OSINT

This will be a living document and will get content added and/or updated as often as possible.

osint

Open Source Intelligence [OSINT] describes the tools, methodologies, and data sources security professionals, penetration testers, and threat intelligence analysts use to build a picture of a target using only publicly available information … no exploitation, no unauthorized access, just what’s already out there.

Sources typically include social media platforms, public forums, breach data, and public records. Every structured OSINT investigation follows the same general phases:

PLANNING >> OPSEC >> PASSIVE RECON >> ACTIVE RECON >> ANALYSIS

PLANNING

Always ensure the Rules of Engagement [**RoE**] have clearly defined boundaries, targets, and limitations — exactly what systems, networks, applications, and/or physical locations are authorized for testing, and what’s explicitly excluded.

  • Define your objective: what are you trying to find, and why?
  • Identify your target: person, organization, domain, IP, username, etc.
  • Define scope: what’s in bounds and what’s out of bounds?
  • Establish legal boundaries: are you authorized? What laws apply?
  • Define ethical limits: what will you *not* do, regardless of legality?
  • Identify what a successful outcome looks like.
  • Determine who the findings are for and what format they’ll need.
  • Document and have the RoE signed by all relevant parties before any work begins.

OPERATIONAL SECURITY

Before you touch a single tool, get your Operational Security [OPSEC] locked down. This is what keeps attribution off your back and your personal footprint out of the investigation.

  • Set up a dedicated VM or isolated environment
  • Use a VPN or Tor, depending on the anonymity level the engagement calls for
  • Build sock puppet accounts with believable, non-attributable personas
  • Disable WebRTC leaks and browser fingerprinting
  • Keep investigation infrastructure completely separate from personal or work infrastructure

See the glossary if any of these terms aren’t familiar yet.

RECONNAISSANCE

Reconnaissance [Recon] is one of the first real steps of a penetration test; it’s how you build the map before you (or someone with bad intentions) figures out where the doors are.

Passive Recon: web-based sources

Passive recon relies on free, public sources … no direct interaction with the target. A working toolbox here can span hundreds of sites and tools. Some of what’s in mine:

  • Search engine dorking (Google, Bing, DuckDuckGo)
  • Social media profiling: public posts, connections, check-ins, metadata
  • WHOIS and DNS lookups
  • Reverse image searches
  • Data breach databases (HaveIBeenPwned, DeHashed)
  • Public records: court filings, property records, business registrations
  • (Shodan / Censys) for exposed infrastructure
  • crt.sh for certificate transparency and subdomain discovery
  • URLScan.io for scanning and archiving how a URL behaves
  • VirusTotal and any.run for checking files, URLs, and domains against threat intel
  • AlienVault OTX for community-sourced threat indicators
  • `subfinder`, `httpx`, `waybackurls`, and `subzy` for subdomain enumeration, live-host probing, historical URL discovery, and subdomain takeover checks
  • ip-api.com batch endpoint for quick IP geolocation/ASN lookups
  • Wayback Machine / cached pages
  • Metadata extraction from public documents and images (EXIF, FOCA)
  • Job postings and LinkedIn for organizational intel
  • GitHub and code repositories for exposed credentials or config files
  • Dark web monitoring, where applicable and only through vetted, legal-safe access points, never crawl this space blind

NOTE: I bundled a chunk of this workflow into a script so I’m not doing it by hand every time; check out osint-recon on GitHub, a bash-based passive recon tool that automates a lot of the above.

Active Recon: pentesting and social engineering

This is direct interaction with systems or people, and it only happens where the RoE explicitly authorizes it.

  • Direct website visits and crawling
  • Port scanning (Nmap)
  • Subscribing to newsletters or mailing lists
  • Registering for forums or communities the target participates in
  • Banner grabbing
  • Interacting with a target’s social media, connection requests, messages
  • Always through sock puppet accounts, never your real identity

Note: active recon carries a much higher risk of detection. OPSEC needs to be airtight before you move from passive to active.

ANALYSIS

Once collection wraps, the job isn’t done until it’s written up. A detailed analysis report covers every step, tool, and source used, plus screenshots, printouts, and any data files collected during the engagement.

  • Organize and structure all collected data (Maltego, Obsidian, etc.)
  • Cross-reference findings across multiple independent sources
  • Build timelines of activity or events
  • Map relationships between entities, people, domains, accounts, locations
  • Assign confidence levels to findings (confirmed, probable, unverified)
  • Identify gaps and determine if more collection is needed
  • Document everything in a clear, structured, defensible format appropriate for your audience, law enforcement, a client, or your own team

Note: as always, follow basic cybersecurity best practices before any online activity.

OSINT TOOLS

A-B-C

AlienVault OTX — free, community-driven threat intelligence sharing platform.

Anonymous Email — web-based service for sending anonymous, untraceable emails without an account.

any.run — interactive sandbox for detonating and observing suspicious files/URLs safely.

Big Domain Data — domain registrant, history, and ownership info.

crt.sh — free certificate transparency log search, great for pulling subdomains off a target’s SSL cert history.

D-E-F

Data Miner — free Chrome/Edge extension for scraping web page data into CSV/Excel.

G-H-I

J-K-L

Know ‘Em — checks 500+ social networks and 150+ domains for a given username.

M-N-O

MITRE ATT&CK — the standard framework for classifying adversary tactics and techniques. [Paired with MITRE D3FEND for standardized defensive countermeasures.]

Opsis — aggregates info tied to usernames, emails, or names across platforms.

osint-recon — my own th3cyb3rguy bash-based passive recon script, open source on GitHub.

P-Q-R

Privacy.com — virtual cards for privacy-focused transactions during investigations.

S-T-U

SearX — metasearch engine pulling from 70+ search services at once.

Shodan — search engine for internet-connected devices and exposed services.

TextNow — free phone service with unlimited talk/text, useful for sock puppet verification.

Tuta — privacy-focused, end-to-end encrypted email out of Germany.

URLScan.io — scans and archives a URL’s behavior, requests, and screenshots without you touching it directly.

V-W-X

VirusTotal — aggregates dozens of AV engines and threat feeds to check files, URLs, domains, and IPs.

Wayback Machine — the Internet Archive’s crawl of the web going back to 1996. Essential for pulling deleted or edited content.

NOTE: Terms you don’t recognize? Check the glossary.