-: It's time to get creepy. 2 2
In this lab on reconnaissance, 3 3
we're gonna learn about the power 4 4
of harnessing social media sites 5 5
for information gathering. 6 6
We're gonna use a tool called Creepy. 7 7
It's an open source intelligence tool 8 8
that gathers geolocation information 9 9
from a variety of social networking platforms, 10 10
including Twitter, Flickr, 11 11
Instragram, and Google+. 12 12
Creepy gives us the ability 13 13
to gather all the information 14 14
from all of these social networking sites, 15 15
present them in a graphical format on a map, 16 16
and allow us to search that 17 17
based on location or date. 18 18
This allows us to create, what we like to call, 19 19
a pattern of life. 20 20
We'll determine what our target was doing, 21 21
when they were doing it, 22 22
and where they were doing it. 23 23
You might wonder why I need to know 24 24
all of this information. 25 25
Well, part of a hack sometimes comes down 26 26
to having physical access to the facility. 27 27
And if we need to gain physical access, 28 28
we're gonna really need to know 29 29
when our victim is and isn't at home. 30 30
Creepy allows us to build that pattern of life 31 31
to determine the best time to conduct our attack. 32 32
Creepy's available for Linux, 33 33
Windows, and Macintosh systems. 34 34
Creepy used to be loaded by default in Kali, 35 35
but the latest version, you actually have 36 36
to download and install it yourself. 37 37
We're gonna walk through that in a minute 38 38
since we're all gonna be using Kali 39 39
as our attack platform, 40 40
but you can also download and install this 41 41
to your Windows or Mac machine if you want instead. 42 42
Since Creepy does require internet access, 43 43
we're gonna reconfigure our network adapter 44 44
on our Kali-Linux virtual machine. 45 45
If your virtual machines aren't already open, 46 46
you're gonna need to open VirtualBox at this time. 47 47
From the VirtualBox Manager, 48 48
we're gonna select our Kali machine. 49 49
And then we're gonna click on Network. 50 50
From here, we're gonna select our Internal Network, 51 51
which prevented us from reaching the internet. 52 52
And making it go to NAT. 53 53
This stands for Network Address Translation, 54 54
and will actually allow the virtual machine 55 55
to use the network adapter of your host machine. 56 56
And then select OK. 57 57
At this point, we're gonna power on our Kali machine 58 58
and we'll have internet access. 59 59
To begin to install Creepy, 60 60
we're gonna open the terminal. 61 61
We're gonna use PIP to install the application. 62 62
But first, we're gonna upgrade PIP. 63 63
So do: pip install 64 64
upgrade pip 65 65
Next, we're gonna install Creepy. 66 66
To install Creepy, we're gonna do: 67 67
pip install -U pytz python-qt flickrapi 68 68
python-instagram yapsy tweepy google-api-python-client 69 69
python-dateutil configobj and dominate 70 70
Next, we're gonna need to download 71 71
the Creepy software itself. 72 72
So next we're gonna open up Firefox 73 73
and go to: github.com/jkakavas/creepy/tarball/master 74 74
to download the source code. 75 75
And then we'll save the file. 76 76
It's gonna go into the Downloads folder. 77 77
And from here, we're gonna unzip the tarball 78 78
by using tar -xvz and then the name of the file. 79 79
You'll see that now we have a folder for that. 80 80
So we'll go into that folder. 81 81
Next, we're gonna go into the Creepy folder. 82 82
And from here, we're gonna run CreepyMain 83 83
by doing: python CreepyMain.py 84 84
Now from here, before it will work, 85 85
we're gonna have to set it up 86 86
with our particular social media accounts. 87 87
So we're gonna go up to Creepy, 88 88
and then go to Edit, Plugins Configuration, 89 89
and from here, we're gonna run the Configuration Wizard. 90 90
For our example, I'm just gonna use Twitter. 91 91
Click on Next. 92 92
And then authorize the app. 93 93
You'll need this PIN - type it in the bottom. 94 94
And then click Finish. 95 95
And now our Twitter is gonna be set up. 96 96
You do the same thing 97 97
for Flickr, Google+, and Instagram. 98 98
Now if you want to make sure it works, 99 99
you can try the Test Plugin Configuration. 100 100
