Recent changes to the Facebook Graph have left a lot of OSINT collectors and investigators dazed and confused. Searchbook is a Firefox extension for Graph-like searches against Facebook that is easy to set up and easy to use. The extension allows you to overwrite some search queries that can be performed from the interface with more specific ones. It is based on the research article Facebook graph search workaround published by Social Links. After some communication with the developer and a bit of tweaking in the README, it’s ready to use straight out of the box without additional explanation. However, if you do need help, the developer is very responsive on Twitter.
Setting up Searchbook is easy. The only prerequisites are FireFox, Git (or just download the zip), and the following steps defined by the developer:
- Clone this repository or download it as a zip file and extract it on your filesystem
- Open a new browser tab in Firefox and type in the address bar
- Select “Enable add-on debugging”
- Click on the “Load Temporary Add-on…” button and open any file inside the code folder (e.g.: manifest.json)
Once you’ve downloaded and installed the extension, you’ll see a little blue thumbs down icon in the top right corner of you’re screen. You’re ready to get started.
Facebook Graph Searches
If you’ve been in the OSINT space for a while, you’ll know that the tools provided by Intel Techniques were recently taken down; additionally, Facebook made changes to their search index that rendered much of the canned manual searches obsolete. Because of the resiliency of the OSINT community, many researchers got to work on finding workarounds. Here’s an example of the work done by Dan Nemec. Prior to SearchBook, a lot of JSON conversions and headaches were involved in continuing the tradecraft. Now it only requires a few commands to imitate the most of the legacy searches.
The developer of SearchBook is actively updating the tool and providing users with as many search capabilities as they can. Currently, the developer has 17 different search possibilities including: pages-liked, groups, places-visited, spouses, and more. To use these keyword searches, you have to combine them with the command “intersect” within the Firefox extension. Here’s an example:
The Firefox extension is kind enough to provide the Facebook ID of the user for you, so you simply have to replace the “facebook_id” with the one it provides you. After you’ve set the search, simply type whatever you want into the search bar. SearchBook will intercept your query and populate the graph-like search underneath a few results generated by your placeholder query.
The changes to the Graph search by Facebook are unlikely to be the last changes we’ll see this year. It’s even possible that SearchBook may only be a temporary solution. We also saw a wide-scale removal of OSINT pseudo accounts on Twitter during the same time as the Facebook changes. However, don’t get discouraged. The market always adjusts when changes are made and OSINT investigators will continue to have a valuable skill set so long as they change accordingly with the times. As far as SearchBook is concerned, make sure to keep the latest version installed on your machine for the best results. To streamline this, make sure to install SearchBook through Git so you can simply type “git pull” into the command prompt under the SearchBook directory for an update and re-upload the extension to Firefox.