While conducting an OSINT investigation, it's important to be able to pull in information based on any clue you uncover. In particular, license plate information can turn up everywhere, from photos to live data to on your own street. You could use that data to find the VIN, see if a Tinder date has hit anyone, find out who's blocking your driveway, and so on. Skiptracer can help get the ball rolling.
To get started, you'll need to have Python 2 installed and updated on your system. The developer of Skiptracer, xillwillx, is in the process of updating the tool to Python 3 since Python 2 is no longer supported, but it's not entirely done yet, so Python 2 is what we'll need for now. To see if you have Python 2 installed, use:
~$ python 2 --version
Python 2.7.18Python 2.7.18 is the latest version, so you're good if that's what comes up. If you don't have it yet, install or update it using:
~$ sudo apt install python2
[sudo] password for kali:
Reading package lists... Done
Building dependency tree
Reading state information... Done
python2 is already the newest version (2.7.17-2).
python2 set to manually installed.
0 upgraded, 0 newly installed, 0 to remove and 122 not upgraded.Now, once you have the U.S. license plate number and state of the vehicle you want to conduct an OSINT investigation on, you could start plugging the data into websites online. Still, most of them will try and charge you hefty fees to access any information. That's why Skiptracer is an excellent tool to use, as it queries a bunch of APIs to see if it can find free information from the best sources that are available.
Now, to get started with Skiptracer, after knowing you already have Python 2 installed and up to date, you'll need to download the tool from xillwillx's GitHub. It's pretty easy to install since you just need to clone the repository with:
~$ git clone https://github.com/xillwillx/skiptracer.git
loning into 'skiptracer'...
remote: Enumerating objects: 3, done.
remote: Counting objects: 100% (3/3), done.
remote: Compressing objects: 100% (3/3), done.
remote: Total 1098 (delta 0), reused 0 (delta 0), pack-reused 1095
Receiving objects: 100% (1098/1098), 388.83 KiB | 1.85 MiB/s, done.
Resolving deltas: 100% (654/654), done.To see what's inside the repository downloaded, you can cd into skiptracer, then ls to list its files.
~$ cd skiptracer
~/skiptracer$ ls
Changelog Dockerfile LICENSE plugins README.md requirements.txt skiptracer.py storageIf you've ever installed a Python program before, it may be fairly obvious what needs to happen next. For those of you who haven't or don't know, you'll need to install the requirements.text file, which is a list of all the different modules Skiptracer needs to work. Use the pip install -r command to install it.
~/skiptracer$ pip install -r requirements.txt
Collecting python-docx
Downloading python-docx-0.8.10.tar.gz (5.5 MB)
|████████████████████████████████| 5.5 MB 880 kB/s
Requirement already satisfied: urllib3 in /usr/lib/python3/dist-packages (from -r requirements.txt (line 2)) (1.25.8)
Collecting bs4
Downloading bs4-0.0.1.tar.gz (1.1 kB)
Requirement already satisfied: lxml in /usr/lib/python3/dist-packages (from -r requirements.txt (line 4)) (4.5.0)
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from -r requirements.txt (line 5)) (2.23.0)
Collecting ipdb
Downloading ipdb-0.13.2.tar.gz (14 kB)
Collecting pprint
Downloading pprint-0.1.tar.gz (860 bytes)
Requirement already satisfied: click in /usr/lib/python3/dist-packages (from -r requirements.txt (line 8)) (7.0)
Collecting cfscrape
Downloading cfscrape-2.1.1-py3-none-any.whl (12 kB)
Requirement already satisfied: numpy in /usr/lib/python3/dist-packages (from -r requirements.txt (line 10)) (1.17.4)
