Breached Data Search
Using the information that I obtained during Recon, I am now going to grep pieces of information through a collection of breached databases that I have.
This is my collection.
Any hits will be very beneficial. Breached data contains PPI and confidential information.
Email/Password combos, SSN, Addresses, Full Names, Phone Numbers, Etc..
This information can then be used as pivot points for enhanced POI investigations.
Humans have a tendency to be sloppy when it comes to cyber security related to passwords. Using the same password for multiple accounts is a thing. It is not a smart thing but it is an easy thing so it is a rather popular thing to do. It doesn’t matter how complicated and safe you may think your password is, if you use the same password for multiple accounts and one of those accounts gets breached, that password when dumped on the darkweb will be in plain text.
How many breaches happen that are never reported to the end-user who’s data has been compromised?
Anyway, I love breached data. Some say that the use of breached data is unethical since it is technically “stolen” data. As far as I’m concerned, I didn’t steal it. I obtained it from open sources in the wild that anybody can access if they know how to find them.
Moving forward…
No hits for that domain email.
“realstreetstaff” is the social media handle for this company. I got a 5 different email/pw combos and 2 LinkedIn accounts password hashes. I was also able to get a full name because the person used her first name in her password. The email format for for this company is first name initial then last name @realstreetstaffing.com.
From the looks of it, one of the in-scope IP addresses for realstreet.com was used to create multiple porn site accounts. I need to check ownership of the IP at the time the account was made to verify if it was realstreet.com that owned it then. There was also an gmail address that I will be doing some OSINT on if it was in fact realstreet’s IP at that time.
For now I am done. I’ve found a few old but valuable leads.
I’ll be back for more grepping when I find more to grep.
Filed under: Uncategorized - @ January 23, 2025 10:37 AM