[dfworks]

If anyone found the above interesting, I wrote a short article mapping plane activity on FlightRadar's 'blocked' list (i.e FlightRadar had agreed to remove the ADBS data from their dataset following probable legal pressure).

https://dfworks.xyz/blog/hnwi-osint-private-jet/

Slightly tangential so feel free to remove if irrelevant

[araes]

The article was interesting alone, simply for the Google Dork technique explanation. Have not heard the "unusual, yet specifically frequent" search technique described that way previously. Very similar to what's necessary for searching StackExchange and similar, such as "site:https://aviation.stackexchange.com/ tracking private planes"

The Bombardier Global Express 6000 GLT6 result is interesting, as it's a plane with a known large number of military conversions. https://en.wikipedia.org/wiki/Bombardier_Global_Express#Mili...

Known Conversions: GlobalEye, Project Dolphin, Raytheon Sentinel, Saab Swordfish, PAL Aerospace P-6, E-11A, HALOE, PEGASUS, Hava SOJ, CAEW, HADES.

Actually has a tie-in with the article, since the Hava SOJ is an air stand-off jammer configuration for the Turkish region.

Otherwise, if I still worked for the government contracting, I'd probably offer you a job, although you're apparently British, so there might have been citizenship issues.

[spudlyo]

Apparently people now call using Google's advanced search operators Dorking, neat! I guess I've been dorking for a while.

Most of us know about "site:" since it's extremely handy, but there are a lot more. For some reason I had it in my head that many of the documented operators didn't work properly -- or at least I couldn't get them to work properly the last time I tried to experiment. I'll have to try again.

[dfworks]

There was a very recent "bug" in Search where the site: operator stopped working for a little bit and everybody in the OSINT community had a bit of a meltdown - https://www.digitaldigging.org/p/search-alert-google-filetyp...

The date operators from: to: I think have been unsupported for a while and replaced with a dropdown in the UI

filetype: is a fave and has been working for as long as I can remember

AROUND(number) is pretty useful too although I find that might be a bit buggy sometimes

There is a good list here https://www.exploit-db.com/google-hacking-database showing how dorks can be used for pentesting and/or generally finding insecure stuff

[araes]

Thanks, had no idea there were that many specific operators and combinations of operators.

At least in the last year, looks like "inurl", "intitle", and "intext" have all been getting a lot of use.

Also, a lot of "index of". "db.py", "store", "secret", "ec2 -aws", "mysql inurl:./db/", ect... in combination. Must be a lot of low hanging fruit in the orchard.

[jjwiseman]

Google dorking has been a thing for more than 20 years: https://kit.exposingtheinvisible.org/en/google-dorking.html

(Your comment downplaying someone else's work, while simultaneously showing your lack of historical knowledge on the topic about which you're commenting, based on my specific googling to find the date of coinage, might make you eligible to be "a foolish or inept person as revealed by Google".)

[dfworks]

Yep, British for my sins, as a US soldier once described to me, we are your least worst enemy

[flyinghamster]

That's LADD (Limited Aircraft Data Displayed), which requires that aircraft marked as such in the FAA's database to be removed from the official data feeds used by the commercial flight radar sites.

Crowdsourced data isn't subject to LADD, so adsbexchange and other such sites can and do display such aircraft.

For flights within the US, there's also a private address program that allows an ADS-B equipped plane to broadcast an alternate address.

https://www.faa.gov/air_traffic/technology/equipadsb/privacy

[dfworks]

Every day is a learning day!

[jjwiseman]

That was interesting, thanks. I liked the co-location analysis idea.