{"id":2243,"date":"2021-09-30T08:01:52","date_gmt":"2021-09-30T08:01:52","guid":{"rendered":"https:\/\/osintme.com\/?p=2243"},"modified":"2021-09-30T18:03:36","modified_gmt":"2021-09-30T18:03:36","slug":"osint-me-tricky-thursday-8-url-manipulation","status":"publish","type":"post","link":"https:\/\/osintme.com\/index.php\/2021\/09\/30\/osint-me-tricky-thursday-8-url-manipulation\/","title":{"rendered":"Osint Me Tricky Thursday #8 \u2013 URL manipulation"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"2243\" class=\"elementor elementor-2243\">\n\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-af93aa2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"af93aa2\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-bfe2b42\" data-id=\"bfe2b42\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b1a6294 elementor-widget elementor-widget-text-editor\" data-id=\"b1a6294\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This week&#8217;s focus will be on reviving a somewhat forgotten and neglected section of the blog &#8211; the <a href=\"https:\/\/osintme.com\/index.php\/tag\/tricky-thursday\/\">Osint Me Tricky Thursday<\/a>.<\/p><p>And without further ado, I want to get right into it, sharing some tips and tricks on how to use URL manipulation for OSINT.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-76af016 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"76af016\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-67414b6\" data-id=\"67414b6\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-cda7b1b elementor-widget elementor-widget-heading\" data-id=\"cda7b1b\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">1. Understanding the basics of URLs<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-1a24756 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"1a24756\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1536cf8\" data-id=\"1536cf8\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6a1cc4c elementor-widget elementor-widget-text-editor\" data-id=\"6a1cc4c\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Even if sometimes we are unable to recall the exact meaning of the acronym URL (Uniform Resource Locator), we all know what it is and what it does &#8211; it&#8217;s a human-readable link in your browser that allows you to access online resources residing on a specific IP address.<\/p><p>A URL can be general in nature, pointing to a landing page of a website (for example <a href=\"https:\/\/osintme.com\/\">osintme.com)<\/a>, or to a more defined object or resource using the path to a file, such as a PDF form or a text file on that website, for instance:<\/p><p><a href=\"https:\/\/osintme.com\/wp-content\/uploads\/2021\/05\/CySA-002-Notes.pdf\">https:\/\/osintme.com\/wp-content\/uploads\/2021\/05\/CySA-002-Notes.pdf<\/a><\/p><p>A thing to remember &#8211; many domains have hidden URLs that are never usually accessed or searched for by regular users. Some of those URLs are part of the deep web, meaning that they are not indexed by search engines &#8211; but sometimes they can be accessible by discovering and visiting the exact URL.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-802dbff elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"802dbff\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-c14aa0b\" data-id=\"c14aa0b\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-40f91a9 elementor-widget elementor-widget-heading\" data-id=\"40f91a9\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">2. Subdomain enumeration<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-229c3e8 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"229c3e8\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-4f7d76c\" data-id=\"4f7d76c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-6862b9f elementor-widget elementor-widget-text-editor\" data-id=\"6862b9f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Every valid Internet domain name is comprised of the following components:<\/p><ol><li><strong>Top level domain<\/strong> \u2013 whatever follows after the last dot in the URL string. Common top level domains examples are: .com, .org, .gov, .net, .uk, .ie\u2026<\/li><li><strong>Second level domain<\/strong> \u2013 whatever is before the top level domain. So, the second level domain of this blog is <strong><em>osintme<\/em><\/strong> and the top level domain is <strong><em>.com<\/em><\/strong>.<\/li><li><strong>Subdomain<\/strong> \u2013 whatever is positioned before the second level domain. It can be anything really, for example: aws.amazon.com \u2013 the <strong><em>aws<\/em><\/strong> part is the subdomain here.