Requirement already satisfied: simplejson in /usr/lib/python3/dist-packages (from -r requirements.txt (line 11)) (3.17.0)
Requirement already satisfied: tqdm in /usr/lib/python3/dist-packages (from -r requirements.txt (line 12)) (4.43.0)
Requirement already satisfied: beautifulsoup4 in /usr/lib/python3/dist-packages (from bs4->-r requirements.txt (line 3)) (4.9.0)
Requirement already satisfied: setuptools in /usr/lib/python3/dist-packages (from ipdb->-r requirements.txt (line 6)) (46.1.3)
Requirement already satisfied: ipython>=5.1.0 in /usr/lib/python3/dist-packages (from ipdb->-r requirements.txt (line 6)) (7.13.0)
Requirement already satisfied: pexpect in /usr/lib/python3/dist-packages (from ipython>=5.1.0->ipdb->-r requirements.txt (line 6)) (4.6.0)
Building wheels for collected packages: python-docx, bs4, ipdb, pprint
Building wheel for python-docx (setup.py) ... done
Created wheel for python-docx: filename=python_docx-0.8.10-py3-none-any.whl size=184489 sha256=32c641b12abc6ff6aee1d56a517a41bfef0f0141f16b8a56959a17e160b6eae1
Stored in directory: /home/kali/.cache/pip/wheels/97/4c/2e/68066cbf12b9b2e66403da8982aaf4f656d9f5cb5dc3179e82
Building wheel for bs4 (setup.py) ... done
Created wheel for bs4: filename=bs4-0.0.1-py3-none-any.whl size=1272 sha256=38acc084f674266787666f8155ea215bcb5b396e0c10abda215e7eb6c2606b01
Stored in directory: /home/kali/.cache/pip/wheels/75/78/21/68b124549c9bdc94f822c02fb9aa3578a669843f9767776bca
Building wheel for ipdb (setup.py) ... done
Created wheel for ipdb: filename=ipdb-0.13.2-py3-none-any.whl size=10520 sha256=80973c70adb010a911087952c8eb2b65df2c2c39200d55bf5142fcc4bd5809c1
Stored in directory: /home/kali/.cache/pip/wheels/31/f3/58/accdf45cba573136dff3bc0e8aad1848899255f5fc3266a9fc
Building wheel for pprint (setup.py) ... done
Created wheel for pprint: filename=pprint-0.1-py3-none-any.whl size=1250 sha256=d925426ad1cb6c7b20b03248fcacffb846477c9b4fa4939417a14b651a65cf2e
Stored in directory: /home/kali/.cache/pip/wheels/db/43/1c/d58ea998a94cba18fba3d83fb3f574dcefe66b825f039cd932
Successfully built python-docx bs4 ipdb pprint
Installing collected packages: python-docx, bs4, ipdb, pprint, cfscrape
Successfully installed bs4-0.0.1 cfscrape-2.1.1 ipdb-0.13.2 pprint-0.1 python-docx-0.8.10Then, we'll run the actual skiptracer.py file. When we run it, we should see an awesome banner and a list of different things we can do.
~/skiptracer$ python skiptracer.py
.▄▄ · ▄ •▄ ▪ ▄▄▄·▄▄▄▄▄▄▄▄ ▄▄▄· ▄▄· ▄▄▄ .▄▄▄
▐█ ▀. █▌▄▌▪██ ▐█ ▄█•██ ▀▄ █·▐█ ▀█ ▐█ ▌▪▀▄.▀·▀▄ █·
▄▀▀▀█▄▐▀▀▄·▐█· ██▀· ▐█.▪▐▀▀▄ ▄█▀▀█ ██ ▄▄▐▀▀▪▄▐▀▀▄
▐█▄▪▐█▐█.█▌▐█▌▐█▪·• ▐█▌·▐█•█▌▐█ ▪▐▌▐███▌▐█▄▄▌▐█•█▌
,.-~*´¨¯¨`*·~-.¸-(by)-,.-~*´¨¯¨`*·~-.¸
▀ █ █ █▀▄▀█ █▀▀█ █▀▀▄
█ █ █ █ ▀ █ █ █ █▀▀▄
▀ ▀ ▀ ▀ ▀ ▀▀▀▀ ▀▀▀
https://illmob.org
.▄▄ · ▄ •▄ ▪ ▄▄▄·▄▄▄▄▄▄▄▄ ▄▄▄· ▄▄· ▄▄▄ .▄▄▄
▐█ ▀. █▌▄▌▪██ ▐█ ▄█•██ ▀▄ █·▐█ ▀█ ▐█ ▌▪▀▄.▀·▀▄ █·
▄▀▀▀█▄▐▀▀▄·▐█· ██▀· ▐█.▪▐▀▀▄ ▄█▀▀█ ██ ▄▄▐▀▀▪▄▐▀▀▄
▐█▄▪▐█▐█.█▌▐█▌▐█▪·• ▐█▌·▐█•█▌▐█ ▪▐▌▐███▌▐█▄▄▌▐█•█▌
,.-~*´¨¯¨`*·~-.¸-(by)-,.-~*´¨¯¨`*·~-.¸
▀ █ █ █▀▄▀█ █▀▀█ █▀▀▄
█ █ █ █ ▀ █ █ █ █▀▀▄
▀ ▀ ▀ ▀ ▀ ▀▀▀▀ ▀▀▀
https://illmob.org
[!] Lookup menu:
[1] Email - Search targets by email address
[2] Name - Search targets by First Last name combination
[3] Phone - Search targets by telephone number
[4] ScreenName - Search targets by known alias
[5] Plate - Search targets by license plate
[6] Domain - Search targets by Domain
[7] Help - Details the application and use cases
[88] Report - Generates a docx report from queries
[99] Exit - Terminate the application
[!] Select a number to continue:The most obvious choice here is "plate." A lot of the other options you see are in other tools, such as Sherlock ("ScreenName"), but we're just focusing on the plate search. Go ahead and select number 5 to do so.
