 Welcome to our next talk Vicente Aguilera does he's going to Tell us that we're not only followed by the government and he shows it with a live demo So and hopefully he says everything will go Alright today. So give him a warm applause for his talk Thanks with morning Well at this moment perhaps some of us are being Investigated or under investigation without our knowledge But at the same time maybe Some of us are investigating some other Okay, we don't have the same infrastructure and resources that the government but We have access to a lot of information public information and We have the tools and we have the knowledge to exploit this information and to generate intelligence. Okay This talk is about well now It will speak about a tool that I have developed team for League To analyze The public information in social networks mainly Twitter and I will talk mainly about the five points the first point is is about why the social networks are Focusing my attention and why I chose Twitter to analyze Okay, the second point is about well how this kind of tools can help use can help you to Understand the the information and to to interpret and to generate intelligence and the third point is definition or team for League and I will present some of the Main features and the last part is the most important because I will so I Live demo so I will hope her nothing's Go wrong But this is the idea. Okay Why why? It's important to analyze social networks mainly because Nowadays if we want to know what happens in the world in real time we need to monitor the social networks okay and here quake and Terrorist attack social event all is In the social networks And we can access this information and we can exploit this information This is the most important part to exploit this information. Okay. Why I chose Twitter because Between all the social networks Twitter have a lot of Activity not only because this social network have a lot of uses because also because it's very easy to post a tweet and to it's very fast we need only a few seconds to post a tweet and The second reason is because All the most part of the content in Twitter is public it's public information So we can access The third reason is because the most content in Twitter is text. So we know we know to hope to Exploit the text how to extract the information So it's I would I would never do to analyze Okay, how can help team for it to investigative purposes? Well, regardless of the type of investigation Basically exists three main types or Targets for our analysis the first one is individual for example It's maybe interesting for us to know who is behind and Twitter account or for example What are The relationships with other people or we can predict Where this individual Will be tomorrow at 11 o'clock. Okay. This is important. So the second group is an organization we can investigate an organization for example a company or Terrorist group or community okay, so we can ask something like Who are part of this? organization or for example What are the relationships between the members of this community? Okay, and the third target of analysis is a place a place for a specific location for example We need we can need to to know Which people are in the effort over at this moment or What? Media content are bursting the users at this place. Okay so People you can extract all this kind of information. So this information is useful for several purposes for example for security forces, obviously for intelligence analysts for Journalists for security pentesters for social engineering and so on but not only is useful for professionals is Useful only for us for every vote for everyone because we need to to know what is that the exposure of our information Okay, it's important is it is important for our privacy Okay, so what? What is team for it team for leak is a tool that I have developed a few years ago I am working with this tool and Now I present yesterday I present I released the last version is some specific version for for this camp and It's a tool that I write in in a scouting in Python And it's open source so you can do a lot the code that you can modify and you can improve this tool and you can use for for your For your benefit. So it's a social media social media intelligence tool. So This tool can extract information not only for Twitter also for for different social networks, but mainly for for Twitter and Call it a lot for a large volume of information of tweets for the timeline of a user of in the global timeline and It's able to Interesting information and to format this This information in in a form that we can easily Interpret and and generate intelligence The requirements for to insert this tool are basically a Python osbily and To a P to a P is a is a Python library to access The Twitter API, okay change it to is another library for That I use for for the template for the output HTML and we need Tokens wealth tokens for the dedication with the Twitter app. Okay so You can do a lot from from this tool from my website and as is included in in several distributions like buscador or Kane or black arch, okay and Well as input for for this tool you can have three options you can have A user for example, we can analyze a user Twitter user we can analyze a place and a specific location you can you can enter the coordinates of a place and You can search for for content for takes or for Media content. Okay, so and the rest will is an HTML report But as you can generate output in several formats for sampling in CSV And you can import this data in in other formats and other platforms and you can generate a key mail to For import the data in Google Earth, for example, okay The last version as I can say previously is the dot to that one is the race yesterday and I have developed it for mainly for new features that I will show in the last part of this conference and I think it's a it's a tool that you can use for For several purposes. This this is the output for the hub As you can see is we have a lot of parameters. So it's important to to know Every parameter how we can combine the parameters to exploit with with more powerful The the capacity