 |
| From Google Dorking to Metadata Extraction |
From Google Dorking to Metadata Extraction - Explore how OSINT professionals use Google Dorking, metadata extraction, and advanced tools to gather intelligence. Learn real world applications of technical OSINT in cybersecurity and investigations.
In today’s digital age, information is abundant but only if you know where and how to look. This is where Open Source Intelligence (OSINT) comes into play. Beyond simple keyword searches, OSINT leverages technical methods such as Google Dorking and metadata extraction to uncover hidden insights.
What is Technical OSINT?
Technical OSINT focuses on deep, systematic collection and analysis of digital traces. Unlike surface level searches, it employs advanced queries, metadata forensics, and infrastructure analysis to reveal data not easily visible to casual user.
Examples of technical OSINT include:
- Google Dorking (advanced search operators)
- Domain and infrastructure reconnaissance
- Metadata extraction from documents and images
- Email, username, and IP tracing
1. Google Dorking
Google Dorking is use of advanced search operators to find information not indexed in plain view.
-
Examples of Dorks:
-
filetype:pdf site:gov "confidential" -
intitle:"index of" password -
site:example.com inurl:login
-
-
Applications:
-
Discovering sensitive files left publicly accessible
-
Finding login portals or directories
-
Identifying forgotten or exposed infrastructure
-
Tools to Automate: Google Hacking Database (GHDB), SearchDiggity
2. Metadata Extraction
Metadata is hidden information embedded in digital files documents, images, or videos.
-
Tools: ExifTool, FOCA, MAT2
-
What Metadata Reveals:
-
Author or creator names
-
Device information
-
Geolocation (GPS coordinates in photos)
-
Timestamps of creation or edits
-
-
Use Case:Investigators have successfully geolocated photos by extracting GPS metadata, connecting them to real world locations.
3. Domain and Infrastructure Recon
-
Tools: WHOIS, Amass, Shodan, Censys
-
Process:
-
Identify domain owners and registrants
-
Map subdomains and servers
-
Detect exposed devices and services
-
-
Application: Corporate OSINT teams use this method to audit their digital footprint and discover shadow IT.
4. Email and Username Tracing
-
Tools: TheHarvester, HaveIBeenPwned, Holehe
-
Steps:
-
Collect email addresses tied to a domain
-
Check if credentials were leaked in breaches
-
Link usernames across multiple platforms
-
-
Application: Cybercrime investigators often identify suspects by correlating usernames from underground forums with mainstream accounts.
