Netstalking - Revision history

Damshv at 08:58, 5 May 2021

2021-05-05T08:58:13Z

← Older revision		Revision as of 11:58, 5 May 2021
Line 8:		Line 8:
	Many would would point to the beginning of the netstalking movement to the Russian anonymous forum of Dvach, 2009 during the year it was shutdown, but the roots of the movement can be traced even further back to the year of 2008, to the spiritual predecessor of the whole movement, project 9-eyes.		Many would would point to the beginning of the netstalking movement to the Russian anonymous forum of Dvach, 2009 during the year it was shutdown, but the roots of the movement can be traced even further back to the year of 2008, to the spiritual predecessor of the whole movement, project 9-eyes.

	Project 9-eyes is a perfect example of deli-search (deliberate search) netstalking, additionally it was also the perfect project to kickstart the netstalking movement, with the dedication and effort from its creator John Rafman who spent 8 to 12 hours a day working on it, plus it is a simple premise: “randomly browsing the Google street view images in search of interesting, bizarre or shocking images that may have been accidentally caught by the Google street view car camera”, and with the wide accessibility to Google street view anybody who was even remotely interested was able to dip their toes into the world of netstalking. Once the images were located, then they would get screenshotted and later uploaded to a website for all to see.<ref>[https://9-eyes.com/]"The 9-Eyes project"</ref		Project 9-eyes is a perfect example of deli-search (deliberate search) netstalking, additionally it was also the perfect project to kickstart the netstalking movement, with the dedication and effort from its creator John Rafman who spent 8 to 12 hours a day working on it, plus it is a simple premise: “randomly browsing the Google street view images in search of interesting, bizarre or shocking images that may have been accidentally caught by the Google street view car camera”, and with the wide accessibility to Google street view anybody who was even remotely interested was able to dip their toes into the world of netstalking. Once the images were located, then they would get screenshotted and later uploaded to a website for all to see.<ref>[https://9-eyes.com/]"The 9-Eyes project"</ref>

	Project 9-eyes is still active to this day.		Project 9-eyes is still active to this day.

Damshv: minor grammar edits, added source for 9-eyes

2021-05-05T08:57:57Z

minor grammar edits, added source for 9-eyes

← Older revision		Revision as of 11:57, 5 May 2021
Line 8:		Line 8:
	Many would would point to the beginning of the netstalking movement to the Russian anonymous forum of Dvach, 2009 during the year it was shutdown, but the roots of the movement can be traced even further back to the year of 2008, to the spiritual predecessor of the whole movement, project 9-eyes.		Many would would point to the beginning of the netstalking movement to the Russian anonymous forum of Dvach, 2009 during the year it was shutdown, but the roots of the movement can be traced even further back to the year of 2008, to the spiritual predecessor of the whole movement, project 9-eyes.

	Project 9-eyes is a perfect example of deli-search (deliberate search) netstalking, additionally it was also the perfect project to kickstart the netstalking movement, with the dedication and effort from ~~it’s~~ creator John Rafman who spent 8 to 12 hours a day working on it, plus ~~its~~ simple premise: “randomly browsing the Google street view images in search of interesting, bizarre or shocking images that may have been ~~accidental~~ caught by the Google street view car camera”, and with the wide accessibility to Google street view anybody who was even remotely interested was able to dip their toes into the world of netstalking. Once the images were located, then they would get screenshotted and later uploaded to a website for all to see.		Project 9-eyes is a perfect example of deli-search (deliberate search) netstalking, additionally it was also the perfect project to kickstart the netstalking movement, with the dedication and effort from its creator John Rafman who spent 8 to 12 hours a day working on it, plus it is a simple premise: “randomly browsing the Google street view images in search of interesting, bizarre or shocking images that may have been accidentally caught by the Google street view car camera”, and with the wide accessibility to Google street view anybody who was even remotely interested was able to dip their toes into the world of netstalking. Once the images were located, then they would get screenshotted and later uploaded to a website for all to see.<ref>[https://9-eyes.com/]"The 9-Eyes project"</ref

