How to Find OSINT Data on License Plate Numbers with Skiptracer

While conducting an OSINT investigation, it's important to be able to pull in information based on any clue you uncover. In particular, license plate information can turn up everywhere, from photos to live data to on your own street. You could use that data to find the VIN, see if a Tinder date has hit anyone, find out who's blocking your driveway, and so on. Skiptracer can help get the ball rolling.

To get started, you'll need to have Python 2 installed and updated on your system. The developer of Skiptracer, xillwillx, is in the process of updating the tool to Python 3 since Python 2 is no longer supported, but it's not entirely done yet, so Python 2 is what we'll need for now. To see if you have Python 2 installed, use:

~$ python 2 --version

Python 2.7.18

Python 2.7.18 is the latest version, so you're good if that's what comes up. If you don't have it yet, install or update it using:

~$ sudo apt install python2
[sudo] password for kali:

Reading package lists... Done
Building dependency tree
Reading state information... Done
python2 is already the newest version (2.7.17-2).
python2 set to manually installed.
0 upgraded, 0 newly installed, 0 to remove and 122 not upgraded.

Now, once you have the U.S. license plate number and state of the vehicle you want to conduct an OSINT investigation on, you could start plugging the data into websites online. Still, most of them will try and charge you hefty fees to access any information. That's why Skiptracer is an excellent tool to use, as it queries a bunch of APIs to see if it can find free information from the best sources that are available.

• Don't Miss: Find Identifying Info from a Phone Number Using OSINT Tools

Now, to get started with Skiptracer, after knowing you already have Python 2 installed and up to date, you'll need to download the tool from xillwillx's GitHub. It's pretty easy to install since you just need to clone the repository with:

~$ git clone https://github.com/xillwillx/skiptracer.git

loning into 'skiptracer'...
remote: Enumerating objects: 3, done.
remote: Counting objects: 100% (3/3), done.
remote: Compressing objects: 100% (3/3), done.
remote: Total 1098 (delta 0), reused 0 (delta 0), pack-reused 1095
Receiving objects: 100% (1098/1098), 388.83 KiB | 1.85 MiB/s, done.
Resolving deltas: 100% (654/654), done.

To see what's inside the repository downloaded, you can cd into skiptracer, then ls to list its files.

~$ cd skiptracer
~/skiptracer$ ls

Changelog  Dockerfile  LICENSE  plugins  README.md  requirements.txt  skiptracer.py  storage

If you've ever installed a Python program before, it may be fairly obvious what needs to happen next. For those of you who haven't or don't know, you'll need to install the requirements.text file, which is a list of all the different modules Skiptracer needs to work. Use the pip install -r command to install it.