of the of these two, okay so this is the header of the HTML report for a user for example for the central intelligence agency and we can see some Specific information for this account and we can see the menu or for the different features some of the main features of this tool, okay as You can use the tool in a in a console in a terminal, okay at this moment I Don't have a graphical interface. So you need to to Be able to use that terminal and you can search information about the user For example, where is the home of the user is This tool is able to answer this question or about the place Specifying that the coordinates for for a specific location And about content for example We can filter in the timeline in the global timeline for for a specific cable or we can share for For media content or we can share for the original tweets nor a tweet or and so on, okay Okay about What information we can set about about the user? Well, we can start a lot of data and we need to To analyze this information because intelligence is different from the data, okay The data is the first step and we need to to analyze this information. We need to generate intelligence. So we can set Basic information about this account for example the the Twitter ID the location for this user the status of his shell location or Ho How many times this user is listed in For by other users, okay, or we can identify Which applications are you said are using this user for example? You are using you are using Instagram or Freaker or Facebook or Runkeeper or similar with devices. Are you using for example? an iPad or an iPhone or Mac Android or similar and Which is the use frequency for every application and for every? Device, okay So we can for example in defy if a user is How many users are behind a Twitter account? for example analyzing this kind of information and We can extract hashtags and user mentions and likes we can it's interesting to to know About what is speaking this about about? What cables which cable are using this user or this organization what are the relations and We can filter for for the text for example we can Analyze the worst frequency For example Which are the the worst most used for by this user and which is the frequency? We can know what are the the Visited prices for this user we can for example identify if this user is traveling from from Barcelona to Paris and After to London and we can know how many days are Standing in every place for example in Barcelona is the same for five days after travel to Paris for two days After a week in London, and we need maybe we need to know How is traveling for example if the user is using a flight or a car or Is working for example we can Generate this kind of intelligence, okay, and we can identify the identity in other social networks for example if this user is Registered in in in first square in Facebook or in 20 social network more or less At this time and we can analyze the four ways friends. We can extract all the four ways and all the friends And with all the all the Futures that the two therapy can Can allow for for example we can extract all the four ways for For For a member of an or a terrorist organization We can identify relationships between different organizations or between members of the same organization Okay, and we can extract also all the conversations or For a user for example We can identify All the conversations in in similar to to what's up or a chat and We can identify with With people we are We are speaking Okay This is about the user some of the most important things but also we can extract information about that place for example we can search for In this place we can search for Which hashtags or Or which users are in this place or in in In a specific location and we can Indify the users you can identify all the information all the media content or all the relationships between this Users okay, and also we can search information about the global timeline not foreign specific user not foreign specific location, but We are searching information in the global timeline. Okay Well, so this is the moment for this is the time for for play with team for League I Will so only some of the other functions because the features because Team for League is now is is complex to use Okay, okay, I have connection internet connection. This is the help Okay, a lot of parameters that we can combine to to improve the the power Okay, so for example, you can extract Information about that location For example, we know We make a search for People in the Sarada family in Barcelona my city. Okay. We are searching for the coordinates Okay, and We copy the coordinates so we are searching for this coordinates and one one kilometer for from this Specific location, okay and We can analyze for example only the last 20 tweets posting in this location from the most recent to the To the order. Okay. I am using Maybe Can extract? No, it's correct. Okay. Five kilometers and 100 tweets My I'm sharing my The connection of my mobile device. So it's not a good connection but now we are analyzing The last 100 tweets posting in this location and We can We will show how we can identify different users, okay For example, this is the report okay, and this They are the tweets posting in these coordinates in in a radio of five kilometers. We can identify The date and time and the specific coordinators the media content and the application you said, okay For example, Instagram in this case we can be able to do it and this is the user that post the tweet for some part we can be able to the picture Italy or we can Be able to eat, okay This is Instagram, okay, and we can be able to use a profile or we can request for the coordinators to be in Google Maps displays Okay, it's this tweet is in this location okay, and We can see also not only images also videos for example and see videos interesting Okay, and This is a part also we can identify These users in what in which social networks are Resisted okay, for example, we can locate these users This user for example have This user have an account in Twitter and Instagram and the picture is different Dimension of his profile is different. So