Hacker News new | past | comments | ask | show | jobs | submit login
Dark Web OSINT with Python and OnionScan: Part One (automatingosint.com)
88 points by zcutlip on July 30, 2016 | hide | past | favorite | 7 comments



So I heard the course designer, who is this no-name author generally in Infosec for his work on this no-name Gray Hay Python book (yes, that's absurdist sarcasm).

https://talkpython.fm/episodes/transcript/37/python-cybersec...

He was talking up ISIS analysis using his OSINT methods for someone who does not speak Arabic by analyzing the black Jihadist flags (I find that kind of shoddy, as someone who knows that is painting with broad, but deservedly ugly brush for such people) with Python and OpenCV if I recall.

Has anyone taken the course and willing to say it was worth the money? He is no fool, and the price tag was steep, so I was curious if any in the community saw it is as a worthwhile investment opportunity.


It's neat to see some of my tor domains show up in https://github.com/automatingosint/osint_public/blob/master/... . There's even the unicode art I put in my http headers in the resulting json entry.


Not to take away from the content, but I do cringe whenever anything is installed by piping curl into bash. Yes, I understand that's exactly the provided way to install GVM and that this is supposed to be on a throwaway VPS, but this is an article focusing on security :|

If you were referencing a specific commit, okay. Just installing from HEAD? You might as well email the maintainer your credentials.


I mean, most programs run an installer as the alternative, which is still code being executed on your machine (often as root), doesn't piping bash have the same permissions?


I was shocked to learn of the existence of gvm, and also that the tutorial says to use go 1.4! I would have thought that most of the time just installing go from golang.org would be recommended. Gvm would of course have it's uses, where you need to keep an existing app on an old version of go until you've tested it on the latest go (or making use of gccgo perhaps), but this should be rarer than the uses of ruby's rvm.


How is piping a script to bash any different from downloading an executable and running that? You would only do it from trusted sources, of course, but I assume you don't build everything from source, but download binaries every once in a while.


The credentials to the single-use case VPS you just setup?




Consider applying for YC's Spring batch! Applications are open till Feb 11.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: