The Basics
First off, What is Doxing? Doxing is the act of finding all possible information on a specific person. For example, a dox would include a Name, Phone Number, Address, Social Media's, Old addresses and Old phone numbers, House information, Criminal records, Bankruptcies, Traffic Violations, Banks Accounts, Credit Cards, Social Security Numbers, Relatives information etc...
Most of the stuff listed above makes that a complex dox. But for this tutorial, we will mainly just be sticking to Name, Address, and simple stuff etc..
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
Is Doxing Illegal?
The act of finding one's information is NOT illegal. However... posting that dox publicly or using it for malicious reasons IS illegal. Doxing someone is not illegal if you dont post it publicly for an audience or use it for something like pizza bombing or swatting.
=====================================================================================================================================================================
Getting to Doxing
Now depending upon what information you have on your target, is where you should start.
Email
If you have their email, use an email tool like "Drizzy's" tool and use the email option to look at possible accounts registered with that email. You dont need to use "Drizzy's" tool as some people call it "Skiddy" lol, but any tool can be fine or even simply pasting the email into the google search bar can work. You can find any accounts they have linked to that email. Here is a link to the drizzy tool if anyone wants to use it. Link to email dox tool http://drizzybot.com/ - Email doxing is one of the easiest ways to find inforamtion on a target as most times people use their real email address for things.
=====================================================================================================================================================================
Names
If you have their name, you can search for them on facebook, instagram, and twitter and look for any accounts they may own. The key to doxing to is using their parents names against them. Online people searches is the public way of doxing as you will not find any information whatsoever of a minor on a people search. So using their parents to find their address is what most people do to dox. So for example, if i was doxing "Sarah Smith" and i saw she was following a guy named "John Smtih", i would want to check this guy out. ill click on his page and see he uploaded a picture or has pictures with sarah and i can see that he is her father. Sometimes you have to be careful though. Its 2017 and most kids have parents with different last names because of step parents and it makes doxing a little harder.
Now your target isnt always going to have their name on their account or follow their parents or siblings on social media. You will have to do some other investigating on your targets account. You can try looking at their posts and seeing if they tagged any friends in any pictures and using their friends to find your victim. You can also click the "tagged in" button on the users account to see what pictures they have been tagged in to see if your target was tagged in any pictures from friends. if you have a general first name of your target, you can look up one of their friends on facebook and go to friends and type in your targets first name and find them like that.
One method you can do that is quite risky can be that if you know the name of the target but you cannot find any facebook for them, is you can search the last name of your target into the people search and look up the users on facebook and see if they post any pictures with your target and try to find any relatives. this could be a last resort as this would be very time consuming and most times we dont want to be sitting her doxing someone for a while. You can also try to call the phone numbers of the results in the people search using a burner phone number and asking if "targets name" can speak right now and see how they respond. Its best to make a fake story that sounds believable so the person would actually pass the phone. Like saying how you and your target have a school project due and would like to speak to them.
If you found their name, scroll down to the "People Search" part to learn what to do with the name.
=====================================================================================================================================================================
Reverse Image
If you have a picture of the target and thats all, you can use a "Image Revere Searcher" on google to see if the picture appears anywhere on the internet. Note that you will need the exact size of the uploaded picture. If you are successful with the reverse image search, you will be able to see if that picture was uploaded on any facebook accounts, twitters, instagram accounts etc.. and find your target like that. A couple of website you can use for this include:
=====================================================================================================================================================================
People Search
Once you find their parents name, head over to a people search. Some people searches are better than others so its best to use a couple of them. www.zabasearch.com www.advancedbackgroundchecks.com and www.whitepages.com are some of the best people searches to use. You need to also make sure that when you use these people searches, you need to be sure you have the exact city and state because there are hundreds of other people with your targets name out there so you need to make sure you have the right information on your target.
