Social Media OSINT
Gather intelligence from social media platforms to solve CTF OSINT challenges.
Social Media OSINT
Social Media OSINT is the systematic collection of identifying information from public social media profiles to establish identity, location, employment, associations, and behavioral patterns of targets or organizations. How it works: Search usernames across platforms (Sherlock, Maigret, manual checks); reverse image search profile photos; analyze bio text for location/employer clues; extract posted content for metadata and geotags; cross-reference usernames/emails in Git commits and breach databases; map social connections to identify associated accounts. Why it matters: Users reuse usernames and profile photos across platforms for convenience; public posts reveal real names, employment, location tags, travel patterns; metadata in posted images contains GPS/timestamps; search engine indexing makes historical content discoverable; enables rapid target profiling in CTF challenges.
Only gather information from public profiles as permitted by the CTF scope. Do not attempt to access private accounts, use fake profiles to befriend targets, or harvest personal information about real individuals outside of an authorized CTF challenge.
Note: Some community tools (for example twint) are frequently broken due to platform API changes. When possible prefer official APIs, mirror services like Nitter, or tools that explicitly document credential requirements (Maigret). Always respect platform rate limits and TOS.
Investigation Workflow
Platform-by-Platform Guide
# Profile search
https://twitter.com/username
https://x.com/username
# Advanced search (find old tweets)
https://twitter.com/search?q=from:username+keyword
https://twitter.com/search?q="target phrase"
# Search within date range
from:username until:2024-01-01 since:2023-01-01
# Nitter (alternative Twitter viewer, no login needed)
https://nitter.net/username
# Twitter API via Twint (CLI)
pip3 install twint
twint -u username -s "flag" --output tweets.txtWhat to look for:
- Bio links to other platforms
- Location tags in older tweets
- Photo uploads (download + exiftool)
- Reply chains revealing other accounts
Finding Cross-Platform Connections
Collect a unique identifier
Profile picture, bio text, URL, or exact phrase used on multiple platforms.
Reverse image search the profile photo
Use Google Images and Yandex. Yandex is significantly better for matching faces and personal photos.
Google the exact bio text
Copy unusual phrases from the bio and search them in quotes: "this exact bio phrase". People reuse bios across platforms.
Try username variations
# Common variations to try:
username
username_
_username
username123
username2024
firstname.lastname
f.lastname
firstnamelastnameCheck mutual friends/followers
The same people appearing across Twitter, Instagram, Reddit often indicate verified cross-platform identities.
Archived Content
People delete posts, but archives persist:
# Wayback Machine
https://web.archive.org/web/*/twitter.com/username
# Google cache
cache:twitter.com/username/status/1234567890
# Cached Twitter profiles
# Google: site:twitter.com username (shows cached snippet)The Wayback Machine is one of the most powerful tools in OSINT. Deleted tweets, removed GitHub repos, and taken-down websites frequently survive in archive snapshots. Always check web.archive.org for any target URL.
Metadata in Social Media Posts
# Download an image from the post
# Check EXIF data
exiftool downloaded_image.jpg
# GPS coordinates, camera model, software, timestamps
# Facebook photos sometimes retain EXIF
# Instagram strips most EXIF but not always timestampsMost platforms strip GPS coordinates from uploaded photos before they reach viewers. However, timestamps, camera model, and software fields often survive. The thumbnail embedded in the EXIF can sometimes differ from the main image - always extract and compare it.
OSINT Framework
osintframework.com provides a comprehensive tree of OSINT resources organized by category.
Key branches for social media:
- Username → Sherlock, Maigret, Namechk
- Email → Hunter.io, Have I Been Pwned
- Phone → TrueCaller, Spokeo
- Images → Google Images, Yandex, TinEye
Checklist
Last updated on