GitBook: [#1165] No subject

Author: s0cm0nkey

SUMMARY.md

@@ -5,7 +5,7 @@
   * [OSINT](cyber-intelligence/osint/README.md)
     * [Search Engines](cyber-intelligence/osint/search-engines/README.md)
       * [Goohak.sh Code](cyber-intelligence/osint/search-engines/goohak.sh-code.md)
-      * [Google Dorking Cheatsheet](cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md)
+      * [Google Dorking](cyber-intelligence/osint/search-engines/google-dorking-cheatsheet.md)
     * [Cyber Search](cyber-intelligence/osint/cyber-search.md)
     * [Dark-Web Search](cyber-intelligence/osint/dark-web-search.md)
     * [IP Address](cyber-intelligence/osint/ip-address.md)

blue-defense/event-detection/README.md

@@ -165,6 +165,7 @@ The actions needed to setup persistence typically require the attacker to intera
 * [Flare](https://github.com/austin-taylor/flare) - Not to be confused with the malware reverse engineering VM, This Flare is a network analysis tool by Austin Taylor that can take logs from Elastic stack and Surricate and perform various types of nework analysis and detection, including beaconing detection.
 * [Revoke-Obfuscation](https://github.com/danielbohannon/Revoke-Obfuscation) - Powershell obfuscation detection tool
 * [dnstwist](https://github.com/elceef/dnstwist) - Tool for creation of potential typo-squatting domains by use of multi-character permutation and checking for registration of those domains.
+  * [https://dnstwister.report/](https://dnstwister.report) - Online Version and DNS monitoring service
 
 ## **Detection Use Cases**
 

cyber-intelligence/osint/README.md

@@ -182,6 +182,8 @@ These are misc tools and collections out there. Many overlap, but there are fant
 * [https://thecyberpost.com/open-source-intelligence-osint-tools/](https://thecyberpost.com/open-source-intelligence-osint-tools/)
 * [https://start.me/p/ZGAzN7/verification-toolset](https://start.me/p/ZGAzN7/verification-toolset)
 * [https://map.malfrats.industries/](https://map.malfrats.industries)
+* [https://github.com/cipher387/API-s-for-OSINT](https://github.com/cipher387/API-s-for-OSINT)
+* [https://github.com/cipher387/osint\_stuff\_tool\_collection](https://github.com/cipher387/osint\_stuff\_tool\_collection)
 
 ### VMs
 

cyber-intelligence/osint/cyber-search.md

@@ -3,11 +3,18 @@
 ## **Cyber Search Engines and Internet Scanners**
 
 * [Shodan](https://www.shodan.io) - Shodan is often called the "Hacker's Search Engine". Shodan has servers scanning the entire internet for devices. Once it finds them, it maps their ports and collects other useful information. Shodan has advanced search commands similar to google dorks. Shodan also has a flexible API that can be leveraged into many other tools.
-  * [Awesome List Collection: Shodan Queries](https://github.com/jakejarvis/awesome-shodan-queries)
   * [https://cli.shodan.io/](https://cli.shodan.io)
   * [https://beta.shodan.io/search/filters](https://beta.shodan.io/search/filters)
   * [https://tryhackme.com/room/shodan](https://tryhackme.com/room/shodan)
-  * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Shodan%20Dorks.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Shodan%20Dorks.md)
+  * Shodan Dorking
+    * [Awesome List Collection: Shodan Queries](https://github.com/jakejarvis/awesome-shodan-queries)
+    * [https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Shodan%20Dorks.md](https://github.com/daffainfo/AllAboutBugBounty/blob/master/Recon/Shodan%20Dorks.md)
+    * [https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/1-part-100-article/google/Shodan%20Queries.txt](https://github.com/blaCCkHatHacEEkr/PENTESTING-BIBLE/blob/master/1-part-100-article/google/Shodan%20Queries.txt)
+    * [https://github.com/humblelad/Shodan-Dorks](https://github.com/humblelad/Shodan-Dorks)
+    * [https://github.com/AustrianEnergyCERT/ICS\_IoT\_Shodan\_Dorks](https://github.com/AustrianEnergyCERT/ICS\_IoT\_Shodan\_Dorks)
+    * [https://github.com/lothos612/shodan](https://github.com/lothos612/shodan)
+    * [https://github.com/IFLinfosec/shodan-dorks](https://github.com/IFLinfosec/shodan-dorks)
+    * [https://www.osintme.com/index.php/2021/01/16/ultimate-osint-with-shodan-100-great-shodan-queries/](https://www.osintme.com/index.php/2021/01/16/ultimate-osint-with-shodan-100-great-shodan-queries/)
   * _Operator Handbook: Shodan CLI - pg. 274_
 
