Browser Extensions for OSINT Investigation

Browser Add-ons can be of great help to OSINT investigators in simplifying and automating tasks. We’ve collated a list of some of the browser add-ons that the Skopenow’s team uses most frequently during internet investigations. 

Some of these browser extensions are security and privacy focussed and some are tools to aid in the collection of data and information. Investigators should always consider the possibility that data is being shared with the extension designer and should risk assess this.

Capturing Data and Links 

Investigators often need to capture data from a webpage in bulk. Copy and Paste will work for paragraphs of text, but when seeking to extract all of a page's content or just the links on a webpage, browser extensions can simplify the process.

Instant Data Scraper

Instant Data Scraper is a browser extension that extracts data from web pages and exports it as Excel or CSV files. This tool will extract almost all content on any webpage and automatically create tables or structure the data. Instant Data Scraper can only be installed on Chrome.

Link Klipper

Link Klipper is a chrome extension that enables investigators to extract all the links on a webpage and export them to a file. Link Klipper can only be installed on Chrome.

Link Gopher

Link Gopher is a chrome extension that extracts all links from web pages, sorts them, removes duplicates, and displays them in a new tab for Investigators to copy and paste into other systems. Link Gopher can be installed on both Chrome and Firefox.

Capturing Full Web Pages 

Investigators also need to capture web pages on the day data was captured, to evidence the contents. Investigators can capture web pages as images, PDFs, or HTML files, or ideally all. Capturing contents ensures intelligence can be presented in court and captures any information which may be deleted at a later date.

GoFullPage

GoFullPage is a Chrome extension that captures full screenshots in formats such as PNG and PDF. Capturing the page as an image or PDF shows the evidence exactly how it was seen, whilst HTML downloads may change slightly in appearance depending upon which browser they are opened within.

SingleFile

SingleFile is an extension that helps you to save a complete page (with CSS, images, fonts, frames, etc.) as a single HTML file. An HTML file, also known as a Hypertext Markup Language file is the standard web page file type on the internet, which captures all of the source code on the page as it was written, as well as all of the embedded files, such as videos. This is valuable when presenting files in court as it shows the webpage in its intended form at the exact time that it was captured. An extension exists for both Chrome and Firefox browsers.

Nimbus

Nimbus is a Chrome tool to capture partial or entire web page screenshots.

Quick Web Caches

Wayback Machine

The Wayback Machine is an extension that provides investigators with the ability to easily and quickly check if a web page has previously been archived within the Internet Archive. If a web page has been archived multiple times, investigators can switch between different versions. An extension exists for both Chrome and Firefox browsers.

Ad and Script Blocking

uBlock Origin

uBlock Origin is an extension that blocks undesired scripts from running. uBlock Origin works instantly from installation but some changes can be made to make minor improvements. To do this, click on the settings and select “I’m an advanced user”. Select the 3rd party filter tab and select all options within ads, privacy, malware domains, and annoyances. This will prevent most ads on pages with a large number and will speed up the loading of a webpage. Click Update now to refresh the addon and apply the settings. An extension exists for both Chrome and Firefox browsers.

Secure Connection

HTTPS Everywhere

HTTPS Everywhere is a Firefox and Chrome extension that encrypts web traffic with websites accessed to make browsing more secure. The HTTPS Everywhere automatically rewrites requests for thousands of sites from insecure "HTTP" to secure "HTTPS".

Media Download 

Investigators often need to download media that is found during their investigations to capture evidence.

Video Download Helper

Video Download Helper is a Chrome and Firefox extension that enables investigators to directly download videos from many sites to their devices. As videos that are downloadable play, the extension button will turn from grayed out to color to highlight that there are videos on the page that can be downloaded. 

CocoCut

CocoCut is a Chrome and Firefox extension that converts an M3u8 file to an MP4 file, which you can then download. This is useful for some sites which do not enable users to download mp4 files, such as Gettr. To download the video as an MP4 file, simply click on the extension, which will show a list of downloadable videos in the drop-down. 

