the other one isn't too bad,
and I think that's more likely why this post
is being so vague.
It's because of a talent crunch
and they're having difficulty hiring for this position
if they're very specific on what their needs actually are.
All right, so we're going to go ahead
and click around until we find one that helps us.
I'm going to go and jump down to the 'Senior Cloud Engineer'
this is probably a good one
because we're talking about cloud
and that was what I was looking for.
Now I bet here we're going to be a bit more specific
in the requirements as well.
Now, in this position, we see some generic information
about a cloud engineer, and then in the second paragraph
it says, "Our primary environments and tools include AWS,
GCP, VMware, Dell computer/storage,
VSAN, Terraform, CloudFormation, Atlantic,
Ansible, Datadog, and GitHub."
That's a pretty good list of their tech stack
and their different development tools,
and one of the things I noticed in there that wasn't listed
is Microsoft Azure, so we know Azure
is not one of the cloud tools they're really focused on,
and this tells me they are using a multi-cloud
infrastructure though because I did see AWS
and Google Cloud being listed.
Now based on my reading of that,
it seems that they're primarily on Amazon Web services
and they're using Google Cloud for a backup,
but that's just my guess at this point.
Now, if we look down a little bit further
at the requirement section, you're going to see
that it states a "good level of experience with AWS
and cost management experience a plus."
This confirms my suspicion
that they're probably using AWS primarily.
So, now that I gather this intelligence,
what does it tell me?
Well, I'm going to have to think about
how I'm going to test things during the engagement,
and I'm going to want to make sure that I have someone
on the team who's familiar with AWS penetration testing,
and we need to make sure to get AWS's permission
before we start doing those tests.
Also, since they're using AWS for their cloud,
that means I can use something like Pacu,
which is an open source, AWS exploitation framework
during my engagement against their AWS technical stack.
I think you can see now why I love job posting so much
during the reconnaissance phase
because you can find so much great information
that's open-source within them.
This includes things like the personnel
who are making up the departments or teams,
including the hiring managers.
You might be able to find the lack of qualified personnel
in critical positions.
For example, we saw this organization needs
a new security architect and a cloud engineer,
and that means they either lost those people
and they're looking for replacements
or they're growing rapidly,
and either of those are things we can take advantage of.
We can also find the level
of technical capability they have.
Again, this is based off those job postings,
what level of education are they posting as requirements?
We can also figure out what software architecture
and services are used.
We can figure out what programming languages are used.
We can figure out the types of hardware they use.
We can find out
the types of security systems they've fielded.
All of this is stuff we can find inside
of these job postings if we just go out and look for it.
In addition to LinkedIn, there's lots of other places
to gather information about the people
who work at that company
and the positions they're hiring for.
Sites like Monster, ZipRecruiter, Indeed, Glassdoor,
and many others are a great place for you to look
as you're looking for more information
on your targeted organization.