 {% embed url="https://youtu.be/v2EdwgX72PQ" %}
@@ -36,3 +43,4 @@
   * [https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139](https://medium.com/@Asm0d3us/weaponizing-favicon-ico-for-bugbounties-osint-and-what-not-ace3c214e139)
 * [fav-up](https://github.com/pielco11/fav-up) - IP lookup by favicon using Shodan. Helps to find IP addresses hidden behind Cloudflare
   * [https://pielco11.ovh/posts/cloud-hunting/](https://pielco11.ovh/posts/cloud-hunting/)
+* [https://besticon.herokuapp.com/](https://besticon.herokuapp.com) - A service finding icons on web sites

cyber-intelligence/osint/dark-web-search.md

@@ -12,6 +12,7 @@ Searching the Dark/Deep web is a great intelligence activity that can yield a mu
 * [Dark Search](https://darksearch.io) - A clearnet search engine for searching the Dark Web
 * [https://onionlandsearchengine.com/](https://onionlandsearchengine.com) - A search engine for the deep web. Official onion site can be found [here.](http://3bbad7fauom4d6sgppalyqddsqbf5u5p56b5k5uk2zxsy3d6ey2jobad.onion)
 * [https://www.dargle.net/search](https://www.dargle.net/search) - A data aggregation platform for dark web domains. Using this directory, we can generate a portfolio of domains and their statuses, gain insight into the content and nature of these services, as well as the connections between them.
+* [https://torwhois.com](https://torwhois.com) - TorWhois Onion Search
 
 ### Invisible Internet Project (I2P)
 

cyber-intelligence/osint/files-media-breach-paste-code.md

@@ -53,13 +53,32 @@ While having other functionality Michael Bazzell's **Images.html** and **Videos.
 
 {% file src="../../.gitbook/assets/Videos (1).html" %}
 
-* [The Wolfram Language Image Identification Project](https://www.imageidentify.com) 
-* [pictriev](http://pictriev.com)  - Search engine for faces. Upload the picture of choice and find links to other pictures with similar people.
 * [CameraTrace](http://www.cameratrace.com/trace)  - Trace the location a camera has been by the metadata it embeds in photos that end up on the internet.
 * [FotoForensics](https://fotoforensics.com) - Free and public photo forensics tools.
-* [FindFace](https://findface.pro) - Russian face search engine.
-* [PimEyes](https://pimeyes.com/en) - Facial recognition and reverse image search
+* [https://www.imageforensic.org/](https://www.imageforensic.org) - Image Metadata Analysis tool
+* [https://github.com/GuidoBartoli/sherloq](https://github.com/GuidoBartoli/sherloq) - An open-source digital image forensic toolset
 * [https://www.peteyvid.com/](https://www.peteyvid.com) - A video and audio search engine that searches over 70 different platforms.
+* Reverse Image Search
+  * [The Wolfram Language Image Identification Project](https://www.imageidentify.com) 
+  * [pic.sogou.com](https://pic.sogou.com) — chinese reverse image search engine
+  * [Image So Search](https://image.so.com) — Qihoo 360 Reverse Images Search
+  * [Revesearch.com](https://revesesearch.com) — allows to upload an image once and immediately search for it in #Google, #Yandex, and #Bing.
+  * [Pixsy](https://pixsy.com) — allows to upload pictures from computer, social networks or cloud storages, and then search for their duplicates and check if they are copyrighted
+  * [Image Search Assistant](https://chrome.google.com/webstore/detail/image-search-assistant/kldhhobmmejaeaiilomaibhjlcfpceac/related) — searches for a picture, screenshot or fragment of a screenshot in several search engines and stores at once
+  * [openi.nlm.nih.gov](https://openi.nlm.nih.gov/gridquery) — Reverse image search engine for scientific and medical images
+  * [DepositPhotos Reverse Image Search](https://ru.depositphotos.com/search/by-images.html) — tool for reverse image search (strictly from DepositPhoto's collection of 222 million files).
+  * [EveryPixel](https://www.everypixel.com) — Reverse image search engine. Search across 50 leading stock images agencies. It's possible to filter only free or only paid images.
+* Facial Recognition
+  * [pictriev](http://pictriev.com)  - Search engine for faces. Upload the picture of choice and find links to other pictures with similar people.
+  * [PimEyes](https://pimeyes.com/en) - Facial recognition and reverse image search
+  * [Portrait Matcher](http://zeus.robots.ox.ac.uk/portraitmatcher/index?error=agree) — Upload a picture of a face and get three paintings that show similar people.
+  * [FindFace](https://findface.pro) - Russian face search engine.
+  * [Face Recognition](https://github.com/ageitgey/face\_recognition) — facial recognition api for Python and the command line
+  * [Search4faces.com](https://search4faces.com) — search people in VK, Odnoklassniki, TikTok and ClubHouse by photo or identikit
+* Clothing/Shopping
+  * [Searchbyimage.app](https://searchbyimage.app) — search clothes in online shops
+  * [Aliseeks.com](https://www.aliseeks.com/search) — search items by photo in AliExpress and Ebay
+  * [lykdat.com](https://lykdat.com) — clothing reverse image search services
 