<\/li><\/ol>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-08543ed elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"08543ed\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7522aa4\" data-id=\"7522aa4\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d6c70d0 elementor-widget elementor-widget-text-editor\" data-id=\"d6c70d0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Subdomain enumeration is used to identify and expose subdomains that are infrequently used or that are not meant to be accessed by regular users. This can be done manually by simply adding a common word before the second level domain:<\/p><ul><li>blog.example.com<\/li><li>news.example.com<\/li><li>mail.example.com<\/li><li>store.example.com<\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a41da8a elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a41da8a\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-107dedf\" data-id=\"107dedf\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d8cb350 elementor-widget elementor-widget-text-editor\" data-id=\"d8cb350\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>However, manual domain enumeration is long-term ineffective: it can be laborious and time consuming, or won&#8217;t work at all if subdomains have uncommon names.<\/p><p>You can automate subdomain enumeration using a tool like Sublist3r&#8230;<\/p><p><a href=\"https:\/\/github.com\/aboul3la\/Sublist3r\">https:\/\/github.com\/aboul3la\/Sublist3r<\/a><\/p><p>&#8230; or The Harvester:<\/p><p><a href=\"https:\/\/github.com\/laramies\/theHarvester\">https:\/\/github.com\/laramies\/theHarvester<\/a><\/p><p>Alternatively, you can use web tools such as Spyse&#8217;s Subdomain Finder:<\/p><p><a href=\"https:\/\/spyse.com\/tools\/subdomain-finder\">https:\/\/spyse.com\/tools\/subdomain-finder<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-33f9fb2 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"33f9fb2\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-d69026f\" data-id=\"d69026f\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-353f6ed elementor-widget elementor-widget-heading\" data-id=\"353f6ed\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">3. Connecting directly through an IP address<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-f7454f0 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"f7454f0\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-8da3d27\" data-id=\"8da3d27\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d02a895 elementor-widget elementor-widget-text-editor\" data-id=\"d02a895\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The URL bar is not limited to working only with human-readable input like domain names.<\/p><p>DNS &#8211; Domain Name System &#8211; entries appear in a human friendly name (www.google.com) &#8211; but this is not the only way to connect to a website. Every resolvable domain will have what&#8217;s known as an <strong>A record<\/strong> (Address Record), which points to an IP address.<\/p><p>I can illustrate this with an example of a Hack The Box machine <a href=\"https:\/\/forum.hackthebox.eu\/discussion\/4221\/official-delivery-discussion\"><strong>Delivery<\/strong><\/a> that was accessible under this URL (it won&#8217;t resolve now, unless a HTB users activates it &#8211; they only stay online for 24h):<\/p><p><a href=\"http:\/\/helpdesk.delivery.htb\">http:\/\/helpdesk.delivery.htb<\/a><\/p><p>Part of the task of compromising this machine involved connecting to it through its IP address, which can be further enhanced by adding a port number:<\/p><p>http:\/\/10.129.229.49:22<\/p><p>http:\/\/10.129.229.49:80<\/p><p>Sometimes you can glean extra information from connecting to an online resource using various ports, of course if they are open.<\/p><p><strong>NOTE:<\/strong> This will not always work &#8211; it depends on details of a security configuration. Also, services like Cloudflare or hosting providers are likely to block this method of connection.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-b2be2a8 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"b2be2a8\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-1d3db2c\" data-id=\"1d3db2c\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-9e73bcb elementor-widget elementor-widget-heading\" data-id=\"9e73bcb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">4. See anything with a number? Enumerate!<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-ac6e35b elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"ac6e35b\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-6373aec\" data-id=\"6373aec\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d20d767 elementor-widget elementor-widget-text-editor\" data-id=\"d20d767\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This technique can be used wherever you find a URL that implies the existence of sequentially ordered resources. For instance, take LinkedIn groups:<\/p><p><a href=\"https:\/\/www.linkedin.com\/groups\/113\/\">https:\/\/www.linkedin.com\/groups\/113\/<\/a><\/p><p>At the end of that URL there is a number that you can manipulate by switching digits and searching through the listed resources by incrementally increasing or decreasing the numeral value.<\/p><p>This can work particularly well for photo galleries, file directories, usernames and so on.