Skip to content

USAGE_GUIDE.md

Latest commit

 

History

History
455 lines (365 loc) · 12.4 KB

USAGE_GUIDE.md

File metadata and controls

455 lines (365 loc) · 12.4 KB

Worker OSINT Toolkit - Usage Guide

Purpose

This OSINT (Open Source Intelligence) toolkit is specifically designed for worker advocacy, labor organizing, and corporate accountability investigations. It turns surveillance and investigation tools - typically used against workers - into tools that empower workers' rights.

Table of Contents

  1. Why This Matters
  2. OPSEC - Operational Security
  3. Legal & Ethical Boundaries
  4. Tool Overview
  5. Investigation Workflows
  6. Use Cases
  7. Evidence Preservation

Why This Matters

The Problem

  • Corporations use OSINT to investigate workers, unions, and organizers
  • Insurance companies use it to deny claims and surveil claimants
  • Law enforcement uses it to monitor activists and labor movements
  • Workers lack access to these same investigative capabilities

The Solution

This toolkit provides workers with:

  • Corporate transparency: Investigate company structures, ownership, finances
  • Safety documentation: Track OH&S violations and workplace incidents
  • Wage theft evidence: Find enterprise agreements, award rates, payment records
  • Organizing intelligence: Research company anti-union activities and history
  • Legal support: Gather evidence for Fair Work claims and legal cases

OPSEC - Operational Security

CRITICAL: You Leave Digital Footprints

Every OSINT investigation creates traces:

  • IP addresses logged on websites
  • Search queries tracked by Google
  • DNS requests visible to ISPs
  • Certificate lookups recorded in logs

Protection Strategies

Essential (Do Always)

  1. Use VPN - Routes traffic through another server, masks your IP

    • Recommended: ProtonVPN, Mullvad, IVPN
    • Free options: ProtonVPN free tier, Windscribe

  2. Dedicated Browser - Separate from personal browsing

    • Firefox with privacy addons
    • Brave browser
    • Tor Browser for sensitive investigations

  3. Clear Data - After each investigation

    • Clear cookies, cache, history
    • Close all tabs
    • Restart browser

  4. Document Everything - For legal protection

    • What you searched
    • When you searched it
    • What you found
    • Why it was relevant

Advanced (For Sensitive Work)

  • Tor Browser - Anonymous routing (slower but more private)
  • Dedicated Device - Separate laptop/phone for OSINT work
  • Tails OS - Operating system designed for anonymity
  • Burner Accounts - Temporary emails/accounts for registration
  • Time Zone Awareness - Search during target's business hours to blend in

What NOT To Do

❌ Use your personal device without VPN ❌ Log into personal accounts during investigations
❌ Access company systems without authorization ❌ Save sensitive data to cloud services ❌ Discuss investigations on monitored platforms

Legal & Ethical Boundaries

✅ PERMITTED Activities

Public Records ✓

  • Business registries (ABN, CRO)
  • Domain registration (WHOIS)
  • Certificate transparency logs
  • Court records and judgments
  • Fair Work Commission decisions
  • Company annual reports

Public Websites ✓

  • Company websites and social media
  • Search engines (Google, Bing)
  • Archive.org (Wayback Machine)
  • Public GitHub repositories
  • News articles and media

Passive Intelligence ✓

  • DNS lookups
  • Certificate searches
  • Subdomain enumeration
  • Social media profiles (public)

❌ PROHIBITED Activities

Computer Crimes ✗

  • Unauthorized system access
  • Using stolen credentials
  • Exploiting vulnerabilities
  • DDoS attacks or system disruption

Harassment & Impersonation ✗

  • Stalking individuals
  • Impersonating others
  • Social engineering with false pretenses
  • Threats or intimidation

Data Crimes ✗

  • Using stolen databases
  • Paying for hacked credentials
  • Accessing confidential files
  • Breaching non-public systems

⚠️ GREY AREAS (Proceed Carefully)