	Project 9-eyes is still active to this day.		Project 9-eyes is still active to this day.
Line 16:		Line 16:
	Riding upon this wave of interest a book was written “Тихий дом” (Silent House), spreading the interest about netstalking even further by creating a map of network levels where mystery and unimaginable secrets dwelled at the bottom just waiting to be discovered by a lucky netstalker! An almost call to adventure, a challenge for the netstalkers! With this newest wave so called organizations started to appear, the most famous of which was “Amnesia”, an organization created in 2012, it gave rise to many famous and scandalous stories on 4stor, a website in the vein of Dvach.		Riding upon this wave of interest a book was written “Тихий дом” (Silent House), spreading the interest about netstalking even further by creating a map of network levels where mystery and unimaginable secrets dwelled at the bottom just waiting to be discovered by a lucky netstalker! An almost call to adventure, a challenge for the netstalkers! With this newest wave so called organizations started to appear, the most famous of which was “Amnesia”, an organization created in 2012, it gave rise to many famous and scandalous stories on 4stor, a website in the vein of Dvach.

	Sadly it was later revealed in an open letter from Amnesia that all the information that they claimed to have found while netstalking was fake, most of what they told the public about was mostly for attention. Interestingly enough a similar event occurred with the book “Тихий дом” (Silent House), the author said that he had gotten tired from maintaining and developing the story, he announced that everything was fiction. ~~Tho~~ rumors of them never did stop and still circulate the forums occasionally.		Sadly it was later revealed in an open letter from Amnesia that all the information that they claimed to have found while netstalking was fake, most of what they told the public about was mostly for attention. Interestingly enough a similar event occurred with the book “Тихий дом” (Silent House), the author said that he had gotten tired from maintaining and developing the story, he announced that everything was fiction. Though rumors of them never did stop and still circulate the forums occasionally.

	~~Tho~~ a movement can’t be sustained by fake rumors and publicity-stunts, netstalkers found many hidden treasures of the internet like: unique sites, net-art, ARGs. Sadly the wave wasn’t able to sustain itself indefinitely and around 2015 interest started dying, some say that due to the exhaustion of all the easier to find hidden gems of the internet the technical skill requirement went up to find anything of interest, resulting in a higher entree barrier.		Though a movement can’t be sustained by fake rumors and publicity-stunts, netstalkers found many hidden treasures of the internet like: unique sites, net-art, ARGs. Sadly the wave wasn’t able to sustain itself indefinitely and around 2015 interest started dying, some say that due to the exhaustion of all the easier to find hidden gems of the internet the technical skill requirement went up to find anything of interest, resulting in a higher entree barrier.
	Since 2016 the community has been pushing to become more accessible for newbies, group chats have been created, with the main one being the “Collection Point” that is still active, and numerous conferences. This made the community more accessible and provided an influx of new blood to the movement.		Since 2016 the community has been pushing to become more accessible for newbies, group chats have been created, with the main one being the “Collection Point” that is still active, and numerous conferences. This made the community more accessible and provided an influx of new blood to the movement.

Line 24:		Line 24:

	=Morality=		=Morality=
	While lacking a leader or an official organization, a certain unspoken ethical code has developed over the years, for example: ruining the discoveries is forbidden, do not “hurt” the owner in anyway and other common sense rules to preserve findings for the future, nobody could really enforce these rules but your reputation would be ruined, ~~tho~~ how much of a threat that really is questionable as almost anybody could just make a new account and ditch their ruined reputation.		While lacking a leader or an official organization, a certain unspoken ethical code has developed over the years, for example: ruining the discoveries is forbidden, do not “hurt” the owner in anyway and other common sense rules to preserve findings for the future, nobody could really enforce these rules but your reputation would be ruined, though how much of a threat that really is, is questionable as almost anybody could just make a new account and ditch their ruined reputation.

	The line between a skilled netstalker and a skilled hacker might just be their goal in obtaining the data they are after, so it isn’t unheard of that netstalkers would sell the data that they recovered, but that is frowned upon in the community. There is also the factor of safety to consider, what if you stumble upon information that should stay secret, for example some thing related with the mob, and if you do happen to sell it or publish it, you might have to fear for your safety, that is another reason for some of the unspoken rules in the community.		The line between a skilled netstalker and a skilled hacker might just be their goal in obtaining the data they are after, so it isn’t unheard of that netstalkers would sell the data that they recovered, but that is frowned upon in the community. There is also the factor of safety to consider, what if you stumble upon information that should stay secret, for example some thing related with the mob, and if you do happen to sell it or publish it, you might have to fear for your safety, that is another reason for some of the unspoken rules in the community.