 ## **Breach/Leak/Paste data** 
 
@@ -135,6 +154,11 @@ You can manually parse these by user or subject but there are some handy tools t
 * [https://tryhackme.com/room/geolocatingimages](https://tryhackme.com/room/geolocatingimages)
 * [https://tryhackme.com/room/searchlightosint](https://tryhackme.com/room/searchlightosint)
 
-## Github dorking wordlist
+## Github dorking
+
+* [https://github.com/techgaun/github-dorks](https://github.com/techgaun/github-dorks)
+* [https://github.com/jcesarstef/ghhdb-Github-Hacking-Database](https://github.com/jcesarstef/ghhdb-Github-Hacking-Database)
+* [https://github.com/H4CK3RT3CH/github-dorks](https://github.com/H4CK3RT3CH/github-dorks)
+* [https://github.com/Vaidik-pandya/Github\_recon\_dorks/blob/main/gitdork.txt](https://github.com/Vaidik-pandya/Github\_recon\_dorks/blob/main/gitdork.txt) (for finding files)
 
 ".mlab.com password" "access\_key" "access\_token" "amazonaws" "api.googlemaps AIza" "api\_key" "api\_secret" "apidocs" "apikey" "apiSecret" "app\_key" "app\_secret" "appkey" "appkeysecret" "application\_key" "appsecret" "appspot" "auth" "auth\_token" "authorizationToken" "aws\_access" "aws\_access\_key\_id" "aws\_key" "aws\_secret" "aws\_token" "AWSSecretKey" "bashrc password" "bucket\_password" "client\_secret" "cloudfront" "codecov\_token" "config" "conn.login" "connectionstring" "consumer\_key" "credentials" "database\_password" "db\_password" "db\_username" "dbpasswd" "dbpassword" "dbuser" "dot-files" "dotfiles" "encryption\_key" "fabricApiSecret" "fb\_secret" "firebase" "ftp" "gh\_token" "github\_key" "github\_token" "gitlab" "gmail\_password" "gmail\_username" "herokuapp" "internal" "irc\_pass" "JEKYLL\_GITHUB\_TOKEN" "key" "keyPassword" "ldap\_password" "ldap\_username" "login" "mailchimp" "mailgun" "master\_key" "mydotfiles" "mysql" "node\_env" "npmrc \_auth" "oauth\_token" "pass" "passwd" "password" "passwords" "pem private" "preprod" "private\_key" "prod" "pwd" "pwds" "rds.amazonaws.com password" "redis\_password" "root\_password" "secret" "secret.password" "secret\_access\_key" "secret\_key" "secret\_token" "secrets" "secure" "security\_credentials" "send.keys" "send\_keys" "sendkeys" "SF\_USERNAME salesforce" "sf\_username" "site.com" FIREBASE\_API\_JSON= "site.com" vim\_settings.xml "slack\_api" "slack\_token" "sql\_password" "ssh" "ssh2\_auth\_password" "sshpass" "staging" "stg" "storePassword" "stripe" "swagger" "testuser" "token" "x-api-key" "xoxb " "xoxp" \[WFClient] Password= extension:ica access\_key bucket\_password dbpassword dbuser extension:avastlic "support.avast.com" extension:bat extension:cfg extension:env extension:exs extension:ini extension:json api.forecast.io extension:json googleusercontent client\_secret extension:json mongolab.com extension:pem extension:pem private extension:ppk extension:ppk private extension:properties extension:sh extension:sls extension:sql extension:sql mysql dump extension:sql mysql dump password extension:yaml mongolab.com extension:zsh filename:.bash\_history