at the name can be different. So for example This Cocoa and eventos eco-mobile so I am not searching for for the image or or the username so We can We cannot have False positives Maybe we can have false negatives, but not false positives. Okay We can Intify also the hashtags that this user are using in in several social networks to see About what is speaking this user and also we can identify Not only the people that have the allocation enabled in his device, but also people that As target by another user for example These users are in Instagram the first column are users that are in Instagram and Don't have the geolocation Enable, okay But this user is target by this your other user. Okay in this dating time in this picture in this image for example, we can See the image and We can see the tweet The tweet have a picture in Instagram. We can enter In Instagram we can see The same picture, okay, okay, so it's important to note that our privacy not Depends also on the party, okay Maybe we are aware of for the important the importance of our security of and of our privacy, but maybe our friend is Not have these concerns about the security or privacy, okay So a lot of people only analyzing the last 100 tweets, okay So this is an example and Also, for example, we can Search information about a user for example Please Please DPS 3 Sample please DPS 3 we can search for example information about about his account about the source applications or About hashtags and mentions and Media content that is posting this user in the last for example 100 tweets obviously we can analyze We can more information if we analyze all his timeline all the tweets of a user or large volume or tweets, but for this demo we can use and for this Connection we can use only the last 100 tweets, okay, so now teamfully is searching in the timeline of this user and Is analyzing all the content of these tweets and Are extracting the most important information and are collecting and We will display this information in an HTML report. Okay, so We can also specify the name of the report, but my fault is teamfully HTML Okay, so This is the user this is his profile we can see the picture and This is have a lot of a lot of activity more than then tweets by day Is from Madrid for La Brada is city from from Madrid have the yellow case on enable it's true Okay maybe can and We can search for a sample for for apps Is Twitter is using basically Twitter for Android is an Android user Also is an Instagram user, but basically is posting the tweets for from the Clean the client for for Android, okay We can also See the first use of the device Okay, for example, is Instagram is using in the in this data and this date and we can view the first tweet posting by this device Okay and the last to it for example, we can See the hashtags. This is the hashtags that the user are posting in the last 100 tweets classified by date and time How many Retweets and likes You can see the the tweet This is the user For so this is a retweet because we are searching information by this user You have another call for this row for the role of the of the Twitter or that user that we are analyzing at this at this moment Also, we can see all the hashtags in his timeline Okay, so we can have an idea of With topics are Are speaking to user for example, okay, and so We can In this case, we have a row for every tweet. Okay, so maybe Hashtag is Repeated in different tweets. So here we have Every hashtag they take for every hashtag When is using this hashtag, okay between in this period and how many the tweets likes Counts, okay, for example, the other amistad Champions League and so okay, and also we can see the last or that top The hashtags must use it by this user in his timeline. Okay, so You have this information and the same is similar for the user mentions. Okay We can identify all the user mentions for this user We can see the tweet. We can see the Mention the profile, okay, we can see a repeater or video or To it we can see also have a lot of user mentions We can also Every user mention how many times are Mention this user Okay, between the period of time and The same information that the hashtag, okay, and also we have the Most user mentions. Okay, so maybe or surely these users are friends or Have a relationship with The target of analysis. Okay. Well, also we have Information about the media. Okay, for example, the Images a video that this user are posting in his timeline for example, this picture from Instagram Surveillance or likes, this is the the user that have posted this this content his media content and In the other column We have Okay, this is the The column for the original user that are posting this tweet and this is the user Make a retweet. Okay So We can identify Also platforms or applications mafia or Twitter for iPhone Okay, we can identify Little details in the in a picture. So we can identify the exact location or we can identify some Cable or some picture that that is useful for our investigation. Okay, and We have auto information only with the request About the last 100 tweets, so You can imagine all the information that we can start analyzing All his timeline. Okay, but We can start more information. For example about the same user we can start Information about The last 10 locations the last 10 visitor locations, okay well Sorry, I will start by the fall The tool analyze the last 200 tweets, but for this demo we analyze only for sample 20 tweets Okay, so So Tool is executing the operation is analyzing. Okay Finish it we can access to the report and now we can see the geolocation information Well only Only went to it in the last 20 tweets, but we can instead Sorry, I will Use another user with more information. For example Steve Bosniak with 200 tweets is Very fast we have analyzing 200 to it and is that I'm collecting and analyzing information Okay, this is the account of Profile image of Steve Bosniak Steve Bosniak have Enable his geolocation Okay, so We consult the request Okay We see the The different different tweets with the his coordinators and the application for example this tweet is Posting in this location Okay, so if