Damshv: Edited tools section and moved the tool list

2021-05-05T08:52:20Z

Edited tools section and moved the tool list

← Older revision		Revision as of 11:52, 5 May 2021
Line 77:		Line 77:
	[[File:OSINT_framework.png\|center\|400px\|thumb\|<ref>[https://osintframework.com/]"Framework". Retrieved 03.05.2021</ref>]]		[[File:OSINT_framework.png\|center\|400px\|thumb\|<ref>[https://osintframework.com/]"Framework". Retrieved 03.05.2021</ref>]]

	==Most popular tools==		= Netstalking Tools =

			Over the years many tools, many tools have developed which the Netstalking community adopted as their mainstay, these range from open source fan projects to professional OSINT tools with subscription models, all of which fall under use-cases of Netstalking.

			=== Most popular tools ===

	<ul>		<ul>
Line 89:		Line 93:
	</ul><ref>[https://www.csoonline.com/article/3445357/what-is-osint-top-open-source-intelligence-tools.html]"OSINT tools"</ref>		</ul><ref>[https://www.csoonline.com/article/3445357/what-is-osint-top-open-source-intelligence-tools.html]"OSINT tools"</ref>

	~~= Netstalking Tools =~~

	== Nesca ==		== Nesca ==

Damshv: edited a bit of shodan/nesca to properly house the vulnerabilities screenshot

2021-05-05T08:47:56Z

edited a bit of shodan/nesca to properly house the vulnerabilities screenshot

← Older revision		Revision as of 11:47, 5 May 2021
Line 128:		Line 128:

	[[File:Shodan_interface.png\|400px\|thumb\|Shodan.io]]		[[File:Shodan_interface.png\|400px\|thumb\|Shodan.io]]

			[[File:Shodan_creenshot_vulnerabilities.png\|400px\|thumb\|More vulnerabilities than you can count]]

	Shodan is a search engine and an OSINT tool that simplifies the search and reconnaissance of potential targets. It can search by: IP address, Domain name, geolocation, server type - apache, nginx, open port type, and a myriad of other properties that can be found [https://developer.shodan.io/api/banner-specification here].		Shodan is a search engine and an OSINT tool that simplifies the search and reconnaissance of potential targets. It can search by: IP address, Domain name, geolocation, server type - apache, nginx, open port type, and a myriad of other properties that can be found [https://developer.shodan.io/api/banner-specification here].
Line 139:		Line 141:

	Following is an example of a banner<ref name="shodan_query_tutorial">[https://help.shodan.io/the-basics/search-query-fundamentals] basic search fundamentals of Shodan</ref>		Following is an example of a banner<ref name="shodan_query_tutorial">[https://help.shodan.io/the-basics/search-query-fundamentals] basic search fundamentals of Shodan</ref>
	<~~source~~ lang="javascript"~~\|multiline~~>		<syntaxhighlight lang="javascript" line>
	{		{
	"data": "Moxa Nport Device		"data": "Moxa Nport Device
Line 152:		Line 154:
	}		}
	}		}
	</~~source~~>		</syntaxhighlight>

	To find banners such as this, we can input several kinds of queries:		To find banners such as this, we can input several kinds of queries:
	<~~source~~>		<syntaxhighlight inline>
	org:"Starhub Mobile"		org:"Starhub Mobile"
	</~~source~~>		</syntaxhighlight>

	Will find all the devices owned by Starhub Mobile		Will find all the devices owned by Starhub Mobile

	<~~source~~>		<syntaxhighlight inline>
	port:"4800"		port:"4800"
	</~~source~~>		</syntaxhighlight>

	Will find all the devices with an open port of 4800.		Will find all the devices with an open port of 4800.
Line 171:		Line 173:

	=== Finding the information ===		=== Finding the information ===

	~~[[File:Shodan_creenshot_vulnerabilities.png\|400px\|thumb\|More vulnerabilities than you can count]]~~

