One important point that I should indicate in this OSINT Workflow article that this technique may only be applied to Facebook friend lists that are publicly visible. However, if you have a Sock Puppet that is connected to the target Facebook user, then the process that we are about to show you will also apply. We should stress that there is no way to bypass Facebook security and privacy mechanisms to uncover hidden friend lists.
- Google Chrome: For the purpose of this OSINT Workflow article, we shall use Google Chrome as it is the most compatible browser for the extensions indicated below.
- Webpage Auto Scrolldown: A Google Chrome extension that can be used to auto-scroll down a target Facebook profile’s friend list. It can be activated by clicking the icon on the top right of the Google Chrome browser and clicking once more in order to deactivate it. The extension can be downloaded and installed via this link.
- Instant Data Scraper: Another Google Chrome extension that is a very handy tool that is used to extract URLs and allow you to export them within a comma-separated value (CSV) file. The extension can be downloaded and installed via this link.
- Microsoft Excel: We will use Excel in order to build our Edge and Node lists by applying some functions.
- Gephi: Gephi is a data visualization and exploration software for all kinds of graphs and networks. Gephi is a free / open-source tool that is compatible with Windows, MacOS and Linux operating systems. The software can be downloaded and installed via this link.
PREPARING THE OSINT ENVIRONMENT
It goes without saying, all SOCMINT activities should be done through the use of a Sock Puppet for a variety of reasons. If you have not created a Sock Puppet account for Facebook, please read through our comprehensive guide.
With your tools installed and your Sock Puppet configured, it is now time to access Facebook and view the friend list of the target profile. The URL should be:
SCRAPING THE FRIEND LIST
We are now on the target profile friend list. If your target only has up to 200 friends, then there is no real need for you to use the Webpage Auto Scrolldown. Otherwise, you should go ahead and click on the Webpage Auto Scrolldown icon that can be found in the top right of your Google Chrome browser. However, you may need to click on the browser ‘jigsaw’ icon and pin the extension to the top bar.
When you click on the Webpage Auto Scrolldown icon, the extension will work its way down to the bottom of the Facebook page. You will also notice that the target profile’s likes will also be expended – this is very normal, just allow the tool to finish what it needs to do.
Once you are at the bottom of the Facebook page, click on the Webpage Auto Scrolldown icon once more – this will prevent the scroller from forcing its way back down to the bottom of the page and allow you to regain control of your mouse scroll-wheel.
Navigate yourself back up to the friend list using the browser scrollbar or the mouse scroll wheel, then click anywhere on the whitespace within the friend list. Make sure not to accidentally click on another Facebook user profile otherwise, you will need to repeat the above process. Once you have clicked on an area of whitespace (perhaps in-between two of the target’s friends) you can now click on the Instant Data Scraper icon which should be located on the top right area of the browser window.
Once clicked, a pop-up window should open. The pop-up should contain a list of Facebook profile URLs and names. These URLs are the target’s friends. Inside the pop-up, you should click on the green button named ‘CSV‘ – once clicked, the target’s friend list will download in a Comma-Separated Value (CSV) file.
IMPORTING THE CSV TO MS EXCEL
Now we have our friend list downloaded as a CSV file, you should switch to MS Excel.
To import the CSV file into MS Excel, you should open a blank worksheet and then navigate to the data tab located on the top of the MS Excel window. You should see on the left-hand side of the ribbon a button named ‘From Text/CSV‘, click on this. This will now open a new window where you can navigate to the Facebook target’s friend list CSV file. You should double-click on the file or select it and then click ‘Open’.
A pop-up window should appear in MS Excel providing you with some options with regards to importing the CSV file to MS Excel. Click on the dropdown arrow under ‘File Origin’ and then select UTF-8. Next, you should click ‘Transform Data‘ located in the bottom right of the pop-up window. By clicking on the button, you are now finalising the import of the CSV file into MS Excel.
The Power Query Editor should open in a new window on your screen. Within Power Query Editor, you should remove the first row by clicking on the ‘Remove Rows‘ button and then selecting ‘Remove Top Rows‘. A separate window will now open asking you how many rows you wish to delete. As we only need to remove the first row, we will input ‘1‘ and click ‘Ok‘.
Next, we click on ‘Close & Load To…‘ and select ‘Existing Worksheet‘, then click ‘Ok‘.
CREATING THE NODE LIST IN MS EXCEL
You should see the friend list of the Facebook target in MS Excel.
Our first task is to rename ‘column1′, column2’, ‘column3’ and ‘column4’ with ‘url‘, ‘img‘, ‘fullname‘ and ‘description‘. After this, delete the column named ‘column5‘ as it will add no overall value to the link analysis chart that we will produce at the end.
Return to the first row of columns and add three new columns in front of the column named ‘url’ and name them ‘id‘, ‘label‘ and ‘role‘.
Next, you should input a formula that will extract the profile username from each of the individuals within the friend list. The formula will extract the username from the ‘url’ column by counting the number of characters within the URL string and extract the username. The formula to do this is
=IF(ISNUMBER(FIND("profile.php",D2)),MID(D2,41,LEN(D2)+1-41),MID(D2,26,LEN(D2)-25)). You should paste the formula into the first entry under the column named ‘label’.