you analyze Latchable of tweets we you can predict his The next movements for this user for example You can identify Sponsored also media content Okay, but we have more information another section in the in the report we have The route that is used as forward in the in the last days for example Have a lot of activity this user from now This user is in San Jose, but During two two days previously is in Los Gatos San Jose, California Another cities that I can I cannot pronounce and We can see all the we can follow that the trip Of this user, okay, maybe this is interesting for our investigation to follow this user or Or to see which cities are visiting this user Okay, but that's so we have information about The top locations this is important because if you are posting tweets a lot of tweets from the same location every day in In the night for example This location Surely is your home Okay, so you are revealing your your home your workplace your favorite restaurant So on only following few tweets, okay For example, this user is we are analyzing remember we are we are analyzing only 200 tweets so this information can have It's not Satelli or more but this is useful. Okay, we can see that this user is posting information posting tweets All the day all the days are in in a lot of in every moment of the day In every day, this is in red color Is the date that a posting more tweets so to say is very active this user from this location and we can view we can view the The place This is okay This is a park maybe We have a shop or is a Favorite place for this user Okay, this Location is also interesting because a lot of tweets are posting here and This is the home of Steve Bosniak Okay, so Maybe house case So you can predict the The next place is for this user or you can see okay every free day this user is in this restaurant so you can You can go to the restaurant pretty at this time and maybe you can You can find this user. Okay. Well, we can set more information for for example About New agencies for example CNN We can set for example the last or the 25 Wars must use it by this Agency in the last 300 tweets for example Okay, this is interesting because we can We can use we can compare this information for example and United States agency and Russian agency, okay, and we can compare about the topics Okay, for example CNN Location enable, okay This is the word frequency This tool also drop empty words in in English and Spanish for example Particles or or prepositions are drop it. So I I try to Set it only the important important words. Okay, for example CNN is speaking about Trump a Lot is the most Used word, but also president Plans military China China will Venezuela, okay, Korea Well now I will compare with That's I think is that's your refuge That's is an I don't remember the Sorry one moment this Agency news That's agency. Okay, it's an Russian Russian agency news with the words in in English Okay, so We are searching for the last 300 tweets Okay, and this is the report That's what frequency Well, this is not speaking about about Donald Trump is speaking Russian Russia sanctions Kremlin Army anti-Russian Putin, okay, okay, we can this is only one example, but we can analyze The most important is to analyze large volume of of data, okay We can search also information about Well, not about the place we can make an example about We can search in the global timeline not for a specific user not for a specific place we can search for example Tweets in the global timeline that contains This hashtag Also Media content Okay in the last 300 tweets Maybe you are posting about T7 or this conference Okay, we are analyzing in the global timeline 200 tweets at this moment. I hope you have a better connection Okay, so in the last 300 tweets we found 97 sorry 97 tweets with this criteria, okay so Okay, this is the tweets we are searching for tweets with the this hashtag and With many media content. Okay the date and time so we can search Media content So it's another form of identify users that are in an allocation and don't have the location enabled. Okay For example different users For example, we can we can identify the most used application in this camp for example if we are Android users or Apple users for example Okay, they are retweets. Okay. This is red wheat but we can filter also by by the original tweets or retweets for example Not tweets about this conference. That is not good Okay Or maybe it's good. It depends of the point of view and Okay, this is an example we can see that to it and for example we can Search nor retweets media The last 100 225 the original original tweets The original users that posted These tweets. Okay. Now we don't have retweets only original tweets so it's also important to We have media content Okay, this is an example of the kind of things that We can identify If you are interested in more details about this tool in two hours more or less. I I will teach in our shop About how to use this tool for With all the parameters and combination Okay, and real case So that is all. Thank you for your time. Okay, and you have any questions Thanks So there is Another five minutes for question and answer. Does anybody have a question for Vicente? Hi. Can you hear me? Yeah, you showed in one of the HTML reports. You had like red Twitters and blue twitters. What's the difference? Yes, the difference is that The red color indicates that this day the user is posting the most of the tweets for example, okay, you can post 20 tweets in a week, but The Friday you post the most of the tweets 12 tweets this day. So it's Marketing in red color that the blue color is that this day Are posting tweets and you don't have Colors these days without tweets Next you have only shown output into HTML files is there also an option to output the data into a database or a graph database? At this moment The information is not a story in a database But in our future in a near future, yes Because it's important to to restore this information and to correlate this information with previous experiences Okay, so it's our another question Nobody what the give a warm applause for for Vicente Thank you very much