	As already mentioned, Shodan also aggregates all the known vulnerabilities pertaining to the software running at a specific IP address. One such list of vulnerabilities is shown on the figure. This proves to be a very lucrative source of information for those with the knowledge to crack the websites, or gain unauthorized entry. From the viewpoint of a Netstalker, this report is invaluable, as gaining unauthorized entry and just looking around is what a Netstalker wants - after such a catch, the said Netstalker will either store the gathered intel in their own database, share it in a close circle of like-minded individuals, or might even collect some more data and just sell it on the Darkweb. This will not happen however, because all the vulnerabilities that were mentioned are not so easy to exploit while also getting away with it - Shodan, as any self-respecting website, logs all the activity that transpires on its premises, and in the case of misconduct, can provide the information to court, and all the experienced users of the web know that this is the rule for any OSINT platform, that is run by "someone else".		As already mentioned, Shodan also aggregates all the known vulnerabilities pertaining to the software running at a specific IP address. One such list of vulnerabilities is shown on the figure. This proves to be a very lucrative source of information for those with the knowledge to crack the websites, or gain unauthorized entry. From the viewpoint of a Netstalker, this report is invaluable, as gaining unauthorized entry and just looking around is what a Netstalker wants - after such a catch, the said Netstalker will either store the gathered intel in their own database, share it in a close circle of like-minded individuals, or might even collect some more data and just sell it on the Darkweb. This will not happen however, because all the vulnerabilities that were mentioned are not so easy to exploit while also getting away with it - Shodan, as any self-respecting website, logs all the activity that transpires on its premises, and in the case of misconduct, can provide the information to court, and all the experienced users of the web know that this is the rule for any OSINT platform, that is run by "someone else".

Maxdon at 08:34, 5 May 2021

2021-05-05T08:34:43Z

← Older revision		Revision as of 11:34, 5 May 2021
Line 1:		Line 1:

	[[File:Netstalking_logo_draft.png\|300px\|thumb\|Unofficial logo for netstalking]]		[[File:Netstalking_logo_draft.png\|300px\|thumb\|Unofficial logo for netstalking]]


			Netstalking is an activity involving browsing the depths and the fringes of the web in search of secret or difficult to access information, due to either not being indexed by search engines or it not being meant to be accessed, and then analyzing it and storing it. Information being searched for may have no value but be aesthetically pleasing or contain shocking secrets, often netstalking is done without a specific goal but with the hopes of finding something interesting.

			=History and origins=
			Many would would point to the beginning of the netstalking movement to the Russian anonymous forum of Dvach, 2009 during the year it was shutdown, but the roots of the movement can be traced even further back to the year of 2008, to the spiritual predecessor of the whole movement, project 9-eyes.

			Project 9-eyes is a perfect example of deli-search (deliberate search) netstalking, additionally it was also the perfect project to kickstart the netstalking movement, with the dedication and effort from it’s creator John Rafman who spent 8 to 12 hours a day working on it, plus its simple premise: “randomly browsing the Google street view images in search of interesting, bizarre or shocking images that may have been accidental caught by the Google street view car camera”, and with the wide accessibility to Google street view anybody who was even remotely interested was able to dip their toes into the world of netstalking. Once the images were located, then they would get screenshotted and later uploaded to a website for all to see.

			Project 9-eyes is still active to this day.

			Sadly the movement didn’t catch on in the English speaking parts of the world, but it did catch the attention of anonymous user on Dvach in and around 2009, the movement was spearheaded by the ISKOPAZI team who mainly found IP cameras around the world, a good example of net-random netstalking, even with these humble achievements it was enough to spark rumors and gossip, igniting interest in netstalking. Eventually when Dvach was shut down the movement spread with the users to other platforms, making sure that it would live on.

			Riding upon this wave of interest a book was written “Тихий дом” (Silent House), spreading the interest about netstalking even further by creating a map of network levels where mystery and unimaginable secrets dwelled at the bottom just waiting to be discovered by a lucky netstalker! An almost call to adventure, a challenge for the netstalkers! With this newest wave so called organizations started to appear, the most famous of which was “Amnesia”, an organization created in 2012, it gave rise to many famous and scandalous stories on 4stor, a website in the vein of Dvach.