Next, within the first entry for the column named ‘id’ input the formula
=B2, this formula will copy the value from the ‘label’ column. In the first entry for the ‘role’ column, go ahead and type in ‘friend‘. To apply the aforementioned formulas to the rest of the fields, simply click on the entry you wish to copy (for example, B2); in the bottom-right corner of the cell, you should see a square; using your mouse, right-click, hold and drag down across all of the relevant cells within the same column (as shown in the animated image above). This process can be repeated for the rest of the fields.
The Node List is now complete, I would recommend you save it as a standard MS Excel file with a name such as ‘[TARGET NAME]-nodelist’ for example. Don’t close the spreadsheet just yet as we will need it very shortly!
CREATING THE EDGE LIST IN MS EXCEL
To create the Edge List, you should start by opening a blank worksheet in MS Excel.
You should begin by naming the first four columns ‘source‘, ‘target‘, ‘type‘ and ‘weight‘. Next, return to the Node List and select all of the entries from the ‘id’ or ‘label’ column and copy them. Returning to your Edge List, right-click on the first blank entry within the ‘target’ column and paste the items as values.
In the ‘source’ column, this is where the target’s user name should be placed. You can start by inputting the target name in the first blank cell and then copying and pasting the target name into the rest of the blank cells in the ‘source’ column.
In the column named ‘type’, the following rule applies. If the individuals are friends of the target, you should input ‘Undirected’. However, if the individuals are followers of the target, you should input ‘Directed’.
The last column ‘weight’ is nice and simple, just input ‘1’.
Using the same processes indicated in the preceding section, you can now populate the remainder of the fields by using the copy and paste function.
Now it is time to save this spreadsheet. Again, save it as a regular MS Excel file with a name such as ‘[TARGET NAME]-edgelist’ for example. Don’t close the spreadsheet just yet as we will need it very shortly!
MULTIPLE FACEBOOK TARGETS
In the likely event that you have multiple target profiles to analyse on Facebook, you can apply all of the processes indicated above and populate all of your data within the same Node and Edge Lists. The only thing you will have to make sure of is that you account for the different target username (as indicated in the animated image above).
EXPORTING THE NODE AND EDGE LISTS
You should export both your Node and Edge Lists as Comma-Separated Value (CSV) spreadsheet. As indicated in the animated image above, click on ‘File‘ and then select ‘Export‘ from the left sidebar. Here, you should select ‘Change File Type‘, then select ‘CSV (Comma delimited)‘, then ‘Save As‘, and then save the file in the same folder as your original spreadsheets. You may close your MS Excel windows.
CREATING THE LINK ANALYSIS CHART WITH GEPHI
With the Node and Edge Lists created in CSV format, you can now open Gephi and create a ‘New Project‘.
With our project created, we can select the ‘Data Laboratory‘ button and use this area to import your Node and Edge Lists.
Starting with the Node List, ensure that the ‘Node‘ tab is selected in the top-left of the Data Laboratory window and then click on ‘Import Spreadsheet‘. Next, navigate to and select the Node List CSV file that you want to import into your Gephi Project. A pop-up window should now appear. In the ‘General CSV Options (1 of 2)’, you can go straight ahead and select ‘Next‘, and do the same in the next section titled ‘Import Settings (2 of 2). In the following pop-up window named ‘Import Report’, make sure to select ‘Append to existing worksheet‘, then click ‘Ok‘. You will now see the Node List imported into the Gephi Data Laboratory.
Next, we want to import the Edge List. Select the tab named ‘Edge‘ located in the top-left section of the Data Laboratory window and then click on ‘Import Spreadsheet‘. You can start by navigating to and selecting the Edge List CSV file that you want to import. Follow the exact same process as you have done with the Node List and make sure that you select ‘Append to existing worksheet‘ when the ‘Import Report’ popup appears. After this, you will see that the Edge List has now been imported into the Gephi Data Laboratory.
It is now time to view and configure the Link Analysis chart. Click on the ‘Overview‘ tab located at the top of the Gephi window. If you do not see a Link Analysis chart in this section, navigate to the top bar and select ‘Window‘ and then ‘Graph‘. After following this instruction, you should now see a link chart appear. At this point, it is time for you to configure the layout of the Link Analysis chart. You can do this by selecting ‘ForceAtlas 2‘ located in the ‘Layout’ tab to the left of the screen. You can now configure your desired visualisation settings (as indicated in the animated image shown above) and then clicking ‘Run’. Lastly, within the ‘Graph’ window, you can configure text options by selecting ‘T‘ to show the label of each node and adjust the size of the text as you see fit.
And that is it! We have now scraped a target friend list from Facebook and visualised the data within a Link Analysis chart. However, there is much more that we can do inside Gephi in order to exploit the data that we have collected and visualise it across different views. In our next OSINT Workflow article, we will take a closer look at Gephi and the data visualisation power that it holds!