As a cybersecurity student, I wanted to find something to watch in my free time that would help fuel my desire to learn about computer security. I ended up landing on a show I somehow didn’t know existed. A show that accurately captures what it’s like to use and deploy hacking tools. That show was Mr. Robot.
For those who haven’t seen it, Mr. Robot is a wild ride centered around the hacker Elliot Alderson and his collaborator, Mr. Robot. The show explores a variety of topics beyond just hacking computer systems, such as the human element and how threat actors exploit people’s psychology, social patterns, relationships, and trust. It also focuses on government and corporate greed, power structures, and ideology. It’s a great show and I highly recommend it to anyone up for a dark, suspenseful thriller about hacking.
In the show, the main character Elliot creates several scripts using Python. This inspired me to create some scripts that matched the show’s vibes since I am learning Python in college. Nothing malicious, of course, but rather focused on OSINT (open-source intelligence).
One of the scripts I created was a username recon tool which, when given a username, checks several top social media sites for accounts with that same username. The tool checks each site and prints “found” if an account by that name is found, or “not found” if no account exists under that username.
The code for this script is straightforward and mirrors what I am learning in college. There are several imports, mostly for checking the social sites for HTTP 200 codes and text indicating there is a profile, however Colorama is there just for looks. The functions are what you would expect in this style of script, although I did create a “type out” function and a decrypt animation function just to give the tool a more movie-hacker look when you run it. I also couldn’t resist adding in some ASCII art.
The username recon script also has a few requirements: the Python packages “requests,” “Colorama,” and “curl_cffi.” Excluding Colorama, the other two packages are for checking the social media sites for the existence of the user-defined username.
The main issue I ran into while writing the script was checking Reddit for the existence of profiles. Cloudflare sometimes throws a JS challenge when scanning Reddit, which I managed to somewhat get around with a function that impersonates a browser with curl_cffi. It can also get past the test using a solution generated from a seed found inside the page’s HTML. However, this isn’t 100% consistent yet and may still return false positives or false negatives.
I learned a few new things while working on this script, including how to check social media sites for the existence of a profile automatically with Python using the packages “requests” and “curl_cffi.” I also learned a few fun things, like using a type out function to slow roll the text more like what you would see in the movies, as well as how to use Colorama to print colored text in the terminal.
You can download and use the tool (or just read the source code) by going to the GitHub repo here. I included all the relevant instructions inside the readme.md. I made sure the script will run on Windows, Linux, and WSL or Git Bash.
Overall, this was a fun script to create and play around with. Although I designed it to be flashy, my hope is that this script will help others with their OSINT gathering.
Have fun and stay safe!