filename:.bash\_history DOMAIN-NAME filename:.bash\_profile aws filename:.bashrc mailchimp filename:.bashrc password filename:.cshrc filename:.dockercfg auth filename:.env DB\_USERNAME NOT homestead filename:.env MAIL\_HOST=smtp.gmail.com filename:.esmtprc password filename:.ftpconfig filename:.git-credentials filename:.history filename:.htpasswd filename:.netrc password filename:.npmrc \_auth filename:.pgpass filename:.remote-sync.json filename:.s3cfg filename:.sh\_history filename:.tugboat NOT \_tugboat filename:\_netrc password filename:apikey filename:bash filename:bash\_history filename:bash\_profile filename:bashrc filename:beanstalkd.yml filename:CCCam.cfg filename:composer.json filename:config filename:config irc\_pass filename:config.json auths filename:config.php dbpasswd filename:configuration.php JConfig password filename:connections filename:connections.xml filename:constants filename:credentials filename:credentials aws\_access\_key\_id filename:cshrc filename:database filename:dbeaver-data-sources.xml filename:deployment-config.json filename:dhcpd.conf filename:dockercfg filename:environment filename:express.conf filename:express.conf path:.openshift filename:filezilla.xml filename:filezilla.xml Pass filename:git-credentials filename:gitconfig filename:global filename:history filename:htpasswd filename:hub oauth\_token filename:id\_dsa filename:id\_rsa filename:id\_rsa or filename:id\_dsa filename:idea14.key filename:known\_hosts filename:logins.json filename:makefile filename:master.key path:config filename:netrc filename:npmrc filename:pass filename:passwd path:etc filename:pgpass filename:prod.exs filename:prod.exs NOT prod.secret.exs filename:prod.secret.exs filename:proftpdpasswd filename:recentservers.xml filename:recentservers.xml Pass filename:robomongo.json filename:s3cfg filename:secrets.yml password filename:server.cfg filename:server.cfg rcon password filename:settings filename:settings.py SECRET\_KEY filename:sftp-config.json filename:sftp-config.json password filename:sftp.json path:.vscode filename:shadow filename:shadow path:etc filename:spec filename:sshd\_config filename:token filename:tugboat filename:ventrilo\_srv.ini filename:WebServers.xml filename:wp-config filename:wp-config.php filename:zhrc HEROKU\_API\_KEY language:json HEROKU\_API\_KEY language:shell HOMEBREW\_GITHUB\_API\_TOKEN language:shell jsforce extension:js conn.login language:yaml -filename:travis msg nickserv identify filename:config org:Target "AWS\_ACCESS\_KEY\_ID" org:Target "list\_aws\_accounts" org:Target "aws\_access\_key" org:Target "aws\_secret\_key" org:Target "bucket\_name" org:Target "S3\_ACCESS\_KEY\_ID" org:Target "S3\_BUCKET" org:Target "S3\_ENDPOINT" org:Target "S3\_SECRET\_ACCESS\_KEY" password path:sites databases password private -language:java PT\_TOKEN language:bash redis\_password root\_password secret\_access\_key SECRET\_KEY\_BASE= shodan\_api\_key language:python WORDPRESS\_DB\_PASSWORD= xoxp OR xoxb OR xoxa s3.yml .exs beanstalkd.yml deploy.rake .sls