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-4328791 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"4328791\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a724271\" data-id=\"a724271\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-d7eabc3 elementor-widget elementor-widget-heading\" data-id=\"d7eabc3\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">5. Increase image resolution<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-c4ae2fd elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"c4ae2fd\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-47a5295\" data-id=\"47a5295\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-77bb99e elementor-widget elementor-widget-text-editor\" data-id=\"77bb99e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Sometimes you might come across a link containing an image file in a lower resolution. Chances are that there is a higher resolution image out there too, but you just don&#8217;t know the exact URL for it.<\/p><p>In some cases the higher resolution image can be viewed by manipulating the size from the URL. Take a look at the image below:<\/p><p><a href=\"https:\/\/ucarecdn.com\/\/985d4f2c-973a-4ae6-a2b1-f992683da70b\/-\/resize\/200x\/\">https:\/\/ucarecdn.com\/\/985d4f2c-973a-4ae6-a2b1-f992683da70b\/-\/resize\/200x\/<\/a><\/p><p>Now &#8211; try switching this part -\/200x\/ &#8211; to \/2200x\/ by adding 2 in the front&#8230;<\/p><p>The effectiveness of this method will depend on each website and each URL. Different services will have different parameteres, located in different parts of the URL, like for example this image of pizza:<\/p><p><a href=\"https:\/\/cdn.shopify.com\/s\/files\/1\/1405\/0664\/products\/4791207-9790062099-Pizza1_250x250_crop_center@2x.progressive.jpg?v=1469649640\">https:\/\/cdn.shopify.com\/s\/files\/1\/1405\/0664\/products\/4791207-9790062099-Pizza1_250x250_crop_center@2x.progressive.jpg?v=1469649640<\/a><\/p><p>If you noticed the 250&#215;250 value (pixels in this case), try changing it to something else.<\/p><p>For instance:<\/p><p><a href=\"https:\/\/cdn.shopify.com\/s\/files\/1\/1405\/0664\/products\/4791207-9790062099-Pizza1_1250x1250_crop_center@2x.progressive.jpg?v=1469649640\">https:\/\/cdn.shopify.com\/s\/files\/1\/1405\/0664\/products\/4791207-9790062099-Pizza1_1250x1250_crop_center@2x.progressive.jpg?v=1469649640<\/a><\/p><p>Other services might allow you to change the size parameters by substituting the word &#8220;small&#8221; with &#8220;large&#8221; in the URL, and so on.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d003bbb elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d003bbb\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ac01132\" data-id=\"ac01132\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-a2e4209 elementor-widget elementor-widget-heading\" data-id=\"a2e4209\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">6. Add something at the end of a URL<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-8acae92 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"8acae92\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b0ee8c7\" data-id=\"b0ee8c7\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-38964e6 elementor-widget elementor-widget-text-editor\" data-id=\"38964e6\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Many websites contain files that are not being indexed by search engines &#8211; for example, robots.txt.<\/p><p>As per this <a href=\"https:\/\/developers.google.com\/search\/docs\/advanced\/robots\/intro\">Google explainer<\/a>, a robots.txt file is used to manage crawler traffic to a website, and <em>usually<\/em> to keep a file off Google, depending on the file type.<\/p><p>This file will not reveal any sensitive data, but it might point a user to resources currently in development &#8211; or to whatever the website&#8217;s owner does not want the wider public to see.<\/p><p>You can try this method by visiting random websites and adding this value &#8211; \/robots.txt &#8211; (as well as trying some other options) to the URL.<\/p><p>Example:<\/p><p><a href=\"https:\/\/www.rte.ie\/robots.txt\">https:\/\/www.rte.ie\/robots.txt<\/a><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-544ddf5 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"544ddf5\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-40e3f56\" data-id=\"40e3f56\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-9ba9351 elementor-widget elementor-widget-heading\" data-id=\"9ba9351\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">7. Unshorten a URL<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-a2c39b7 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"a2c39b7\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b4a1c75\" data-id=\"b4a1c75\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-5bfd579 elementor-widget elementor-widget-text-editor\" data-id=\"5bfd579\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Link shortening services are legitimately used to condense very long and messy URLs into short and sweet, legible and human friendly links. Sadly, these resources are also often used by scammers and cyber criminals as a method of obscuring a URL that might otherwise appear suspicious to any prospective victim.