~/skiptracer$ pip install -r requirements.txt

Collecting python-docx
  Downloading python-docx-0.8.10.tar.gz (5.5 MB)
     |████████████████████████████████| 5.5 MB 880 kB/s
Requirement already satisfied: urllib3 in /usr/lib/python3/dist-packages (from -r requirements.txt (line 2)) (1.25.8)
Collecting bs4
  Downloading bs4-0.0.1.tar.gz (1.1 kB)
Requirement already satisfied: lxml in /usr/lib/python3/dist-packages (from -r requirements.txt (line 4)) (4.5.0)
Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from -r requirements.txt (line 5)) (2.23.0)
Collecting ipdb
  Downloading ipdb-0.13.2.tar.gz (14 kB)
Collecting pprint
  Downloading pprint-0.1.tar.gz (860 bytes)
Requirement already satisfied: click in /usr/lib/python3/dist-packages (from -r requirements.txt (line 8)) (7.0)
Collecting cfscrape
  Downloading cfscrape-2.1.1-py3-none-any.whl (12 kB)
Requirement already satisfied: numpy in /usr/lib/python3/dist-packages (from -r requirements.txt (line 10)) (1.17.4)
Requirement already satisfied: simplejson in /usr/lib/python3/dist-packages (from -r requirements.txt (line 11)) (3.17.0)
Requirement already satisfied: tqdm in /usr/lib/python3/dist-packages (from -r requirements.txt (line 12)) (4.43.0)
Requirement already satisfied: beautifulsoup4 in /usr/lib/python3/dist-packages (from bs4->-r requirements.txt (line 3)) (4.9.0)
Requirement already satisfied: setuptools in /usr/lib/python3/dist-packages (from ipdb->-r requirements.txt (line 6)) (46.1.3)
Requirement already satisfied: ipython>=5.1.0 in /usr/lib/python3/dist-packages (from ipdb->-r requirements.txt (line 6)) (7.13.0)
Requirement already satisfied: pexpect in /usr/lib/python3/dist-packages (from ipython>=5.1.0->ipdb->-r requirements.txt (line 6)) (4.6.0)
Building wheels for collected packages: python-docx, bs4, ipdb, pprint
  Building wheel for python-docx (setup.py) ... done
  Created wheel for python-docx: filename=python_docx-0.8.10-py3-none-any.whl size=184489 sha256=32c641b12abc6ff6aee1d56a517a41bfef0f0141f16b8a56959a17e160b6eae1
  Stored in directory: /home/kali/.cache/pip/wheels/97/4c/2e/68066cbf12b9b2e66403da8982aaf4f656d9f5cb5dc3179e82
  Building wheel for bs4 (setup.py) ... done
  Created wheel for bs4: filename=bs4-0.0.1-py3-none-any.whl size=1272 sha256=38acc084f674266787666f8155ea215bcb5b396e0c10abda215e7eb6c2606b01
  Stored in directory: /home/kali/.cache/pip/wheels/75/78/21/68b124549c9bdc94f822c02fb9aa3578a669843f9767776bca
  Building wheel for ipdb (setup.py) ... done
  Created wheel for ipdb: filename=ipdb-0.13.2-py3-none-any.whl size=10520 sha256=80973c70adb010a911087952c8eb2b65df2c2c39200d55bf5142fcc4bd5809c1
  Stored in directory: /home/kali/.cache/pip/wheels/31/f3/58/accdf45cba573136dff3bc0e8aad1848899255f5fc3266a9fc
  Building wheel for pprint (setup.py) ... done
  Created wheel for pprint: filename=pprint-0.1-py3-none-any.whl size=1250 sha256=d925426ad1cb6c7b20b03248fcacffb846477c9b4fa4939417a14b651a65cf2e
  Stored in directory: /home/kali/.cache/pip/wheels/db/43/1c/d58ea998a94cba18fba3d83fb3f574dcefe66b825f039cd932
Successfully built python-docx bs4 ipdb pprint
Installing collected packages: python-docx, bs4, ipdb, pprint, cfscrape
Successfully installed bs4-0.0.1 cfscrape-2.1.1 ipdb-0.13.2 pprint-0.1 python-docx-0.8.10

Then, we'll run the actual skiptracer.py file. When we run it, we should see an awesome banner and a list of different things we can do.

~/skiptracer$ python skiptracer.py

        .▄▄ · ▄ •▄ ▪   ▄▄▄·▄▄▄▄▄▄▄▄   ▄▄▄·  ▄▄· ▄▄▄ .▄▄▄
        ▐█ ▀. █▌▄▌▪██ ▐█ ▄█•██  ▀▄ █·▐█ ▀█ ▐█ ▌▪▀▄.▀·▀▄ █·
        ▄▀▀▀█▄▐▀▀▄·▐█· ██▀· ▐█.▪▐▀▀▄ ▄█▀▀█ ██ ▄▄▐▀▀▪▄▐▀▀▄
        ▐█▄▪▐█▐█.█▌▐█▌▐█▪·• ▐█▌·▐█•█▌▐█ ▪▐▌▐███▌▐█▄▄▌▐█•█▌
               ,.-~*´¨¯¨`*·~-.¸-(by)-,.-~*´¨¯¨`*·~-.¸

                  ▀ █ █ █▀▄▀█ █▀▀█ █▀▀▄
                  █ █ █ █ ▀ █ █  █ █▀▀▄
                  ▀ ▀ ▀ ▀   ▀ ▀▀▀▀ ▀▀▀
                    https://illmob.org

        .▄▄ · ▄ •▄ ▪   ▄▄▄·▄▄▄▄▄▄▄▄   ▄▄▄·  ▄▄· ▄▄▄ .▄▄▄
        ▐█ ▀. █▌▄▌▪██ ▐█ ▄█•██  ▀▄ █·▐█ ▀█ ▐█ ▌▪▀▄.▀·▀▄ █·
        ▄▀▀▀█▄▐▀▀▄·▐█· ██▀· ▐█.▪▐▀▀▄ ▄█▀▀█ ██ ▄▄▐▀▀▪▄▐▀▀▄
        ▐█▄▪▐█▐█.█▌▐█▌▐█▪·• ▐█▌·▐█•█▌▐█ ▪▐▌▐███▌▐█▄▄▌▐█•█▌
               ,.-~*´¨¯¨`*·~-.¸-(by)-,.-~*´¨¯¨`*·~-.¸

                  ▀ █ █ █▀▄▀█ █▀▀█ █▀▀▄
                  █ █ █ █ ▀ █ █  █ █▀▀▄
                  ▀ ▀ ▀ ▀   ▀ ▀▀▀▀ ▀▀▀
                    https://illmob.org

 [!] Lookup menu:
    [1] Email - Search targets by email address
    [2] Name - Search targets by First Last name combination
    [3] Phone - Search targets by telephone number
    [4] ScreenName - Search targets by known alias
    [5] Plate - Search targets by license plate
    [6] Domain - Search targets by Domain
    [7] Help - Details the application and use cases
    [88] Report - Generates a docx report from queries
    [99] Exit - Terminate the application
[!] Select a number to continue:

The most obvious choice here is "plate." A lot of the other options you see are in other tools, such as Sherlock ("ScreenName"), but we're just focusing on the plate search. Go ahead and select number 5 to do so.