cyber-intelligence/osint/misc-osint.md

@@ -29,6 +29,12 @@
 * [https://www.bitcoinabuse.com/](https://www.bitcoinabuse.com) - Check Bitcoin addresses against the bitcoinabuse.com database of suspect/malicious addresses.
 * [https://zerodot1.gitlab.io/CoinBlockerListsWeb/](https://zerodot1.gitlab.io/CoinBlockerListsWeb/) - Cryptojacking IP address blocklists.
 * [https://etherscan.io](https://etherscan.io) - Queries etherscan.io to find the balance of identified ethereum wallet addresses.
+* [Wallet explorer](https://www.walletexplorer.com) — bitcoin wallet transaction history
+* [Blockpath.com](https://blockpath.com) — viewing bitcoin wallet transactions as a graph\
+  [Cryptocurrency alerting](https://cryptocurrencyalerting.com) — track spending and deposits in Bitcoin and Ethereum wallets\
+  [Learnmebitcoin.com](https://learnmeabitcoin.com/tools/path/) — find transactions between two Bitcoin adresses\
+  [Coinwink.com](https://coinwink.com) — allows you to set up email notifications in case Bitcoin (or other #cryptocurrency) rate rises (falls) above (below) a certain value\
+  [BlockCypher](https://blockcypher.herokuapp.com) — Blockchain explorer for Bitcoin, Ethereum, Litecoin, DogeCoin, Dash. Getting into about address, transactions and block hashes, block number or wallet name.
 
 {% file src="../../.gitbook/assets/Currencies.html" %}
 

cyber-intelligence/osint/search-engines/README.md

@@ -32,16 +32,20 @@ Google is the most powerful and scary information gathering tool today. Beyond s
 
 ### Google Dorking CLI Tools
 
-* [EasyDork](https://github.com/s0cm0nkey/EasyDork) - HTML based dorking tool to make launching popular dorking techniques easy.
-  * Encorporated dorks from:
-    * [Goohak](https://github.com/1N3/Goohak/) - Automatically launch google hacking queries against a target domain to find vulnerabilities and enumerate a target.
-      * [https://www.isec.ne.jp/wp-content/uploads/2017/10/65Goohack.pdf](https://www.isec.ne.jp/wp-content/uploads/2017/10/65Goohack.pdf)
-    * [https://dorks.faisalahmed.me/](https://dorks.faisalahmed.me) - Bug Bounty focused dorking helper
+* [Goohak](https://github.com/1N3/Goohak/) - Automatically launch google hacking queries against a target domain to find vulnerabilities and enumerate a target.
+  * [https://www.isec.ne.jp/wp-content/uploads/2017/10/65Goohack.pdf](https://www.isec.ne.jp/wp-content/uploads/2017/10/65Goohack.pdf)
+* [https://dorks.faisalahmed.me/](https://dorks.faisalahmed.me) - Bug Bounty focused dorking helper
 * [pagodo](https://github.com/opsdisk/pagodo) - pagodo (Passive Google Dork) - Automate Google Hacking Database scraping and searching
+* Fast Google Dorks Scan [https://github.com/IvanGlinkin/Fast-Google-Dorks-Scan](https://github.com/IvanGlinkin/Fast-Google-Dorks-Scan)
+* 0xDork [https://github.com/rlyonheart/0xdork](https://github.com/rlyonheart/0xdork)
+* SDorker [https://github.com/TheSpeedX/SDorker](https://github.com/TheSpeedX/SDorker)
+* BugBounty Helper [https://dorks.faisalahmed.me](https://dorks.faisalahmed.me)
+* Google Dork Builder Firefox Add-on [https://addons.mozilla.org/ru/firefox/addon/google-dork-builder/](https://addons.mozilla.org/ru/firefox/addon/google-dork-builder/)
+* ASHOK (osint swiss knife) [https://github.com/ankitdobhal/Ashok](https://github.com/ankitdobhal/Ashok)
 * Depreciated
   * [Googd0rker ](https://github.com/ZephrFish/GoogD0rker/)- GoogD0rker is a tool for firing off google dorks against a target domain, it is purely for OSINT against a specific target domain.
 
-### Google Dorking Cheatsheet
+### Google Dorking Lists and Resources
 
 {% content-ref url="google-dorking-cheatsheet.md" %}
 [google-dorking-cheatsheet.md](google-dorking-cheatsheet.md)