Web Scraping

  • Check robots.txt and Terms of Service
  • Respect rate limits
  • Some sites prohibit automated access
  • Risk: Account bans, legal threats

Leaked Databases

  • If you find leaked data: Legal to analyze what you find publicly
  • If you pay for leaks: Potentially illegal
  • If you hack to obtain: Definitely illegal

Social Engineering

  • Calling company claiming to be someone else: Illegal
  • Asking questions as yourself: Legal
  • Context and honesty matter

Tools

1. Business Registry Lookups

ABN Lookup (Australia)

Purpose: Verify Australian business legitimacy, get ACN, GST status When to use:

  • Verifying company exists
  • Finding official business name
  • Checking GST registration
  • Getting ABN for legal documents

Example:

ABN: 16009661901 (Qantas)
Returns: Business name, ACN, status, entity type, location

CRO Lookup (Ireland)

Purpose: Irish company registry search When to use:

  • Investigating Irish companies
  • Finding directors and shareholders
  • Checking company status

2. Domain & Infrastructure

WHOIS Lookup

Purpose: Domain registration details Returns: Registrant, registrar, nameservers, dates Use for:

  • Identifying domain ownership
  • Finding registration dates (company age)
  • Checking privacy protection
  • Finding abuse contacts

DNS Reconnaissance

Purpose: Map company's internet infrastructure Returns: IP addresses, mail servers, nameservers, SPF/DMARC records Use for:

  • Understanding email infrastructure
  • Finding cloud providers (AWS, Azure, etc.)
  • Discovering third-party services
  • Mapping attack surface

Certificate Transparency

Purpose: Discover ALL subdomains via SSL certificates Returns: 140+ subdomains for large companies Use for:

  • Finding hidden portals and services
  • Discovering development environments
  • Locating API endpoints
  • Internal tool discovery

Example findings for Qantas:

  • aimintranet.qantas.com.au - Internal intranet
  • confluence.qantas.com.au - Internal wiki
  • api-stg.qantas.com.au - Staging API
  • hr.qantas.com.au - HR systems

Subdomain Scanning

Purpose: Active enumeration of subdomains Combines: Certificate transparency + DNS checks Use for: Complete infrastructure mapping

3. Historical & Social

Wayback Machine

Purpose: View historical website snapshots Returns: Archived pages from 1996-present Use for:

  • Finding deleted policies
  • Tracking company changes
  • Recovering removed content
  • Proving policy violations

Example: View Qantas website from 1997

Social Media Search

Purpose: Find company social media presence Platforms: LinkedIn, Twitter, Facebook, Instagram, YouTube Use for:

  • Official accounts
  • Employee networks
  • Customer complaints
  • Corporate messaging

4. Search & Discovery

Google Dorking

Purpose: Advanced targeted searches Use for:

  • Finding leaked documents
  • Discovering PDFs with employee info
  • Locating enterprise agreements
  • Fair Work decisions

Worker-Focused Dork Examples:

site:company.com filetype:pdf (employee OR union OR agreement)
site:fairwork.gov.au "company name"
"company name" "underpayment" OR "wage theft"
site:company.com "OH&S" OR "safety" filetype:pdf

Email Harvesting

Purpose: Find contact emails Returns: Common patterns, search strategies Use for:

  • Contacting HR
  • Finding union reps
  • Whistleblower contacts
  • OHS officers

5. Security & Verification

Breach Check

Purpose: Check if company emails appear in data breaches Use for:

  • Assessing security practices
  • Finding compromised accounts
  • Evidence of poor data protection

IP Investigation

Purpose: Analyze hosting infrastructure Returns: ISP, location, hosting provider Use for:

  • Understanding hosting setup
  • Geographic location
  • Cloud vs on-premise

Investigation Workflows

Quick Verification (15 minutes)

Goal: Verify company is legitimate Tools:

