Open-Source Intelligence (OSINT): Unmasking YouTube with OSINT Tools!

Welcome back, aspiring cyberwarriors!

In our digital investigations, we often need to extract valuable intelligence from video content. This might include identifying locations, uncovering connections between individuals, finding deleted content, or simply gathering information that someone has inadvertently shared on camera. It is critical that we know how to effectively search through the massive repository of video data that YouTube has accumulated over the years.

To keep our OSINT operations effective, we need to understand how YouTube’s search system works and leverage specialized search techniques. Although both Google and YouTube offer basic search functionality, both platforms have complex algorithms that can either help or hinder our investigations depending on how we craft our queries.

Let’s dive into how we can master YouTube for OSINT purposes!

Step #1 Understanding How YouTube Indexes Content

You can think of YouTube’s indexing system as similar to a library catalog. When someone uploads a video, YouTube analyzes various elements to determine what the video contains and how it should be categorized.

The primary elements that YouTube indexes include:

Video Title: This is one of the most important parameters. YouTube determines the main topic of a video based on keywords in the title. What’s interesting is that YouTube doesn’t evaluate the semantic structure of titles – it doesn’t index prepositions or consider grammatical cases.

Video Description: This is the second most important parameter. YouTube assumes that the author briefly summarizes the video’s content in the description and analyzes it for keywords and phrases.

Video Tags: While there’s debate about how important tags are for video promotion, they are designed specifically as a list of keywords reflecting the video’s topic. Because the author can manipulate these, tags have less weight than titles and descriptions – except when tag keywords match with other metadata.

Subtitles: If the video creator doesn’t upload subtitles, YouTube generates them automatically. Either way, YouTube indexes these subtitles and uses them to identify key topics in the video, even if they’re not mentioned in the title or description.

Channel Name: The name of the channel that uploaded the video is indexed along with the video itself. This is why you can include a channel name in your search query to narrow results.

Viewer Activity: This includes views, likes, comments, shares, and watch duration. Videos with high engagement are considered more relevant by YouTube and will rank higher in search results. Comment text is also indexed, though this likely has minimal impact on search rankings.

Step #2 Mastering YouTube Search Operators

Once you understand how YouTube indexes content, you can begin using search operators to craft more precise queries. These operators function similarly to Google’s search operators but with some important differences.

Here are the most useful search operators for OSINT investigations:

Quotation Marks (“”): Use these for exact match searches. For example, searching for “Linux for Hackers with OTW” will only return videos containing that exact phrase. While YouTube may occasionally show results with slight variations, this is still the best way to search for specific phrases.

Plus (+) and Minus (-): The plus sign indicates that a term must appear in results, while the minus sign excludes terms. For example, “Linux”+”Hackers”-“Windows” will show Linux videos that mention Hackers but not Windows.

Vertical Bar (|): This is the logical OR operator. For example, “Hackers-Arise SQL | MOVEit” will find videos about Hackers-Arise related to either SQL or MOVEit or both.

A sterisk (*): Functions as a wildcard, representing any word. For example, “how to * data” could match “how to extract data,” “how to encrypt data,” etc.

Dollar Sign ($) and Two Dots (..): The dollar sign helps find videos mentioning prices, while two dots can be used for number ranges. For example, “laptop $500..1000” would find videos about laptops in that price range.

intitle: and allintitle:: These operators search only in video titles. “intitle:Mr Robot” will find videos with “Mr Robot” in the title, while “allintitle:Mr Robot OTW” requires both words to be in the title.

description:: Searches only in video descriptions. This is useful for finding videos that mention specific terms in their descriptions but not necessarily in their titles.

before: and after:: These operators filter results by upload date. The format is YYYY-MM-DD. For example, “OSINT after:2021-01-01 before:2021-12-31” will find OSINT videos uploaded during 2021.

Remember that YouTube also has built-in filters that can help narrow your search results. These filters allow you to sort by upload date, type (video, channel, playlist), duration, and features like closed captions or 4K quality.

Step #3 Using Google to Search YouTube

Sometimes YouTube’s algorithm might downrank or hide certain videos that could be valuable for your investigation. In these cases, searching through Google can yield better results.

To search YouTube through Google, use the site: operator combined with other search terms:

site:youtube.com "Hack like Mr Robot" inurl:watch

The inurl:watch parameter ensures you’re finding actual videos rather than channels or playlists.

To learn more about Google hacking and dorks check out the following article.

Step #4 Leveraging Specialized OSINT Tools for YouTube

Beyond basic search techniques, several specialized tools can enhance your YouTube OSINT capabilities:

YouTube Metadata Viewer: https://mattw.io/youtube-metadata

This tool provides detailed metadata about specific videos and channels. Simply paste a video URL, and you’ll see its publication date and time, description, tags, category, language, and identifier. You’ll also see statistics on views, likes, and comments, plus specific characteristics like ad content, recording quality, and geotags. You can download thumbnails and search for the video in web archives or Google by its identifiers.

Deleted Video Finder: https://findyoutubevideo.thetechrobo.ca

This resource helps find deleted videos. Enter the URL of a deleted video, and it will try to find the video itself or information about it on other resources. While finding the actual video isn’t always possible, it often succeeds in finding metadata and subtitles.

YouTube GeoFind: https://mattw.io/youtube-geofind/location

This tool allows you to search for videos by location. Specify a point on the map and a search radius, add filters if needed, and it will show all videos with geotags from that area, both on the map and as a list.

Summary

In many cases, cyberwarriors must be able to effectively extract intelligence from video platforms. YouTube, with its massive repository of user-generated content, contains invaluable information that can be crucial for investigations, reconnaissance, or intelligence gathering operations. The basic search functionality is insufficient for serious OSINT work, but by understanding how YouTube indexes content and using advanced search operators and specialized tools, we can uncover information that remains hidden to casual users.

To improve your OSINT skills, check out our OSINT Investigator Bundle. You’ll explore both fundamental and advanced techniques and receive an OSINT Certified Investigator Voucher.