Book
Hunting Cyber Criminals
Vinny Troia, Wiley
Attacker-style reconnaissance for investigators: network and web enumeration, dorks, WHOIS, certificate logs, metadata, open storage, and people hunting, wrapped around the author's pursuit of The Dark Overlord. Good techniques, dated tools.
Published in 2020, this book blends offensive reconnaissance with investigation. Four parts cover network exploration, web exploration, digging for exposed data, and people hunting, with tips from named industry figures and a long case narrative about identifying the people behind a hacking group. Several chapters lean on specific commercial tools, including the author's own platform.
Never revised. The reconnaissance method still holds; chapters built on specific commercial tools, including one the author ran, have aged.
Worth it if
- You come from security and want OSINT framed as reconnaissance
- You investigate infrastructure: domains, certificates, exposed storage, metadata
- You want a long real case to see how the pieces connect
- You enjoy expert asides from well-known names in the field
Skip it if
- You want current tool instructions; the specific products have changed or gone
- You need structure on analysis and reporting; the book is weakest there
- You are uncomfortable with a book that interacts with threat actors directly
What is inside
- 01
Getting started
Prerequisites, Linux, API keys, and investigations and threat actors as a frame.
- 02
Part I: Network exploration
Manual exploration, advanced NMAP techniques, and automated discovery tools.
- 03
Part II: Web exploration
Website information gathering, directory hunting, search engine dorks, WHOIS, certificate transparency and internet archives, and a chapter on a commercial domain tool.
- 04
Part III: Digging for gold
Document metadata, interesting places to look, and publicly accessible data storage.
- 05
Part IV: People hunting
Researching people, images, and locations; social media; profile tracking and password-reset clues; passwords and dumps; interacting with threat actors; and cutting through the disinformation of a ten-million-dollar hack.
What you will be able to do
- Enumerate an organisation's infrastructure from the outside
- Pivot from a domain through certificates and archives to related assets
- Find exposed documents and storage, and read their metadata
- Follow a person across accounts using reset clues and dumps
How current it is
The 2020 edition is the only one. Dorks, certificate transparency, archives, and metadata techniques still work. Chapters tied to a named commercial domain tool and to the author's own breach platform are historical now.
- Updated
- First edition, 2020
- Maintained
- Archived
How to get the most from it
- 01
Read the case chapters first
They show why each technique exists. Then the technical parts make sense.
- 02
Substitute current tools
Where a chapter names a product, find the current equivalent before you try the steps.
- 03
Skip the self-interaction chapter unless it is your job
Interacting with threat actors is a specialised, risky activity. Read it for awareness, not practice.
Strengths
- Infrastructure reconnaissance explained from an attacker's view
- A memorable, real case
- Tips from named practitioners
Limitations
- Dated tool chapters
- Weak on analysis and reporting
- Some content promotes the author's own products
Pair it with
- ReadBookPaidIntermediate
OSINT Techniques
The current manual for the people-hunting half.
- ReadCoursePaidIntermediate
SANS SEC497: Practical Open-Source Intelligence
Teaches the infrastructure chapters with current tools.
- ReadCommunityFree + paidIntermediate
DEF CON Recon Village
The conference village where this style of reconnaissance is discussed.
FAQ
Questions, answered
Is the Data Viper platform still available?
Treat the chapter as historical. The techniques around breach data still apply; the specific platform should not be relied on.
Who is this for?
Security analysts, SOC teams, and investigators who want OSINT taught as reconnaissance. Journalists and human-rights researchers will find half of it irrelevant.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days