Ryan Benson @_RyanBenson

I do digital forensics and work on open source DFIR tools @Google. I kinda like web browsers, too. Not on Twitter often anymore, reach me at ryan 'at' https://t.co/Zcq6BJG4xC dfir.blog SF Bay Area Joined April 2009

Tweets

1K
Followers

4K
Following

264
Likes

845

not puppycat @not_puppycat

4 years ago

@GergelyOrosz FYI that link in the screenshot is acquired by the user tapping "Copy Link" button from the Twitter app on iPhone. That's what the parameter "s=46" means. It's safe to also drop that from the final URL. Here's where I got the s-parameter table to look up: dfir.blog/unfurl-parsing…

0 2 8 0 11

View Details

Ryan Benson @_RyanBenson

4 years ago

@KevinPagano3 thanks, I'll take a look and get them added

0 0 0 0 0

View Details

Ryan Benson @_RyanBenson

4 years ago

There's a new Unfurl release! v2022.11 adds: 🔹Parsing #Twitter "s" values - all 71 of them! 🔹Timestamps from #Mastodon IDs 🔹Decoding #LinkedIn identifiers 🔹Expanding #Substack redirect links 🔹Parsing common tracking parameters Blog: dfir.blog/unfurl-parsing… #DFIR #OSINT

1 11 21 0 4

View Details

Ryan Benson @_RyanBenson

4 years ago

With all the uncertainty @twitter, I've seen more people talking about alternatives like #Mastodon. Like tweets, Mastodon IDs have embedded timestamps in them, and Unfurl can parse them: 🔗dfir.blog/unfurl/?url=ht… #DFIR #OSINT

1 15 47 0 8

View Details

Ryan Benson @_RyanBenson

4 years ago

@phillmoore @inversecos It doesn't. These files are in the SNSS format, which involves some serialization. AFAIK, there aren't any working open source parsers (github.com/cclgroupltd/cc… & github.com/JRBANCEL/Chrom… worked at least partially in the past) and I haven't taken a pass at parsing it myself yet.

1 0 2 0 0

View Details

Alexandre Dulaunoy @[email protected] @adulau

4 years ago

We are reviewing our @MISPProject warning lists and we are looking for a maintained list of hosts which are domain parking. Do you know someone doing such thing? or should we start to build one from scratch? #threatintelligence

3 6 20 0 2

View Details

Chris Sanders 🔎 🧠 @chrissanders88

4 years ago

A key mindset to grasp as you transition from junior analyst to a more experienced level is that you won't have all the answers, but you can ask the right questions and know where to start looking for the answers.

1 15 58 0 5

View Details

Ryan Benson @_RyanBenson

4 years ago

@WebBreacher Double-click any node and it copies the text to clipboard. I need to make that feature more visible, sorry.

1 0 1 0 0

View Details

Ryan Benson @_RyanBenson

4 years ago

@ollie_boyd_ Awesome! Will do for sure.

0 0 0 0 0

View Details

Ryan Benson @_RyanBenson

4 years ago

Nice little tidbit here about decoding #LinkedIn profile ids from URLs, then using their sequential nature to estimate profile creation time. I see an @unfurl_link update in the future! #DFIR #OSINT

Jack Crook @jackcr

4 years ago

All of the profiles listed in the article and this thread were created within days of each other. jennie-biller-9b631120a victor-sites-40139b20a charolette-pare-93b3a220a vivian-christy-b1246320a maryann-robles-2924b620a 1/4

1 1 3 0 2

0 1 8 0 2

View Details

Ryan Benson @_RyanBenson

4 years ago

Apparently TikTok uses the same ID scheme for job postings as it does for videos? Random, but kind of interesting.🤷‍♂️ Example: dfir.blog/unfurl/?url=ht… More info on TikTok timestamps: dfir.blog/tinkering-with… #DFIR #TikTok #OSINT

0 2 6 0 1

View Details

Ryan Benson @_RyanBenson

4 years ago

@WebBreacher Ha, thanks 😉. I updated the logo at least for dark mode, other components will take more time.

0 1 1 0 0

View Details

Micah @WebBreacher

4 years ago

Have a long URL to decode? Use dfir.blog/unfurl/. It decodes parameters & values in the URL. Ex: I used Amazon & ran a search, copied URL, pasted into Unfurl. It broke the URL down & revealed "qid" param (2) is a time stamp and a date (3). #osint #cyber #tools

2 25 59 0 29

View Details

Ryan Benson @_RyanBenson

4 years ago

@WebBreacher Thanks! Glad you like it. And after seeing your screenshot, I'll make the logo look better in dark mode ;)

1 0 1 0 0

View Details

Ryan Benson @_RyanBenson

4 years ago

If you want a refresher on the benefits of allowlisting vs denylisting, just ask a 5 year old to stop doing something.

1 0 2 0 0

View Details

Ryan Benson @_RyanBenson

4 years ago

Very cool! #DFIR #Python

Droogy @0xDroogy

4 years ago

forked @_RyanBenson's awesome unfurl tool and patched the library so it can easily be used in a Jupyter Notebook :) #python github.com/Droogy/unfurl_…

0 0 5 0 0

0 0 4 0 0

View Details

Ryan Benson @_RyanBenson

4 years ago

@WHInspector If you're interested in browser forensics, check out hindsig.ht

2 7 25 0 9

View Details

Ryan Benson @_RyanBenson

4 years ago

Hey, thanks! Your #DailyOSINT looks really interesting too!

White Hat Inspector @WHInspector

4 years ago

Of course I didn't know that when I started but, this guy @_RyanBenson has been doing a #DailyDFIR before I have even thought about it! If u re interested in #DFIR, definitely check out his hashtag! (7/8)