Should-I-Trust : OSINT Tool To Evaluate Trustworthiness Of A Company

Should-I-Trust is a tool to evaluate OSINT signals for a domain. You’re part of a review board that’s responsible for evaluating new vendors. You’re specifically responsible for ensuring new vendors meet compliance and security requirements.

Standard operation procedure is to ask for one or all of the following: SOC report, VSAQ, CAIQ, SIG/SIG-Lite. All vendors will not have these reports and/or questionnaire answers. Maybe it’s org process to deny vendor intake without this information, or maybe, this is a “special” engagement and you need to ascertain trustworthyness without the docs. Maybe you don’t trust the response in the docs.

should-i-trust is a tool to go beyond standard responses and look for signals that the organization should not be trusted. Maybe they’re exposing their CI/CD to the internet with no auth. Maybe they have an EC2 instance with prod code running and no directory restrictions.

should-i-trust doesn’t provide all the information you will need to make a go/no-go decision but it will allow you to quickly gather OSINT data for further evaluation.

should-i-trust is also useful for red team or similar engagements. It can quickly identify targets to probe.

Requirements

  • Should-i-trust requires API keys from the following sources:

Also Read – Vulnx : Auto Shell Injector That Detect Vulnerabilities In Multiple Types Of CMS

Setup

Either install the chrome extension through chrome or download and manually install in chrome using developer mode.

Running

  • Open the extension
  • Enter your API keys (required once)
  • Enter a domain to query

Output

  • If there’s an indicator the domain participates in a bug bounty program
  • Domains found through VirusTotal, Censys.io, and the Google Cert Transparency Report
  • IPs and open ports found through Censys.io
  • Repositories found on GitHub, GitLab, and Bitbucket
  • Misc data found on virustotal.com
  • AWS bucket files found exposed through GrayHatWarfare
R K

Recent Posts

Useful Bug Bounty And Security Related Write-ups : A Comprehensive Guide For Enthusiasts

This repo contains all variants of information security & Bug bounty & Penetration Testing write-up…

4 hours ago

Admin-Panel-Dorks : Mastering Google Dorks To Uncover Hidden Admin Panels

site:*/sign-in site:*/account/login site:*/forum/ucp.php?mode=login inurl:memberlist.php?mode=viewprofile intitle:"EdgeOS" intext:"Please login" inurl:user_login.php intitle:"Web Management Login" site:*/users/login_form site:*/access/unauthenticated site:account.*.*/login site:admin.*.com/signin/…

4 hours ago

Conduwuit : Pioneering A New Era In Matrix Homeservers

Matrix is an open network for secure and decentralized communication. Users from every Matrix homeserver…

4 hours ago

LSMS – Linux Security And Monitoring Scripts

Linux Security And Monitoring Scripts are a collection of security and monitoring scripts you can…

4 hours ago

Fiber – Using Fibers To Run In-Memory Code

A fiber is a unit of execution that must be manually scheduled by the application…

4 hours ago

XSS-Exploitation-Tool : A Penetration Testing Tool

XSS Exploitation Tool is a penetration testing tool that focuses on the exploit of Cross-Site…

4 hours ago