Hello. This is Dean Pompey, Leo and we are in the social engineering class.
I'm going to be demo ing a tool called creepy,
We can go to the website really quick as geo creepy dot com.
This tool allows you to do geo location.
So by using various social networking,
track and individual or individuals
to see what they're doing and where they're doing it.
And this will work for Twitter,
instagram, flicker and Google, Plus
creepy is available to, uh, to use from within. Cali.
I'm I decided to install it on windows to make a little bit easier instead of having to boot up the V m. But
go ahead and, uh, use it through through Callie if you wish.
There's the windows download here
and we can see that there's also *** downloads and then you can get it from Run it from source code.
There's a YouTube video,
and we do get some quick start instructions.
Some instructions for installing on your Debian Destro's such as Callie.
Okay, so I'm gonna go ahead and launch the tool,
and when this comes up, we should see a map.
It takes a couple seconds to load.
And this basically is sending the geo location data
So this is actually a Google Maps. Uh, ap I interface.
Speaking of AP eyes,
you do need to configure
I have only configured the Twitter plug in.
So when you try to run the configuration wizard
for any of the other,
to that particular website
and should give me the the window here in a moment.
And so you log in as your normal account and then you'll get a pin number of which then you'll paste
into this window that you see here
and what you're doing is authorizing Twitter to allow creepy to do to have read only access to your Twitter account.
So in order to use this tool to interrogate the other social networking sites, you do need to create accounts on all those platforms.
Anyway, I've already configured this and we're gonna go ahead and cancel out,
and what I'd like to do is create a new person based project,
and I'm going to actually just use myself as the target
you may find when you're searching for
information about a target that
in some cases they are maybe somewhat security minded.
So if you use a tool like this, it it may have limited results because that
that target may have disabled geo location,
which any any smart person would. D'oh. Unless Unless that's something that is, ah, part of your your twitter
feed and you want that to be visible to people.
All right, so I'm gonna go ahead and tighten my my twitter handle, which is my first and last name together. As we see it
You can go ahead and figure these others when you when you need to. We're just gonna do a simple demonstration here
and I can click the search button
So pop me up pretty quickly Now, Once I see my search results, I still have to click the add two targets button
Twitter account in the target's window
multiple targets. It doesn't have to be just one.
So now that my target is here, I can go ahead and click next,
and I have some options. I can include retweets, I can exclude replies.
I just keep those at the default setting, Click next and finish.
project name is here. I could expand this, and I can see
that there's a suction for locations and some other analysis.
What I need to do first, though, is,
uh, select the project and then click the analyzed current project. But
you'll notice that the bottom
it'll give you an update here that's analyzing,
looking for locations, looking for other information.
it did find some locations. And this window here,
I can see three different
three different tweets.
I'm gonna go ahead and zoom out
and just a little bit more. Okay, so
these are three sample tweets that I that I created just for the demonstration purposes.
location, you can see that it tells me my
my date and time stamp here tells me the location
contacts, which is the actual tweet that I sent.
He's actually reverse order.
Let's look at the Chicago one first. Chicago one.
I was just doing a simple test testing. 123
Sorry about that. Interruption testing 123
And when you twitter in particular,
it's very easy for the person doing the tweeting
to either use an automatic
geo location future or you just type the location in.
that means that this information is that you're getting here may not be completely reliable,
but for the purposes of trying to uncover
where someone might be, where they where they've been recently, what kind of messages they're sending,
we'll just assume that that that the information is most likely correct.
And you can always try to correlate this information later with with something else.
this location was Chicago,
another tweet in San Francisco, which is my second test
and then another one,
another one in Washington.
Another feature that the tool has is to click the analysis link
when the account was created. How many tweets have been created,
allowed geo location of my tweets,
and then it gives some other stats on,
uh, the different hours of the day. We're the tweeting happened
put in a another person based project and you were looking to,
you know, follow a celebrity, let's say, or a politician
or someone else. That's part of a social engineering
you know, as part of a pen test, Let's say,
then you'd have to find out first. Of course, if if that target is using any of these social engineering
social networking platforms,
a lot of people use Twitter and flicker on Instagram and Google, plus, so
trying to do simple searches for an individual on those websites pretty easy. You could just use their first and last name.
And if they have a profile, that profile should come up, and you should be able to
get their Twitter handle that way or their handle for some other service.
So, yeah, it's pretty pretty useful. I just put in the names of cities when I did these tweets, so it basically tries to center you
geographically in that city.
If you don't give in this a specific address,
some other things you can do are too filter
by location, date or position
so you can do this by time, days, the weak and months of the year. Internet narrow things down a little bit.
And the filter buttons were also here. So I can
filter by specific date
and you can even give a distance from the point of interest.
So, for instance, if you were trying thio
determined or to correlate information showing where someone
was on a certain date in time,
geographically, you could piece some of this information together.
And then this heat map will then show
a, uh indication of how close
the individual was to that area.
when particular events happen and made my case when particular tweets happened.
And then you can click this red bar to remove all those filters.
She didn't remove the filter. The heat map.
Okay, so that's the basic idea of the creepy tool.
wanted one tool to adhere to your bag of tricks
in order to correlate information and to be able to use
the built in features of many social networking tools to get more information about your target.
All right, that concludes the demo.
See you on the next time. L thank you