[!] Select a number to continue: 5
.▄▄ · ▄ •▄ ▪ ▄▄▄·▄▄▄▄▄▄▄▄ ▄▄▄· ▄▄· ▄▄▄ .▄▄▄
▐█ ▀. █▌▄▌▪██ ▐█ ▄█•██ ▀▄ █·▐█ ▀█ ▐█ ▌▪▀▄.▀·▀▄ █·
▄▀▀▀█▄▐▀▀▄·▐█· ██▀· ▐█.▪▐▀▀▄ ▄█▀▀█ ██ ▄▄▐▀▀▪▄▐▀▀▄
▐█▄▪▐█▐█.█▌▐█▌▐█▪·• ▐█▌·▐█•█▌▐█ ▪▐▌▐███▌▐█▄▄▌▐█•█▌
,.-~*´¨¯¨`*·~-.¸-(by)-,.-~*´¨¯¨`*·~-.¸
▀ █ █ █▀▄▀█ █▀▀█ █▀▀▄
█ █ █ █ ▀ █ █ █ █▀▀▄
▀ ▀ ▀ ▀ ▀ ▀▀▀▀ ▀▀▀
https://illmob.org
[!] ScreenName search menu: Target info - None
[1] All - Run all modules associated to the email module group
[2] Plate Search - Run known vehicle plates against a database
[3] Reset Target - Reset the Phone to new target address
[4] Back - Return to main menu
[!] Select a number to continue:Now, let's select number 2 for "Plate Search." After doing so, it will ask you for the plate number, so enter that in at this time.
[!] Select a number to continue: 2
[?] Whats the target's plate number? [ex: (XYZ123|0U812)]: 5FZXXXXAfter entering that, it'll ask you for the U.S. license plate's state abbreviation.
[?] FaxVin
[!] Please enter 2 letter abbreviated state - ex: (AL=Alabama|CO=Colorado) CA
[X] No results were found ...If everything went well, you should see results. If you get the "No results" warning as I did, press Enter to continue, then select number 1 for "All." It's for all modules associated to the email module group, which doesn't make sense, I know, but it works. Then, reenter the state ID.
[!] ScreenName search menu: Target info - 5FZXXXX
[1] All - Run all modules associated to the email module group
[2] Plate Search - Run known vehicle plates against a database
[3] Reset Target - Reset the Phone to new target address
[4] Back - Return to main menu
[!] Select a number to continue: 1
[?] FaxVin
[!] Please enter 2 letter abbreviated state - ex: (AL=Alabama|CO=Colorado) CA
[+] Plate: 5FZXXXX
[+] State: CA
[+] VIN: WDBUF70JX4A4XXXXX
[+] Make: Mercedes-Benz
[+] Model: E-Class
[+] Year: 2004
[+] Trim: E500
[+] Style: SEDAN 4-DR
[+] Engine: 5.0L V8 SOHC 24V
[+] Plant: Sindelfingen, Germany
[+] Age: 16 year(s)
Press 'ENTER' key now to continueFrom that, we were able to extract some information about the vehicle. We started with just the plate number, but now we have the automobile's VIN, which we can use to pull up all sorts of other information. That data could include when it was registered and who it was registered to. If you're an OSINT investigator, you know that the more clues you can get about a specific target, the easier it is to plug it into other sources and learn a little bit more, bit by bit.
If you're looking for other information, there are other useful modules included in Skiptracer. For example, if you have a specific screen name you're looking for, it's easy to use the ScreenName module and run it against "All." It'll do the work for you, looking for accounts online that use that screen name. So if you need to do a quick profile on someone, or if you have a U.S. license plate to scan, either one of these modules will work just fine.
Skiptracer isn't a complete solution for an OSINT investigation, but it's a great way to start pulling clues together quickly, provided you have Python 2 installed on your system. If you need further help with Skiptracer, hit up the comments below or ask on Twitter @NullByte.
Just updated your iPhone? You'll find new emoji, enhanced security, podcast transcripts, Apple Cash virtual numbers, and other useful features. There are even new additions hidden within Safari. Find out what's new and changed on your iPhone with the iOS 17.4 update.
18 Comments
Can you use this tool to investigate Indian number plates?
face some problems here:
root@kali:/home/skiptracer# python skiptracer.py
Traceback (most recent call last):
File "skiptracer.py", line 4, in <module>
from plugins.menus import menus
File "/home/skiptracer/plugins/menus.py", line 5, in <module>
from plugins.fouroneone_info import FourOneOneGrabber
File "/home/skiptracer/plugins/fouroneone_info.py", line 5, in <module>
from plugins.base import PageGrabber
File "/home/skiptracer/plugins/base.py", line 4, in <module>
import requests
ImportError: No module named requests
Any idea?
