search

theabraxas / Battalion

Battalion is a tool used to automate reconnaissance and assist both pentesters and internal security/admin teams.
44 stars 7 forks source link

Twitter API Research! #21

Open theabraxas opened 7 years ago

theabraxas commented 7 years ago

User Scan currently contains the following datas: [full name] [email addresses] [company name] [~other stuff]

Would like to investigate using the Twitter API to search for things like this:

[In Twitter Profile: Company name] AND [[in name field: full name] OR [in profile: email address]

Variations on searches like this (possibly test things like: "currently work at [company name]" ) to see if we can identify twitter usernames of probable employees of the target company.

Outputs will include: '[name] has twitter[t/f] with account named [username]' Potentially include a confidence score based on clarity of match from API.

KurtPrice commented 6 years ago

If this tool was integrated would you be okay with the use of the Twitter API in python or would you prefer this to be done in shell scripts?

KurtPrice commented 6 years ago

So a quick read of the Twitter API documentation and I can see that we will need a few things. One we need a system to allow users to provide their own API Key and API Secret to the library. We obviously can't just put on in the source code for anyone to use. Once that system is in place the next step for us would be to actually code up our portion of it.

My first thought would be to create files and identify the API tokens from within that file if it exists, otherwise we would prompt the user for the keys and add them to the file. I also found an article that does a great job of explaining the basics of the API in python found here

KurtPrice commented 6 years ago

To add on to the above, the Twitter API recently added an approval process for developers and may make this a solution that is undesirable. If anyone would like to add their API keys they would first have to go through at least a 24 hour process explaining why they would like to use the API.

eidolonpg commented 6 years ago

Hi Kurt, sorry for the delay on getting a response into this thread. First of all, any implementation is acceptable. Shell scripts have never been our long-term vision, but were used for rapid prototyping. Given that I'd be happy to integrate whatever.

To your other comments: Interesting! I had no idea there was actually an approval process, that feels like a barrier to utilizing Twitter API in general. Technically not a barrier to any integration here.