+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: OpSec and OSINT (https://hackforums.net/forumdisplay.php?fid=322)
+---- Thread: ==> [FULL GUIDE] How to be undoxable (Noob friendly) <== (/showthread.php?tid=5482652)
==> [FULL GUIDE] How to be undoxable (Noob friendly) <== - Raid7 - Dec 2, 2016
Doxing & how to prevent it.
* Chapters (5)
:- what is doxing?
- why do people do it.
- is it legal?
- basics of doxing.
- how to prevent a dox.
* Chapter 1: what is doxing?
=> doxing is gathering someone's personal information usually on a pastebin/ghostbin and release it to the Internet, a dox usually contains information such as:real name phone number
location
emails
phone number..etc
Wikipedia:
Doxing:
=> from dox, abbreviation of documents),or doxxing, is the Internet-based practice of researching and broadcasting private or identifiable information (especially personally identifiable information) about an individual or organization.
Urbandictionary:
Dox:
=> Personal information about people on the Internet, often including real name, known aliases, address, phone number, SSN, credit card number, etc.
Chapter 2: why do people do it?
=> People do doxing for alot of reasons. for blackmailing, to piss off someone or simply just for fun.
- some sell it as a service which is pretty beneficial for them and some use it for good reasons such as exposing pedos, criminals..etc.
Chapter 3: is it legal?
=> Doxing is always illegal, whether it is done against a federal employee, a state employee, or a regular person. There are federal and state laws that specifically address doxing government employees. With regular citizens, doxing falls under various state criminal laws, such as stalking, cyberstalking, harassment, threats, and other such laws, depending on the state.
- (D)ue to new federal laws that apply to internet cyber-stalking, the broader points now apply in multiple internet forums and social media sites (ours included).
- Revealing a “name” per se’ may, or may not be considered “Doxing” depending on the level of anticipated anonymity. However, in this law, the term “restricted personal information” means, “with respect to an individual, the Social Security number, the home address, home phone number, mobile phone number, personal email, or home fax number of, and identifiable to, that individual.” This is an important distinction to remember
Chapter 4: basics of doxing
=> Username(s):
your username can reveal information on you more thank think, a dox usually starts with getting the username name of a person by googling it or using special sites and looking into what popsup on the search it could be social media accounts or other linked accounts to the same username which can be very bad.
=> Email(s):
emails are a big part of the Internet and you almost cant register on any site without needing one.
- a email can be linked to many accounts and can reveal so much information about a person especially if its linked to a bank account or if that email exists on a site dump (which is a list of all emails and users and their passwords which is usually encrypted but can still be easy to decrypt) one tip is to use a email for trusted sites and important stuff and another email for regular internet stuff.
=> Phone numbers:
This is exetremely bad for you if someone got a hold of your mobile phone. it could reveal so much especially if the attacker used some social engineering then he could get any information about you, not to mention he can trick your phone
number provider into giving them your sim card remotely and use the sms verification to break into your accounts and make calls and read messages.
- the number can also be used as a search keyword to reveal personal information about you and any account linked to it (which is mostly important accounts).
=> Location:
alright this is alright to have in general but not your exact address because a attacker could do so much bad stuff if he got a hold of it.
- for example what's known as swatting.
Swatting is basically calling someone's local police department and tell them that there is a emergency at (your address) like bombing, terrorist attack, hostages which is enough to send the swat team that might actually get someone killed.
=> Social Media:
social media is mostly fine unless someone finds your Facebook if you have your info there for example (education, current location and hometown, family..etc) which is bad not to mention it also has your full name and pictures and possibly family pictures which sucks and we will get to protecting social media from doxers later on.
Chapter 5: how to prevent a dox.
Note: this could fully prevent a dox or make it have much less info depending on the doxer's skill. => Username(s):
*1:
Do not use the same username on every single website, and what's best is keeping one username for each site that way if anyone tries to dox you and searches your username it will not show anything related to you.
*2:
Do not include real name in username, like Benjack12 or JohnD123 (these are random usernames i just made up) but you get the point because if the username contains real name the doxer could potentially search it and get results or use it to validate results.
=> Email(s):
Like i mentioned in chapter 4, keeping one email for your important accounts (bank, facebook..etc) and one or two for regular internet stuff like registering on forums and sites.
- And don't have similar email names for example your main email is email1@domain and your second one is email2@domain because searching one might reveal the other...etc.
- I also recommend using encrypted emails that also have two factor authentication and using that.
- I finally would recommend using a dump email for trash sites , you ever wanted just one thing from a site but you have to register and confirm it to be able to view content..yeah use this email for it.