			Sadly it was later revealed in an open letter from Amnesia that all the information that they claimed to have found while netstalking was fake, most of what they told the public about was mostly for attention. Interestingly enough a similar event occurred with the book “Тихий дом” (Silent House), the author said that he had gotten tired from maintaining and developing the story, he announced that everything was fiction. Tho rumors of them never did stop and still circulate the forums occasionally.

			Tho a movement can’t be sustained by fake rumors and publicity-stunts, netstalkers found many hidden treasures of the internet like: unique sites, net-art, ARGs. Sadly the wave wasn’t able to sustain itself indefinitely and around 2015 interest started dying, some say that due to the exhaustion of all the easier to find hidden gems of the internet the technical skill requirement went up to find anything of interest, resulting in a higher entree barrier.
			Since 2016 the community has been pushing to become more accessible for newbies, group chats have been created, with the main one being the “Collection Point” that is still active, and numerous conferences. This made the community more accessible and provided an influx of new blood to the movement.

			Nowadays the netstalker movement has begun to focus on network archeology and little-known networks, the art of working with search engines, the possibilities of machine analysis of large layers of information.

			=Morality=
			While lacking a leader or an official organization, a certain unspoken ethical code has developed over the years, for example: ruining the discoveries is forbidden, do not “hurt” the owner in anyway and other common sense rules to preserve findings for the future, nobody could really enforce these rules but your reputation would be ruined, tho how much of a threat that really is questionable as almost anybody could just make a new account and ditch their ruined reputation.

			The line between a skilled netstalker and a skilled hacker might just be their goal in obtaining the data they are after, so it isn’t unheard of that netstalkers would sell the data that they recovered, but that is frowned upon in the community. There is also the factor of safety to consider, what if you stumble upon information that should stay secret, for example some thing related with the mob, and if you do happen to sell it or publish it, you might have to fear for your safety, that is another reason for some of the unspoken rules in the community.

			Overall, if the community needed to be assigned a hat color, then it can be said that the community of nestalking is a white hat community as they would report unsecured sensitive date and back-doors to servers, but like in every community there are outliers so the community shouldn’t be judged based on them.


	=Open Source Intelligence=		=Open Source Intelligence=

Anpell: /* SpiderFoot modules examples */

2021-05-05T07:11:55Z

SpiderFoot modules examples

← Older revision		Revision as of 10:11, 5 May 2021
Line 264:		Line 264:
	[[File:picture2.png\|600px\|thumb\|center\|Example of SpiderFoot graph with visual representation]]		[[File:picture2.png\|600px\|thumb\|center\|Example of SpiderFoot graph with visual representation]]

	===SpiderFoot modules ~~examples~~===		=== Examples of SpiderFoot modules===
	*'''Abuse.ch:''' Check if a host/domain, IP or netblock is malicious according to abuse.ch.		*'''Abuse.ch:''' Check if a host/domain, IP or netblock is malicious according to abuse.ch.
	*'''Account Finder''': Look for possible associated accounts on nearly 200 websites like Ebay, Slashdot, reddit, etc.		*'''Account Finder''': Look for possible associated accounts on nearly 200 websites like Ebay, Slashdot, reddit, etc.
Line 276:		Line 276:
	*'''Blockchain:''' Queries blockchain.info to find the balance of identified bitcoin wallet addresses.		*'''Blockchain:''' Queries blockchain.info to find the balance of identified bitcoin wallet addresses.
	*'''BuiltWith:''' Query BuiltWith.com's Domain API for information about your target's web technology stack, e-mail addresses and more. <ref name="SpiderFoot">[https://github.com/smicallef/spiderfoot]"SpiderFoot". Retrieved 03.04.2021</ref>		*'''BuiltWith:''' Query BuiltWith.com's Domain API for information about your target's web technology stack, e-mail addresses and more. <ref name="SpiderFoot">[https://github.com/smicallef/spiderfoot]"SpiderFoot". Retrieved 03.04.2021</ref>