<\/p><p>Luckily, there are several resources and tricks available to unshorten those links.<\/p><p>If it&#8217;s a Bitly shortened URL (you can tell by the Bitly name in the shortened URL), then you can unshorten it by simply adding a + sign at the end of it:<\/p><p><a href=\"https:\/\/bit.ly\/3F3vlKO\">https:\/\/bit.ly\/3F3vlKO<\/a><\/p><p><a href=\"https:\/\/bitly.com\/3F3vlKO+\">https:\/\/bitly.com\/3F3vlKO+<\/a><\/p><p>This works for some other URL shortening services. For others, you can use one of the following resources that help disentangle shortened links:<\/p><ul><li><a href=\"https:\/\/wheregoes.com\/\">https:\/\/wheregoes.com\/<\/a><\/li><li><a href=\"http:\/\/urlxray.com\/\">http:\/\/urlxray.com\/<\/a><\/li><li><a href=\"https:\/\/redirectdetective.com\/\">https:\/\/redirectdetective.com\/<\/a><\/li><li><a href=\"https:\/\/www.spyoffers.com\/\">https:\/\/www.spyoffers.com\/<\/a><\/li><\/ul>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-d67ce60 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"d67ce60\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-a5eaba1\" data-id=\"a5eaba1\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-c778312 elementor-widget elementor-widget-heading\" data-id=\"c778312\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h4 class=\"elementor-heading-title elementor-size-default\">8. Web parameter tampering [not strictly OSINT!!!]<\/h4>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-16fdd07 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"16fdd07\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-ecdcfe1\" data-id=\"ecdcfe1\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-1174105 elementor-widget elementor-widget-text-editor\" data-id=\"1174105\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The last part of these URL related tips and tricks is very much a grey area, on the border between OSINT, pentesting and exploiting vulnerabilities. The legitimate use case for these methods is pentesting of web applications.<\/p><p>OWASP classes these actions as <a href=\"https:\/\/owasp.org\/www-community\/attacks\/Web_Parameter_Tampering\"><strong>web parameter tampering<\/strong><\/a> and identifies a number of attacks that can be perpetrated from a URL level against poorly written and not adequately secured web applications.<\/p><p>As per the OWASP page:<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-f64867f elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"f64867f\" data-element_type=\"section\" data-e-type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-b4539dd\" data-id=\"b4539dd\" data-element_type=\"column\" data-e-type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t<div class=\"elementor-element elementor-element-b17d30e elementor-widget elementor-widget-text-editor\" data-id=\"b17d30e\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>An attacker can tamper with URL parameters directly. For example, consider a web application that permits a user to select their profile from a combo box and debit the account:<\/em><\/p><p><em><code class=\"language-plaintext highlighter-rouge\">http:\/\/www.attackbank.com\/default.asp?profile=741&amp;debit=1000<\/code><\/em><\/p><p><em>In this case, an attacker could tamper with the URL, using other values for profile and debit:<\/em><\/p><p><em><code class=\"language-plaintext highlighter-rouge\">http:\/\/www.attackbank.com\/default.asp?profile=852&amp;debit=2000<\/code><\/em><\/p><p><em>Other parameters can be changed including attribute parameters. In the following example, it\u2019s possible to tamper with the status variable and delete a page from the server:<\/em><\/p><p><em><code class=\"language-plaintext highlighter-rouge\">http:\/\/www.attackbank.com\/savepage.asp?nr=147&amp;status=read<\/code><\/em><\/p><p><em>Modifying the status variable to delete the page:<\/em><\/p><p><em><code class=\"language-plaintext highlighter-rouge\">http:\/\/www.attackbank.com\/savepage.asp?nr=147&amp;status=del<\/code><\/em><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Tips and tricks on how to use URL manipulation for OSINT.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[6],"tags":[27,122,28,26,144],"class_list":["post-2243","post","type-post","status-publish","format-standard","hentry","category-open-source-intelligence","tag-osint-tricks","tag-pentesting","tag-techniques","tag-tricky-thursday","tag-url"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/2243","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/comments?post=2243"}],"version-history":[{"count":37,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/2243\/revisions"}],"predecessor-version":[{"id":2403,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/posts\/2243\/revisions\/2403"}],"wp:attachment":[{"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/media?parent=2243"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/categories?post=2243"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/osintme.com\/index.php\/wp-json\/wp\/v2\/tags?post=2243"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}