Try: pip install requests
sudo pip install requests
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (2.23.0)
and still the same error on python skiptracer.py
The requests module is found in the pip repository so just run:
$ pip install requests
And you should be good. There are a couple other tricky ones but I don't see them in your paste so if you run into another sticking point. This install can finicky about using sudo, I ran into similar errors that were caused by ownership / in-path discrepancies. Try a fesh install without sudo , see how it behaves, using python3 env it's preferred not to run with sudo anyway. I got similar complaints until I ran the install straight through without elevated privilege. Cheers.
not even with python3
What does ls -ltr /usr/bin/python* give?
python -V
pip -V
Try with python2?
-rwxr-xr-x 1 root root 5902 nov 2 2019 /usr/bin/python3-wsdump
-rwxr-xr-x 1 root root 364 dez 15 15:09 /usr/bin/python3-qr
lrwxrwxrwx 1 root root 7 fev 4 11:30 /usr/bin/python-faraday -> faraday
-rwxr-xr-x 1 root root 196 mar 24 17:47 /usr/bin/python3-tor-prompt
-rwxr-xr-x 1 root root 388 mar 27 23:39 /usr/bin/python3-pasteurize
-rwxr-xr-x 1 root root 384 mar 27 23:39 /usr/bin/python3-futurize
-rwxr-xr-x 2 root root 5110856 abr 1 10:48 /usr/bin/python3.7m
-rwxr-xr-x 2 root root 5110856 abr 1 10:48 /usr/bin/python3.7
lrwxrwxrwx 1 root root 16 abr 7 07:43 /usr/bin/python3-config -> python3.8-config
lrwxrwxrwx 1 root root 9 abr 7 07:43 /usr/bin/python3 -> python3.8
-rwxr-xr-x 1 root root 3672400 abr 20 17:30 /usr/bin/python2.7
lrwxrwxrwx 1 root root 9 abr 24 14:55 /usr/bin/python2 -> python2.7
lrwxrwxrwx 1 root root 7 abr 24 14:55 /usr/bin/python -> python2
lrwxrwxrwx 1 root root 33 abr 30 04:33 /usr/bin/python3.8-config -> x86_64-linux-gnu-python3.8-config
-rwxr-xr-x 1 root root 5453440 abr 30 04:33 /usr/bin/python3.8
root@kali:/# python -V
Python 2.7.18
root@kali:/# pip -V
pip 20.0.2 from /usr/lib/python3/dist-packages/pip (python 3.8)
root@kali:/#
How about: pip2 install requests
not good yet
It seems this was made for the eol python2, but there is a stale branch python3 in the repo of xillwillx. You might pull that one, but I made one myself at github.com/jcaster/skiptracer/tree/py3
There was basically just some syntax outdated and I had to install some modules with pip3. I didn't have time to look into the banner logo that seemed to not work, so I commented it out. Let me know if you try it.
UPDATE Link provided,, 404. What's up?
Josh C.
I just caught your comment. I went to re-install skiptracer to a new instance and I see that xillwillx repo was removed for breach of ToS. Which might explain some strange issues I was experiencing when he supposedly migrated to python3.
Anyway, thank you so much for the pull while it was still up and before the alleged deprecation. You are a RockStar bro! Thank you so much,.you did a great thing. I think I can speak for all that have used this -- it's definitely a gem.! Thank you again.
Does anyone have a copy to share?
I cant figure out how to solve this problem. Theres nothing anywhere on it in skiptracer videos or posts that I can find. Ive tried reinstalling and starting fresh, using different versions of python, different versions of pip, stuff like that. I haven't used kali in a couple years though and was never really good so Im rusty and novice. Any and all suggestions on how to fix this is appreciated
If you look in the manifest on the left it says you have ioython satisfied at ~5.8(?). I know a lot got foobared with the attempted migration to 3.x.
I would try manually changing the line in requirements.txt to match your installed version. This should work and allow for the CLI menu to show as expected and fully functional. If it already states that it's satisfied, I am confident this workaround will... 'work'. :)
Let us know if your up and running with that mod...? Cheers.
Just to update everyone,, skiptracer has been pulled for breach of ToS/content. User xillwillx repo is still up but his famed OSINT power tool which is this post is no longer available.
I am currently looking for valid forks or pulls on git and elsewhere, but as I would assume, everyone is quiet with their copies / repos atm. This was an awesome tool and unfortunate with the all the other tools of this nature and those of duality still remain. Sad to see this one taken down.
Anyone willing to share their pull/clone, I would be very grateful.. Maybe even strike a trade..? Hmb.
Thank you @Retia and the rest of Null Byte. Y'all are the defacto standard for quality tutos and the newest/hottest trends in sec related tech.!
Cheers all and happy havking (for educational purposes Only)!
/; >
~r3kl3zz
How can I contact you? I don't see a way to send messages on this site.
With skiptracer no longer available. Are there any alternatives you can recommend?
Share Your Thoughts