Hey everyone, my name is Micah but I go by “WebBreacher”. I’m an American, male and have been working in the infosec business for the last 17+ years. I’d like to tell you how I became OSINT curious.
I’ve always been curious
I cannot remember a time when I didn’t ask questions about how something worked or why something was the way it was. Like the 4 year old child that continually asks “Why?”, it is just who I am. At university, I studied psychology and sought to better understand human behavior. Later in life, my career goals shifted to Information Technology and, eventually, cyber security and I began understanding computers and complex systems. Throughout these chapters of my life, I constantly asked the “Why?” questions and sought answers.
Pentesting led me here
Early in my career, I remember a penetration test I was performing and the revelation I had while on it. Our team was testing a company’s internal computer network. We did all the standard host enumeration procedures and found a number of devices to test. My colleagues began testing the domain controllers and other high-value assets and assigned me, the new guy on the team, something I couldn’t break. I was to test a network-attached copier. But it was not JUST a copier, it was a printer, scanner and fax machine too! Eureka!
I worked through the process of enumerating ports on the device and probing to see what I could find running on those services. That was when I discovered a hidden web server on the copier.”So what?” you might say. Well, this web server allowed anyone that knew about it to browse all of the files stored on the device in the “Documents” directory. You see, this copier/scanner/printer was configured to store a copy of all of the documents it scanned and printed. Those documents were stored (you guessed it) in the “Documents” directory.
I browsed through promotion letters, break-up notes, copies of passports, scans of comic strips, and so many other things that people in that office had scanned, copied, or printed. I was enthralled and horrified at the lack of security of this system.
What if?
My pentest lead at that time was someone who always challenged me. “What if…” were the two words he would ask to motivate me to think deeper about a topic. What if an attacker had that copier data? What could they do?
My career took some amazing twists and turns over the years and, at each one, I repeated that “what if” question. As I moved from pentesting into OSINT, those words followed with me.
- What if I could aggregate and analyze the social beer-drinking habits of people?
- What if I could make a more-accurate tool to discover sites where people might have user accounts?
- What if I…
Those two words summarize my OSINT curiosity and they are why I’m thrilled to have helped create this site and continue to build our OSINT community.