=====================================================================================================================================================================
Isp Doxing
THIS IS A VERY BASIC TUTORIAL. THIS WONT COVER EVERY SINGLE ABOUT ISP DOXING
One of the hardest ways to dox someone is ISP Doxing. ISP Doxing is the finding the ISP (Internet Service Provider) of your target. You can achieve this by finding their online IP. There are many ways to do this, but some require social engineering. a couple ways i could i get someones IP is through skype. Skype is a big platform that has many IP flaws allowing people to grab your IP. Such as a skype resolver. Most of them were patched awhile ago but someone still work. www.skypegrab.net is probably the best working one. You enter your targets username and you can see their current or old database IP's. Another way is through a Skype Deob. a skype deob is an older version of skype that allows you to see the IP used to login to skype for any user CURRENTLY ONLINE. If you are trying to deob a single target, you need to make sure they are online first before you deob them as it wont work if they are offline. Another way you can find IP's is by using a "grabify.link" IP logger and social engineering your target to click the link. Once they click the link, you will be able to see the IP they clicked the link on and the device they used to click. Once you have the IP you can begin your ISP dox. Just know that this will NOT ALWAYS work because over years employees have gotten better at catching people doing this.
You are probably going to want to use a VPN and download a free burner number app on the iPhone like freetone IF YOU DECIDE TO USE YOUR PHONE. On the computer, there are many online website you can use to make phone calls. Make sure to use a VPN when making the call. Also, here is a small list of major ISP's:
-Comcast
-Verizon Fios
-SkyBroadBAnd
-AT&t U-verse
-Spectrum
-Charter Communications
-Frontier Communications
Now ISP doxing will take a little practice and social engieering may take a litle bit to achieve but its possible. What you want to do is call the ISP's phone number. Remember to make the call anonymous and never use your real phone number. When you call them, you want to make up a story that sounds believable as to why you need the information of a certain IP. A good way is to pretend your a worker for that ISP and that your systems crashed and you need help finding the information of a certain customer. Another way you can ISP Dox is by pretending to be an officer for a police department and requesting you need the information of a certain IP because he/she was committing illegal acts online. Make it sound convicning and you will most likely get that information.
Note* Doxing itself is not illegal if you are doing people searches.. but ISP doxing is highly illegal so be careful if you attempt this.
====================================================================================================================================================================
Staying Safe
Staying safe online may seem like its easy, but once you get indo the doxing world, you will understand how easy it really is to find someones information. But dont worry, i will teach you guys some things you can do to make sure nobody can find out who you are. a good way to see how "doxable" you are to use everything i just told you above and try it on yourself. Doing that can help you with any real information you are exposing about yourself online.
====================================================================================================================================================================
Vpn
a VPN is a "Virtual Private Network". It masks your real IP with a different IP so nobody can know your real location. VPN's are also good for unblocking websites that are blocked on your network. If you are also finding yourself getting DDoSed a lot online, you can use a VPN with ddos protection so that you wont keep getting hit offline. You can also use a VPS (Virtual Private Server) as a way of staying anonymous from other users online. If they do pull your IP, they will be pulling the server IP, not your real IP. There are many free VPN services out there but its always best to stick to a VPN that has no logs, and has no DNS leaks. A good cheap VPN to use that has no logs is PIA (Private Internet Acess). PIA was taken to court by the FBI because of a user on their VPN service and court records showed that PIA didnt keep any logs and no leaks in their service and the suspected hoaxer was never caught.
Here are some links to some free VPN services:
https://www.cyberghostvpn.com
https://www.softether.org/
Here are some amazing VPN's that dont log (PAID)
https://www.privateinternetaccess.com/ (i recommend this one)
https://www.ipvanish.com
After you setup and download the VPN, go to your task manager and turn off EVERY SINGLE START UP PROGRAM. When you boot up your computer, you dont want anything to boot up. After you reboot your computer, the first thing you want to do is turn your VPN on and then you can start accessing your programs and going on the internet. You are going to want to do this everytime you boot your computer up.