Digital Marketplace Investigation

AMZScout Stock Stats

AMZScout Stock Stats is a Chrome extension that will show how many units a seller has in stock for a particular item. When investigating counterfeit or stolen goods, this can be powerful information to have at your fingertips. If 15 copies of an item were stolen in a town in Montana and a seller in Montana is identified with 15 of those same items for sale, that’s a strong lead to investigate.

DS Amazon Quick View 

DS Amazon Quick View is a Chrome and Firefox browser extension that will show sales rank and the number of sellers on Amazon while browsing. Knowing how well an item is selling and if there is more than one seller can be valuable as it will quickly identify alternate sellers that may be selling counterfeits, stolen goods, or “squatting” under other listings.

The Camelizer

The Camelizer is a Chrome and Firefox browser extension that provides price history charts for items sold on Amazon. The Camelizer can provide insights to investigators monitoring price levels of goods, either to correlate high theft levels to time with high price levels or when third party prices were below market level.

Reverse Image Searching

Images can provide a wealth of value to an OSINT investigation, they can show what a subject looks like, locations where the subject has been, and any vehicles used. Investigators frequently need to locate the same image or a similar image from a different one they have discovered during an investigation.

Using Search Engines, you can quickly discover visually similar photos from around the web using Reverse Image Searching technology, utilizing content-based image retrieval (CBIR) query techniques. Uploading a photograph from your device or inputting the URL of an image, you can ask a search engine to locate and show you related images used on other websites, either those images that are exactly the same or the same but a different size, or those that contain similar looking items or people. 

Reverse Image Searching can be used as part of an investigation to identify related images relating to images that contain statues, buildings, places, people, and logos. Using Search Engines, you may be able to identify where an image was taken by recognizing a statue or building in the background that can be identified by the Search Engine. Similarly, Search Engines may be able to locate other images of your subject or logos on sites that identify them.

RevEye

RevEye is a Chrome and Firefox extension for reverse image searching. Investigators can perform a reverse image search by right-clicking on any image on a web page and selecting to search either all sites or select from Google, Bing, Yandex, and TinEye.

Geolocation Investigation

MapSwitcher

MapSwitcher is a Chrome and Firefox extension that enables investigators to quickly switch between different map services when investigating a location. Using MapSwitcher, investigators can convert coordinates and directions and jump to the exact location on another map.

Media Verification

InVID WeVerify

The InVID Verification Plugin is a Chrome and Firefox extension that provides similar data to the Metadata extraction tools. The InVID plugin is built specifically to assist journalists in verifying content on social networks and identifying misinformation.

The plugin enables investigators and journalists to get contextual information from Facebook and YouTube videos, perform reverse image searches on search engines, and fragment videos into keyframes.

Once installed, click on the tool extension and a drop-down box will appear. Click ‘OPEN TOOLBOX’ to open the InVID verification plugin.

The Toolbox will open within a new browser window. The InVID Verification Plugin has 4 tabs, Video, Image, Search, and Data Analysis. Video, the first tab, is the one necessary for analyzing YouTube videos.

Within the Video tab, there are 5 tools; video analysis, keyframe, thumbnails, metadata, and video rights.

The Video analysis tool enables users to view key metadata and thumbnails. To use this tool, click on the Video analysis button.

Once the Video analysis tool opens, you can enter a YouTube video URL into the data entry field under ‘Source of the video’. Following this, click the Submit button.

The Video analysis tool will then analyze the input YouTube video, which may take a few minutes. The results of the analysis will populate further down the page.

Below the metadata, you can find thumbnails from the video. These thumbnails can be reverse image searched on search engines by clicking one of the search engine buttons below the images.

Automating OSINT

Using a tool like Skopenow, you can automate OSINT investigations and negate anonymity and security concerns associated with collecting internet intelligence. Skopenow instantly and anonymously locates and archives web pages and social media activity, plots location history, flags actionable behaviors, and reveals hidden connections between individuals. Skopenow’s automatic report builder will save you time organizing the analyzed intelligence into a court-ready report. Please reach out to sales@skopenow.com or visit www.skopenow.com/demo to schedule a demo and activate a 7-day free trial for qualified businesses.