  1. ABN/CRO Lookup → Basic company info
  2. WHOIS → Domain ownership
  3. Social Media Search → Official presence

Output: Company legitimacy confirmed, basic details

Standard Investigation (1-2 hours)

Goal: Comprehensive company profile Tools:

  1. Business Registry → Legitimacy
  2. WHOIS + DNS → Infrastructure
  3. Certificate Transparency → Subdomains
  4. Google Dorking → Documents
  5. Social Media → Online presence
  6. Wayback Machine → History

Output: Complete company profile, infrastructure map, document collection

Deep Investigation (Multiple sessions)

Goal: Labor dispute preparation, legal case building Tools: All tools + manual research Process:

  1. Week 1: Infrastructure mapping, document collection
  2. Week 2: Historical analysis, timeline building
  3. Week 3: Evidence preservation, report compilation

Use Cases

Wage Theft Investigation

Tools: Google Dorking, ABN Lookup, Wayback Machine Process:

  1. Find enterprise agreements via Google dorks
  2. Get company ABN for legal documents
  3. Search Fair Work decisions
  4. Check historical pay rates via Wayback
  5. Document discrepancies

OH&S Violation Documentation

Tools: Google Dorking, Wayback Machine, Social Media Process:

  1. Search for safety reports: site:company.com "OH&S" filetype:pdf
  2. Find incident reports
  3. Check Wayback for deleted safety pages
  4. Monitor social media for complaints
  5. Cross-reference with Fair Work cases

Union Organizing Research

Tools: Certificate Transparency, Email Harvest, Social Media, Google Dorking Process:

  1. Map company structure (subdomains)
  2. Find employee emails
  3. Research anti-union history
  4. Identify sympathetic employees
  5. Locate HR contacts

Enterprise Bargaining Preparation

Tools: ABN Lookup, Google Dorking, DNS, Financial records Process:

  1. Verify company structure (ABN)
  2. Find existing agreements
  3. Research company finances
  4. Map parent company relationships
  5. Identify negotiation contacts

Evidence Preservation

Why It Matters

  • Websites change or disappear
  • Documents get deleted
  • Social media posts removed
  • Companies scrub embarrassing content

How To Preserve

Screenshots

  • Full page screenshots (not just visible area)
  • Include URL and timestamp
  • Save as PNG (lossless)
  • Name files systematically: companyname-pagetype-YYYYMMDD.png

Web Archives

Documents

  • Download PDFs immediately
  • Save to multiple locations (local + cloud)
  • Note source URL in filename
  • Create MD5 hash for legal authenticity

Metadata

Always document:

  • Date/time of collection
  • URL where found
  • Tool used to find it
  • Context (why relevant)
  • Your location (if using VPN, note exit location)

Organization

investigation-companyname/
├── evidence/
│   ├── documents/
│   ├── screenshots/
│   └── archived-pages/
├── notes/
│   ├── timeline.md
│   ├── findings.md
│   └── contacts.md
└── reports/
    └── final-report.md

Getting Started

First Investigation Checklist

  • VPN connected
  • Dedicated browser open
  • Evidence folder created
  • Investigation documented (who, what, why)
  • Legal boundaries understood
  • OPSEC measures in place

Recommended Investigation Order

  1. Start broad: Company name, industry, location
  2. Verify legitimacy: Business registry lookup
  3. Map infrastructure: Domain and DNS
  4. Discover assets: Certificates and subdomains
  5. Search for docs: Google dorking
  6. Check history: Wayback Machine
  7. Assess security: Breach check
  8. Find contacts: Email harvest, social media

Remember

  • Take breaks during long investigations
  • Review OPSEC regularly
  • Document as you go (not at the end)
  • Ask for help when needed
  • Prioritize worker safety over investigation speed

Support & Resources

Fair Work Commission (Australia)

Workplace Relations Commission (Ireland)

Legal Support

This toolkit is for legitimate worker advocacy and legal purposes only. Always operate within legal boundaries and prioritize safety.