	==Metagoofil==		==Metagoofil==

Anpell: /* Metagoofil */

2021-05-05T07:08:40Z

Metagoofil

← Older revision		Revision as of 10:08, 5 May 2021
Line 276:		Line 276:
	*'''Blockchain:''' Queries blockchain.info to find the balance of identified bitcoin wallet addresses.		*'''Blockchain:''' Queries blockchain.info to find the balance of identified bitcoin wallet addresses.
	*'''BuiltWith:''' Query BuiltWith.com's Domain API for information about your target's web technology stack, e-mail addresses and more. <ref name="SpiderFoot">[https://github.com/smicallef/spiderfoot]"SpiderFoot". Retrieved 03.04.2021</ref>		*'''BuiltWith:''' Query BuiltWith.com's Domain API for information about your target's web technology stack, e-mail addresses and more. <ref name="SpiderFoot">[https://github.com/smicallef/spiderfoot]"SpiderFoot". Retrieved 03.04.2021</ref>


	==Metagoofil==		==Metagoofil==

Anpell: /* Some SpiderFoot modules examples */

2021-05-05T07:08:12Z

Some SpiderFoot modules examples

← Older revision		Revision as of 10:08, 5 May 2021
Line 264:		Line 264:
	[[File:picture2.png\|600px\|thumb\|center\|Example of SpiderFoot graph with visual representation]]		[[File:picture2.png\|600px\|thumb\|center\|Example of SpiderFoot graph with visual representation]]

	===~~Some~~ SpiderFoot modules examples===		===SpiderFoot modules examples===
	*'''Abuse.ch:''' Check if a host/domain, IP or netblock is malicious according to abuse.ch.		*'''Abuse.ch:''' Check if a host/domain, IP or netblock is malicious according to abuse.ch.
	*'''Account Finder''': Look for possible associated accounts on nearly 200 websites like Ebay, Slashdot, reddit, etc.		*'''Account Finder''': Look for possible associated accounts on nearly 200 websites like Ebay, Slashdot, reddit, etc.

Anpell: /* Scanning example */

2021-05-05T07:05:19Z

Scanning example

← Older revision		Revision as of 10:05, 5 May 2021
Line 260:		Line 260:
	'''Purpose''': pentestit.ru<br>		'''Purpose''': pentestit.ru<br>
	'''Result:'''		'''Result:'''
	[[File:picture1.png\|~~400px~~\|thumb\|center\|Example of SpiderFoot Search]]		[[File:picture1.png\|600px\|thumb\|center\|Example of SpiderFoot Search]]
	By clicking on the "Graph" tab, you can configure the display of a graph with a visual representation of the scan results (in this case, the forced ordering mode was selected - the "F" button), saving the results to a file is also available:		By clicking on the "Graph" tab, you can configure the display of a graph with a visual representation of the scan results (in this case, the forced ordering mode was selected - the "F" button), saving the results to a file is also available:
	[[File:picture2.png\|~~400px~~\|thumb\|Example of SpiderFoot graph with visual representation]]		[[File:picture2.png\|600px\|thumb\|center\|Example of SpiderFoot graph with visual representation]]

	===Some SpiderFoot modules examples===		===Some SpiderFoot modules examples===

Anpell: /* Scanning example */

2021-05-05T07:04:51Z

Scanning example

← Older revision		Revision as of 10:04, 5 May 2021
Line 260:		Line 260:
	'''Purpose''': pentestit.ru<br>		'''Purpose''': pentestit.ru<br>
	'''Result:'''		'''Result:'''
	[[File:picture1.png\|400px\|thumb\|Example of SpiderFoot Search]]		[[File:picture1.png\|400px\|thumb\|center\|Example of SpiderFoot Search]]
	By clicking on the "Graph" tab, you can configure the display of a graph with a visual representation of the scan results (in this case, the forced ordering mode was selected - the "F" button), saving the results to a file is also available:		By clicking on the "Graph" tab, you can configure the display of a graph with a visual representation of the scan results (in this case, the forced ordering mode was selected - the "F" button), saving the results to a file is also available:
	[[File:picture2.png\|400px\|thumb\|Example of SpiderFoot graph with visual representation]]		[[File:picture2.png\|400px\|thumb\|Example of SpiderFoot graph with visual representation]]