Navigation



unmask.py – Statistical E-mail & Blog Profiling

Last updated: September 9, 2015 | 4,860 views

This is a cool tool I found recently amongst all the flame wars in the security mailing lists, someone developed this tool to profile the semantics of text.

Basically you pump in a load of e-mails from a known source, then compare it to the anonymous socks and see what probability it is that they are the same person based on the text. You can do the same thing with blogs, not just e-mail!

This is version 1.0 of Unmask – a python script that attempts to unmask anonymous text by matching its statistical properties against someone else’s text with a known identity.

Other uses include determining “area of origin”,gender,age, occupation, sexual orientation, etc from text’s statistical properties. Any decision YOU can make against an unknown author, Unmask will also make. Of course, it may be less or more accurate than your determination.

You should probably fiddle with it as you go, to make it work on whatever sample set you have, before using it in the wild.

To use it, simple “store” text (with -s bob -f file.txt). Then just compare your unknown file to that particular store, or use -i to compare it to all stores. Make up a store of all male and all female text and then compare some random weblog, just for kicks.

You can download unmask here:

unmask1.0.tar.gz

Share
Tweet
Share
Buffer
WhatsApp
Email
0 Shares
Posted in: Hacking News


Latest Posts:


Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
July 7, 2021 - 77 Shares
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
May 27, 2021 - 219 Shares
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
May 7, 2021 - 95 Shares
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
April 19, 2021 - 207 Shares
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
March 5, 2021 - 232 Shares
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
February 3, 2021 - 162 Shares


2 Responses to unmask.py – Statistical E-mail & Blog Profiling

  1. dre October 25, 2007 at 11:07 pm #

    watch as christopher abad explains how behaviorial analysis can be applied to user fingerprinting in his slides from Toorcon 2004. the winner of a selected set of words can be predicted based on their use of the command line (bash shell in this case).

    i just saw chris abad speak again at toorcon 9 this past weekend. he is an excellent speaker, and usually “you have to be there” to understand – his work can’ really be explained.

    i imagine that with abad’s techniques (and dave aitel’s techniques in umask.py) – along with hdm’s decloak… and a little Google Analytics cookie saving and search query stealing – you can gather tons of information on random bloggers or other website users.

  2. Sir Henry December 14, 2007 at 7:34 pm #

    Darknet, have you tried this tool yet? What are your thoughts on it? It would be interesting to see any results from a test.