Sep 10, 2025 02:27 PM
(This post was last modified: Sep 11, 2025 08:26 AM by N3bula.)
Social Media OSINT Tips
Things I've learned from 3+ years of social media reconnaissance
Hey everyone. Figured I'd share what I've picked up doing OSINT work over the past few years.
I use it regularly for various projects.
USERNAME CORRELATION
This is where most investigations start. People are creatures of habit and reuse usernames everywhere.
Tools that work:
Sherlock is your best friend:
Pro tip from experience: Don't just search the exact username. I've found accounts by trying variations like username123, _username_, xusername, etc. Also check for common typos, you'd be surprised how many people fat finger their own usernames when creating accounts.
One time I spent hours looking for someone's Instagram, turns out they used a zero instead of the letter O in their username. Small details matter
REVERSE IMAGE INTELLIGENCE
Profile pics are seriously underrated for finding people across platforms.
My go to search engines:
Yandex is insane for finding people. I've located targets using Yandex that Google completely missed. It's especially good if your target has any Eastern European connections.
Tip: Always download the full resolution image, not just right-click save. Sometimes platforms serve you thumbnails that won't match in reverse searches. Check the image URL in dev tools to get the full size version.
METADATA EXTRACTION
This is where things get interesting. Most people have no idea how much data their photos leak.
ExifTool is king:
I've geolocated users from a single Instagram photo because they forgot to turn off location services. Androids are especially bad for this. They embed GPS coordinates in photos by default. (depending on the model)
Device info is also gold. If someone's using "iPhone 14 Pro Max" in their EXIF data, that narrows down their economic status and tells you they probably upgrade frequently. Software versions can indicate how security conscious they are.
Other tools worth knowing:
SOCIAL GRAPH MAPPING
Understanding who's connected to who is crucial. Social networks leak information through relationships.
Manual techniques:
Facebook's graph search still works if you know the syntax. Most people don't realize this:
For automation:
CACHED CONTENT RECOVERY
Deleted doesn't mean gone. The internet has a long memory.
Archive sources that matter:
I've recovered "deleted" social media profiles that were archived months earlier. People think deleting their account erases everything, but archives capture snapshots regularly.
Search operators:
Pro tip: Set up Google alerts for your targets. Sometimes deleted content gets reposted or referenced elsewhere, and you'll catch it in real time.
AUTOMATION AND EFFICIENCY
Manual work is fine for one target, but automation scales everything up.
Frameworks:
FINAL THOUGHTS
This stuff takes practice and patience. Don't expect to master it overnight. I still learn new techniques regularly, and tools break/change constantly. The key is understanding the methodology. Tools come and go but the principles stay the same.
Document everything as you go. Screenshots, URLs, timestamps. It all matters.
I use a simple text file with timestamps for each investigation. Has saved my ass more than once.
Hope this helps some of you. Happy to answer questions or expand on any section.
Stay curious.
Things I've learned from 3+ years of social media reconnaissance
Hey everyone. Figured I'd share what I've picked up doing OSINT work over the past few years.
I use it regularly for various projects.
USERNAME CORRELATION
This is where most investigations start. People are creatures of habit and reuse usernames everywhere.
Tools that work:
Code
Sherlock - https://github.com/sherlock-project/sherlock
WhatsMyName - https://whatsmyname.app
Namechk - https://namechk.com
Social-Analyzer - https://github.com/qeeqbox/social-analyzerSherlock is your best friend:
Code
git clone https://github.com/sherlock-project/sherlock.git
cd sherlock
python3 -m pip install -r requirements.txt
python3 sherlock username --timeout 10 --print-allPro tip from experience: Don't just search the exact username. I've found accounts by trying variations like username123, _username_, xusername, etc. Also check for common typos, you'd be surprised how many people fat finger their own usernames when creating accounts.
One time I spent hours looking for someone's Instagram, turns out they used a zero instead of the letter O in their username. Small details matter
REVERSE IMAGE INTELLIGENCE
Profile pics are seriously underrated for finding people across platforms.
My go to search engines:
Code
Google Images - images.google.com (good for Western content)
Yandex Images - yandex.com/images (absolutely destroys Google for face recognition)
TinEye - tineye.com (great for tracking image origins)
Bing Visual Search - bing.com/images (surprisingly good sometimes)Yandex is insane for finding people. I've located targets using Yandex that Google completely missed. It's especially good if your target has any Eastern European connections.
Tip: Always download the full resolution image, not just right-click save. Sometimes platforms serve you thumbnails that won't match in reverse searches. Check the image URL in dev tools to get the full size version.
METADATA EXTRACTION
This is where things get interesting. Most people have no idea how much data their photos leak.
ExifTool is king:
Code
[h1]Get everything[/h1]
exiftool image.jpg
[h1]Just GPS data (the good stuff)[/h1]
exiftool -GPS* image.jpg
[h1]Device fingerprinting[/h1]
exiftool -Make -Model -Software image.jpg
[h1]When was this actually taken[/h1]
exiftool -CreateDate -DateTimeOriginal image.jpgI've geolocated users from a single Instagram photo because they forgot to turn off location services. Androids are especially bad for this. They embed GPS coordinates in photos by default. (depending on the model)
Device info is also gold. If someone's using "iPhone 14 Pro Max" in their EXIF data, that narrows down their economic status and tells you they probably upgrade frequently. Software versions can indicate how security conscious they are.
Other tools worth knowing:
Code
Jeffrey's EXIF Viewer - good web interface
Metapicz - when you need something quick onlineSOCIAL GRAPH MAPPING
Understanding who's connected to who is crucial. Social networks leak information through relationships.
Manual techniques:
- Check mutual followers/following - birds of a feather and all that
- Look at who consistently likes/comments on posts
- Cross-reference tagged locations (people visit places with friends)
- "People you may know" suggestions reveal phone contact overlap
Facebook's graph search still works if you know the syntax. Most people don't realize this:
Code
Photos of [person] and [person]
Places visited by [person]
People who like [page] and work at [company]
Posts by [person] before [date]For automation:
Code
Twint - Twitter scraping (when it works)
Instagram-scraper - grab follower lists and post dataCACHED CONTENT RECOVERY
Deleted doesn't mean gone. The internet has a long memory.
Archive sources that matter:
Code
Wayback Machine - web.archive.org (the obvious one)
Archive.today - archive.ph (faster, more recent content)
Google Cache - cache:URL in search
Bing Cache - cached:URL (sometimes has stuff Google doesn't)I've recovered "deleted" social media profiles that were archived months earlier. People think deleting their account erases everything, but archives capture snapshots regularly.
Search operators:
Code
cache:twitter.com/username
site:instagram.com/username before:2024-01-01
site:facebook.com/username after:2023-06-01Pro tip: Set up Google alerts for your targets. Sometimes deleted content gets reposted or referenced elsewhere, and you'll catch it in real time.
AUTOMATION AND EFFICIENCY
Manual work is fine for one target, but automation scales everything up.
Frameworks:
Code
theHarvester - great for email enumeration and subdomains
Maltego - expensive but worth it if you do this professionally
SpiderFoot - solid free alternative to Maltego
Recon-ng - modular approach, good for custom workflowsFINAL THOUGHTS
This stuff takes practice and patience. Don't expect to master it overnight. I still learn new techniques regularly, and tools break/change constantly. The key is understanding the methodology. Tools come and go but the principles stay the same.
Document everything as you go. Screenshots, URLs, timestamps. It all matters.
I use a simple text file with timestamps for each investigation. Has saved my ass more than once.
Hope this helps some of you. Happy to answer questions or expand on any section.
Stay curious.
