Username & Social Media Footprinting

Track online identities across platforms using automated username enumeration, avatar hashing, and data breach queries.

// prerequisite reading

OSINT Basics

Overview

In OSINT challenges, an initial clue often consists of a single username, handle, or avatar image.

An attacker’s goal is to discover associated accounts across social media platforms, GitHub repositories, forums, paste sites, and data breach records to construct a complete target profile.

1. Automated Username Enumeration

Sherlock

Sherlock searches for a given target username across over 400 social websites:

# Search for username across all supported platforms
sherlock target_username

# Save output to text file and filter false positives
sherlock target_username --output results.txt --print-found

Maigret

Maigret is an advanced fork of Sherlock that queries over 3,000 sites, extracts user profile metadata (names, bios, locations, avatar URLs), and generates interactive HTML reports:

# Run maigret and export HTML report
maigret target_username --html

2. Avatar & Profile Picture Matching

Users frequently reuse identical avatar images across multiple platforms.

Reverse Image Search Engines

Google Images: images.google.com
Yandex Images (Best for faces/portraits): yandex.com/images
TinEye: tineye.com
PimEyes (Facial recognition engine): pimeyes.com

Avatar Hash Matching (Gravatar)

If a target uses Gravatar, their profile image URL is generated using an MD5 hash of their lowercased email address:

$$\text{Gravatar URL} = \text{https://www.gravatar.com/avatar/} + \text{MD5}(\text{email})$$

Reversing Gravatar Hashes:

Extract the 32-character hex MD5 hash from the Gravatar URL.

Query crackstation or hashcat against email wordlists:

hashcat -m 0 gravatar_hash.txt emails_wordlist.txt

3. GitHub & Code Repository Footprinting

Developers inadvertently leave sensitive information inside public GitHub accounts:

# GitHub Search Dorks
"target_username" AND "password"
"target_username" AND "API_KEY"
user:target_username filename:.env
user:target_username extension:pem

Extracting Unlinked Emails via Git Commits

Even if a user hides their email on GitHub, public commits expose their author email address:

# Clone a target repository
git clone https://github.com/target_username/repository.git
cd repository

# Inspect commit log for author email address
git log --format='%ae' | sort -u
git log --format='%an <%ae>' | sort -u