• Don't Miss: Top 10 Browser Extensions for Hackers & OSINT Researchers

[!] Select a number to continue: 5

        .▄▄ · ▄ •▄ ▪   ▄▄▄·▄▄▄▄▄▄▄▄   ▄▄▄·  ▄▄· ▄▄▄ .▄▄▄
        ▐█ ▀. █▌▄▌▪██ ▐█ ▄█•██  ▀▄ █·▐█ ▀█ ▐█ ▌▪▀▄.▀·▀▄ █·
        ▄▀▀▀█▄▐▀▀▄·▐█· ██▀· ▐█.▪▐▀▀▄ ▄█▀▀█ ██ ▄▄▐▀▀▪▄▐▀▀▄
        ▐█▄▪▐█▐█.█▌▐█▌▐█▪·• ▐█▌·▐█•█▌▐█ ▪▐▌▐███▌▐█▄▄▌▐█•█▌
               ,.-~*´¨¯¨`*·~-.¸-(by)-,.-~*´¨¯¨`*·~-.¸

                  ▀ █ █ █▀▄▀█ █▀▀█ █▀▀▄
                  █ █ █ █ ▀ █ █  █ █▀▀▄
                  ▀ ▀ ▀ ▀   ▀ ▀▀▀▀ ▀▀▀
                    https://illmob.org

 [!] ScreenName search menu: Target info - None
    [1] All - Run all modules associated to the email module group
    [2] Plate Search - Run known vehicle plates against a database
    [3] Reset Target - Reset the Phone to new target address
    [4] Back - Return to main menu
 [!] Select a number to continue:

Now, let's select number 2 for "Plate Search." After doing so, it will ask you for the plate number, so enter that in at this time.

[!] Select a number to continue: 2
[?] Whats the target's plate number? [ex: (XYZ123|0U812)]: 5FZXXXX

After entering that, it'll ask you for the U.S. license plate's state abbreviation.

[?] FaxVin
  [!] Please enter 2 letter abbreviated state - ex: (AL=Alabama|CO=Colorado) CA
  [X] No results were found ...

If everything went well, you should see results. If you get the "No results" warning as I did, press Enter to continue, then select number 1 for "All." It's for all modules associated to the email module group, which doesn't make sense, I know, but it works. Then, reenter the state ID.

[!] ScreenName search menu: Target info - 5FZXXXX
    [1] All - Run all modules associated to the email module group
    [2] Plate Search - Run known vehicle plates against a database
    [3] Reset Target - Reset the Phone to new target address
    [4] Back - Return to main menu
 [!] Select a number to continue: 1

[?] FaxVin
  [!] Please enter 2 letter abbreviated state - ex: (AL=Alabama|CO=Colorado) CA

  [+] Plate: 5FZXXXX
  [+] State: CA
  [+] VIN: WDBUF70JX4A4XXXXX
  [+] Make: Mercedes-Benz
  [+] Model: E-Class
  [+] Year: 2004
  [+] Trim: E500
  [+] Style: SEDAN 4-DR
  [+] Engine: 5.0L V8 SOHC 24V
  [+] Plant: Sindelfingen, Germany
  [+] Age: 16 year(s)

Press 'ENTER' key now to continue

From that, we were able to extract some information about the vehicle. We started with just the plate number, but now we have the automobile's VIN, which we can use to pull up all sorts of other information. That data could include when it was registered and who it was registered to. If you're an OSINT investigator, you know that the more clues you can get about a specific target, the easier it is to plug it into other sources and learn a little bit more, bit by bit.

If you're looking for other information, there are other useful modules included in Skiptracer. For example, if you have a specific screen name you're looking for, it's easy to use the ScreenName module and run it against "All." It'll do the work for you, looking for accounts online that use that screen name. So if you need to do a quick profile on someone, or if you have a U.S. license plate to scan, either one of these modules will work just fine.

Skiptracer isn't a complete solution for an OSINT investigation, but it's a great way to start pulling clues together quickly, provided you have Python 2 installed on your system. If you need further help with Skiptracer, hit up the comments below or ask on Twitter @NullByte.

Cover image via Retia/Null Byte (originally by Marcus P./Unsplash)