For anyone wondering about the VPS's here are the best to use. You may have even heard of these:
-NFO - https://www.nfoservers.com/
-OVH - https://www.ovh.com/us/
====================================================================================================================================================================
Social Media
Social Media is the most crucial step in staying safe online. Most people like to put their name and location on their profile and thats not a bad thing unless you are in the community we are in because that is how you are going to be doxed. You also want to make sure that if you're friends tag you in any pictures, you want to untag yourself from those pictures. You also want to make sure that if you are going to be in the online community, have seperate accounts. And dont follow anyone from the online community on your personal account. These are all crucial steps to keeping you account and information safe.
Most social media platforms have a type of security called "Two Step". Two Step Verification allows you to have a code sent to the phone number linked onto the accout everytime someone tries to log into your account with the correct password. This method can prevent people from getting into your accounts. It can prevent a major process of the bruteforce or dictionary attack of someone trying to hack your account.
====================================================================================================================================================================
Email
Now when you your gonna use an email for an account that will be seen by other people in an online gaming community or such, its always best to use a fake email and to always link fake info to that email address. For example, say my name is john but i want to make a new account for xbox. Ill make the name of the fake email "Ryan" or "Jack" and that will give the person attemtping to dox a fake name to go off and possible get all fake information about you. Which can make the user doxing you look like a complete dumbass. And the rest is pretty simple, just create a fake address, phone, state, city, etc... You can also use something called "10 Minute Mail" which is an email address you can get for 10 minutes and then it will be deleted and trashed. Its very good to use for verify email address to social media accounts online as the email addresses are already made for you. You can just type in "10 Minute Mail" into google and find a bunch of different 10 minute mail services. Ill link some - https://10minutemail.com - https://10minutemail.net/
You also want to make sure that if you are gonna create a fake email on gmail, yahoo, hotmail, outlook, whatever you pick, you want to create the email while on a VPN as people can pull the IP that the email was created on. If you are ever gonna send an message on that email, use a VPN when you send it as people can take the header of the email and find the IP that sent the email.
====================================================================================================================================================================
Ip Logger
So some ways that people online will try to obtain your IP address is by something called an "IP Logger" and its exactly what it sounds like. An IP logger is a link that someone can send to you and the moment you click it, your IP is logged and they can view it. And with it, they can DDoS you or even ISP Dox you. This is why the VPN is always handy to have. But clicking on random links that people send to you is never good. People can modify the way the link looks so that it may look like a normal link but its nothing more than a fake link logging your IP. Most of the time, people will URL shorten the link so that you wont think its an IP logger. Most commonly people use "*do not use url shorteners*" to do this. a shortened url will look something like this "*do not use url shorteners*/2H82r" or something like that with different numbers. The point of this section was to always be careful when clicking links from people online.
====================================================================================================================================================================
Rats
No, im not talking about the gross disgusting creatures that eat trash and live in the sewer. Im talking about a computer RAT (Remote Administrasive tool). Somebody who RAT's your computer can get access to everything on the computer, can make you lose control of your own computer, can turn your webcam on and off, can speak to you, can basically do whatever they want with your computer. They can also look at all the usernames and password that have been used on the computer. Now you are probably wondering how someone can RAT you're computer. Two ways people can RAT you. People can use send you a downloadable program usually with (.exe) at the end of it. Once you open the program and run it, you just gave the attacker access to your computer. Now how to prevent this? Its more about just being smart about what you download and only downloading verified things online. You can also uplaod the download to a scanning website or program and it will detect any viruses in it before it does harm to your computer.
Now the second way attackers can RAT you is by a cookie RAT. which is basically the same thing as the IP logger except they can use a link to RAT your computer as well. Now to prevent this, the same thing as the IP logger. Only click on trusted links or you can even upload the link to a URL scan and it will tell you if its safe to proceed to that website.