And it will tell you if it's able 101 101
to reach Twitter through the api. 102 102
And then hit OK. 103 103
So now at this point, 104 104
we're gonna create a new project 105 105
which is gonna be set on our target set. 106 106
So I'm gonna go to Creepy and go to New Project. 107 107
I'm gonna do a Person Based Project. 108 108
I'm gonna give it a name. 109 109
In my case, and you can follow along, 110 110
we're gonna use TitanCipher. 111 111
T I T A N C I P H E R 112 112
It's a website that I own 113 113
as well as a Twitter handle that I have, 114 114
that I use for hacking competitions, 115 115
and I've dropped some hints there 116 116
for us to play with in this example. 117 117
Some keywords we're gonna use 118 118
are things like titan cipher, 119 119
both with spaces and without, 120 120
and then things like hacking or anything else 121 121
that has to do with that company, 122 122
in this case, TitanCipher is a hacking handle, 123 123
so I'm gonna throw that in there. 124 124
And then for a description, 125 125
this is just for your notes for later, 126 126
I'm gonna do: Person-based project for TitanCipher. 127 127
And then we will hit Next. 128 128
What are we gonna search for? 129 129
Well, I'm gonna search for Twitter 130 130
and I'm gonna search for their user name, 131 131
in this case titancipher. 132 132
Now you can just go to Twitter.com/titancipher 133 133
and you'll be able to find them, 134 134
but I wanna look for them, 135 135
I can look for 'em by email address, 136 136
their full name, their ID, their user name, 137 137
anything of that nature. 138 138
And I can search across all those platforms. 139 139
In this case, I'm gonna go ahead and Search. 140 140
And I did find one that is a Twitter-based one 141 141
that is TitanCipher. 142 142
So I'm gonna add him to my targets. 143 143
And then at this point, I'm gonna click on Next. 144 144
I can look at things that he's retweeted, 145 145
I can exclude replies. 146 146
In my case, I'm gonna leave the replies on 147 147
because I want to find as much information as possible. 148 148
And then I'm gonna hit Next. 149 149
And then Finish. 150 150
So, you're gonna click on Analyze Current Project 151 151
and you'll be able to find everything 152 152
that this person has done. 153 153
So I'm gonna zoom out. 154 154
And I see that there's stuff here in Glen Burnie, 155 155
there's some stuff here in Fort Meade, 156 156
both of these being in Maryland. 157 157
Only have a couple tweets there, you see there's two. 158 158
There are some up here 159 159
in the New York/New Jersey area. 160 160
If I zoom out, I'll see some that are in Colorado. 161 161
And you'll see there's a big pocket here, 162 162
in what looks like Hawaii. 163 163
So we can pick any of these to look at. 164 164
And we can actually search based on location 165 165
if there's something we were interested... 166 166
For instance, if it was a company's headquarters, 167 167
we might look at that location 168 168
to find out what tweets across the internet 169 169
have been done at that particular company's headquarters. 170 170
And so any employee who's tweeted 171 171
with their geolocation on, 172 172
we can start creating patterns of life on that. 173 173
In my case, I'm going after a person's pattern of life. 174 174
If I roll over to the side here, 175 175
you can see... 176 176
We can scroll this date back a little bit, 177 177
you can see that we had Fort Meade, Maryland, 178 178
New York Liberty International Airport, 179 179
Pearl City, which is in Hawaii, 180 180
Laie, Honolulu, Honolulu, Honolulu, 181 181
lots of tweets in Honolulu. 182 182
A hotel in Honolulu, Colorado, 183 183
again an airport, and then Baltimore/Washington. 184 184
And if you look at the times, 185 185
you can see when these happened. 186 186
This was early November. 187 187
And then going up, it got later and later 188 188
as the days went on that 189 189
this person was tweeting. 190 190
So in our case, let's go ahead 191 191
and open up Newark International. 192 192
So in this case, we had a tweet that said, 193 193
Can you guess my flight number? 194 194
Now if we pull up this person's actual tweet, 195 195