=> Image(s):
Alright so what i mean by image is basically that you must keep in mind that any image you post or use as a avatar can be traced and can reveal some information.
- for example, you have this cool selfie or avatar that you like and you used at your instagram and also on another forum, so this doxer can't find your instagram by searching but he does find your account on that forum he could get your image and reverse look it up on google images or tineye.com and it will show all the places that this image was posted in and bingo! he sees your instagram on the results.
=> Social Media:
[1] instagram:
if you own instagram keep it at private mode if you don't want anyone viewing your photos on it or just use a different email and username on it and never use any of the photos on it somewhere else.
[2] Facebook:
- Facebook is like a treasure for doxers in most of the time because it contains way too much info most of the time, so keeping your Facebook not full of details is critical to staying anonymous from doxers and keep your "About Me" section empty is very good.
- edit your post's privacy settings so whenever you post something it cannot be viewed by anyone unless they're friends with you on Facebook.. which leads me to my next point which is dont accept random friend requests or messages from people you don't know on Facebook or anywhere to be honest.
- edit your security settings and privacy in Facebook there is a option in facebook's settings to disable showing up on 3rd party search engines which is a good thing to keep on.
- keep family members section in your Facebook unfilled because even if you don't have info on your Facebook a doxer can get your location and other information from your family members.
[3]:
Not sharing your personal social media on the Internet, you can't just randomly share them all over the place and then expect them to stay hidden.
------------------------
You have reached the end, i really hoped that it has helped you if you have any questions please feel free to contact me.🤝
Also feel free to donate since i decided to make a thread to help people instead of selling it as a ebook :)
1L8ehzbvESa2NUBNRPdAHZMh6nBviRW5uL
Updated thread with more info!
* - SIM-1073426 - Dec 3, 2016
Eye hurting design and non-indepth information, i'm not impressed keep researching and write on it and format it better
* - Raid7 - Dec 3, 2016
(Dec 3, 2016 02:05 PM)Aces. Wrote: Eye hurting design and non-indepth information, i'm not impressed keep researching and write on it and format it better
Thanks for the advice, will definitely consider it
This was my first timetrying to make big threads.
Hopefully I'll get better by time :)
* - 'OverSight - Dec 3, 2016
Don't use social media. Just remove what you said in that section and rewrite it to say delete. Having social media will fuck you in some way or another. Social media is ment to be social. These companies made social media so you give up information and your habits. Social media is not free, you're the product. Should also get into tor/vpns as well. Because you get se'd into giving up your IP or a compromised website, you can kiss all your efforts good bye. About phone numbers. Invest in a prepaid phone for your online activities (pay in cash or get someone to buy a prepaid phone for you), extremely worth it if you know how to "detox" the phone as well rather than getting verification from people online(risk to security). Also, when you're uploading pictures, make sure to strip off exif data. If you use a smart phone, it is common for for your pictures to have it if you have location services on. Having the same username on every site is fine if you follow practices such as using new emails for every website, tor/vpn, different passwords for every site, and good opsec. I'm glad you're trying to help OP but some of the stuff in here is kinda wrong as it won't lead to being "impossible to dox".
* - thrudda - Dec 3, 2016
Nice, this is a good read for beginners.
* - Mom - Dec 3, 2016
I would definitely change the design of the thread to be more user friendly, otherwise, nice job.
* - Ryoma - Dec 3, 2016
Can you cite the specific laws where it is illegal? People can be doxed for various reasons. The government "doxes" or forms a dossier on suspects which isn't illegal. People can use the information for malicious purposes but it is not inherently illegal. Cyberstalking and doxing are not synonymous.
* - Raid7 - Dec 4, 2016
(Dec 3, 2016 11:38 PM)Ryoma Wrote: Can you cite the specific laws where it is illegal? People can be doxed for various reasons. The government "doxes" or forms a dossier on suspects which isn't illegal. People can use the information for malicious purposes but it is not inherently illegal. Cyberstalking and doxing are not synonymous.
Doxing is legal if the doxed person was over 18+ years old
* - MrSpyrO - Dec 4, 2016
I have time on the net and I did not know that that was the official name of these leaks, there are too many websites that offer this information for money ... but they call it another way.
* - G Eazy - Dec 4, 2016
This will help a lot of people out.
* - d000nt - Dec 4, 2016
undoxable god runnin' tha scene since '09 gang gang 6hunnaq
* - Raid7 - Dec 4, 2016
(Dec 4, 2016 12:01 PM)Jixter Wrote: This will help a lot of people out.
Thanks, i hope it will :)
* - RevCrew1 - Dec 6, 2016
This is an alright guide, but try adding some more stuff.