This blogpost is inspired by @djnemec‘s Github gist, which you can find here https://gist.github.com/nemec/2ba8afa589032f20e2d6509512381114.
The next step
In this part, we’re talking about combining searches. Just like in part 1, we will be translating JSON to Base64. And of course we’ll take you through it step by step 🙂
What to combine?
Well, you can only combine when you stay in the same category. In part 1 we’ve discussed the following categories:
It’s not possible to combine a query from ‘photos’ together with a query from ‘people’. So you’ll have to find a query to make which stays within one category (for example, posts you’ve viewed with your profile in a specific group).
How to start combining
In order to combine the queries, we’ll have to put two (or more) JSON lines together. This can be best explained with an example. Let’s say we’re looking for people named ‘John’ who live in ‘Mountain View, California’ and work for ‘Google’.
We’re going to build the base URL first. In the case of the example, it will look like this:
‘search/people/‘ because we want to search for people.
‘?q=john‘ because this is our search query in order to find people named ‘John’.
So now we need to find the ID’s of the location ‘Mountain View, California‘ and the business page ‘Google‘.
Mountain View, California = 108212625870265
Google = 104958162837
(If you don’t know how to find a page ID, please read the first blog post)
Now we take the JSON line for finding people in a specific city and insert the ID of Mountain View:
Second, we take the JSON line for finding people who work at a specific employer and insert the ID of Google:
Now we need to combine those two lines. In order to combine them, we’ll need to remove some curly braces and add a comma. The curly braces that need to be removed are highlighted and the comma that needs to be inserted is highlighted too:
The full correct JSON line will be:
When trying combining these queries, it’s important to test them. Testing can be done really easily via https://jsonformatter.curiousconcept.com/.
1. Paste the JSON line you’ve created
2. Choose the JSON Template ‘Compact’
3. Hit ‘Process’
If you’ve made a mistake, you’ll see an error and it will include where you’ve made a mistake. Really helpful!
The most common mistake is that the quotations in the JSON line aren’t straight. They need to be straight, not slightly tilted.
If you’re getting errors while testing your JSON line, make sure to copy and paste the JSON line in a text program like Microsoft Word, select the text and change the font to something like ‘Lucinda Console’. Now copy and paste the JSON line and your problem should be fixed.
So now that we’ve got the right JSON line, we move back to CyberChef. We’re going to ‘bake’ the JSON to Base64, just like we did in the first blog.
Our JSON line will now look like this when its translated to Base64:
Let’s put it together!
Ok, we’ve created the base URL and we’ve created a search combining 2 queries. Lets put them together:
Now you see the results for people named ‘John’, who live in ‘Mountain View’, who work for ‘Google’!
Of course this is an option to filter in the left menu, but if you want to specifically search a page or city, using the page ID number is much more efficient than searching the specific page in the drop down menu when clicking ‘Choose a City…’.
After reading part 1 and 2 we’ll be able to build your own queries. You’ll have to try different queries to figure out which ones work best for you. Even try to put more than 2 JSON lines in a query.
Also, don’t forget about the search bar! There are some good filtering options in there too!
And if you’ve paid attention to the way the URL’s are built up when using the search bar, you’ll notice the Base64 lines in there. You can always try to reverse the Base64 to JSON (with CyberChef) in order to see how Facebook built the query so you can learn from it.
If you’re looking for any new queries, check out Kirby’s website where there is matrix with all kinds of helpful queries you could build. Check it out here.
Or if you’ve found any new interesting queries, feel free to share them in de comments below!
P.S. Liked this posted? Support us via Patreon from just $1 a month!
17 thoughts on “The new Facebook Graph Search – part 2”
Hi, what is the query for tagged photos?
There isn’t a real query for that anymore I’m afraid. But what helps is to searching in the search bar for the name of the person you’re interested in > From the categories at the top, choose “Photos” > From the filters in the left menu, choose “Posted by” and select “Choose a source” > Try to choose a source (profile) of someone close to the person of interest. You can then see if there are any photo’s related to the person of interest, posted by the source you choose. Hopefully this helps a little!
what is the query for “friends of my friends who live in ….” ?
This is available on the people search page. Just toggle on “friends of friends” and look for a place.
I just added this weblog to my feed reader, great stuff. Can’t get enough!
Is there a query for “Pages liked by people who like page X”?
Is it possible to find all people that are members of a specific group?
is there any facebook search operator that excludes a particular keyword?
Is it correct that these techniques don’t work any more at the moment or is that just me?
Can you be more specific? Is a certain one not working? Are you using the new “beta” Facebook interface? Can you paste the URL you created here for us to look at?
Specifically looking at photos liked by certain users along with comments posted by users. Is there any OSINT features that work regarding this?
how to search married people with specific date of born combined with city they’re living ?
hi all , pls help me one problem , how to find fb page admin ?
Very genius content, its helpful. But I dont see category Links in graph search. I want to see all type of telegram invite links? Is it imposible, pls answer me, i need to know, thanks
Hi everyone, this is all very good, is there a query to find ” I need a graphic designer” and filter those posts by date?