if we click on the tweet, 196 196
we can see where the original tweet was. 197 197
And the question was, 198 198
can you guess my flight number. 199 199
So let's click on their tweet. 200 200
It will open up with our web browser. 201 201
And we can see the person 202 202
was waiting to board a plane. 203 203
We have two pieces of information. 204 204
We have their gate numbers C114 and C115. 205 205
We have also, there's a United sign here, 206 206
so maybe it's a United flight, makes sense. 207 207
And then we also know when they tweeted this, 208 208
which was 17 November, 2016 at 3:56 AM. 209 209
So, do you think we could start Googling around 210 210
and find out what this person's flight number was? 211 211
Well, they're probably either at C114 or C115. 212 212
So we seem to have a lot of Honolulu tweets. 213 213
So we can see they're sort of in a downtown area. 214 214
And we can start looking at 215 215
what buildings are around there, 216 216
what time of day. 217 217
So as this person would move around, 218 218
have different tweets, 219 219
maybe they are lunch every day 220 220
at this building over here, 221 221
but they worked in this building over here. 222 222
You can start figuring out that time of day 223 223
and the way that the person does. 224 224
Now the thing you have to be 225 225
a little bit careful with, with this geolocation, 226 226
is it does it based off cell phones. 227 227
So in the case of this person, 228 228
if we zoom out, 229 229
you can see that they're 230 230
kind of on the side of this mountain ridge here, 231 231
which is actually one of the craters in Honolulu, 232 232
and the downtown area is over here, 233 233
and there's some tweets over here as well. 234 234
In this case, this person may 235 235
be tweeting from anywhere in this area. 236 236
And the reason why is, the cell phone tower 237 237
that does the location... 238 238
There's a lot of cell phone towers 239 239
up on the ridge of this mountain, 240 240
so that can actually throw things off for us. 241 241
So if we look down here, we have a status. 242 242
Do you have any idea 243 243
where I'm staying this time around? 244 244
We click on that. 245 245
We can look at the actual status itself. 246 246
And we can start getting clues. 247 247
There's this waterfall, 248 248
which is probably something we can see. 249 249
There's this tower number, 250 250
and then, of course, 251 251
they even translated it for us 252 252
into the actual properties, 253 253
which is the Aston Waikiki Banyan. 254 254
Now using this information 255 255
to create a pattern of life is helpful. 256 256
Let's assume that this person that we're targeting 257 257
lives in Washington DC, 258 258
but we're now seeing that they're tweeting 259 259
from a place like Hawaii. 260 260
If we need to gain physical access to their office, 261 261
this might be a good time 262 262
to conduct that attack, right? 263 263
Of course it is 264 264
because now they're halfway across the world. 265 265
They're less likely to catch us. 266 266
What if instead, we developed a pattern of life 267 267
showing that the office staff 268 268
tended to take lunch every day between 12 and one? 269 269
Well, this might be the best time 270 270
for us to conduct an attack, 271 271
because there's less people in the office 272 272
and less staff means less eyes looking for us. 273 273
This is a good time to break in. 274 274
These are type of things 275 275
that we're gonna piece together 276 276
using a program like Creepy. 277 277
It helps us give one piece of information, 278 278
and we add another piece, 279 279
and another little bit here, 280 280
and bit there, until we put all these bits together 281 281
to create this fuller picture of the situation. 282 282
Now Creepy only gives us the information 283 283
on people and location, 284 284
not a whole lot about the network itself. 285 285
Next, we're gonna begin using open source intelligence 286 286
on the network itself, 287 287
so that we can gather the information 288 288
we need for our attack. 289 289
After all, the reconnaissance phase 290 290
is where we're gonna spend 80% of our time. 291 291
Preparation is key to the successful hack.