Open Source Intelligence (OSINT) is the practice of collecting and analyzing publicly available information to produce actionable intelligence. This guide provides a structured methodology for conducting OSINT investigations.
OSINT Investigation Framework
1. Planning and Requirements
Before starting any OSINT investigation:
- Define clear objectives and scope
- Identify target entities (persons, organizations, domains)
- Establish legal and ethical boundaries
- Plan data collection and storage methods
2. Collection Phase
People Intelligence (HUMINT)
Social Media Platforms:
- Facebook, LinkedIn, Twitter, Instagram
- Professional networks and forums
- Dating sites and personal blogs
Public Records:
- Electoral rolls and voter registrations
- Court records and legal documents
- Property records and business registrations
Technical Intelligence (TECHINT)
Domain and IP Intelligence:
1
2
3
4
5
6
7
8
9
10
# Whois information
whois domain.com
# DNS enumeration
dig domain.com ANY
nslookup domain.com
# Subdomain discovery
amass enum -d domain.com
subfinder -d domain.com
Network Analysis:
1
2
3
4
5
6
# Shodan searches
shodan search "org:Company Name"
shodan host 192.168.1.1
# Certificate transparency
curl -s "https://crt.sh/?q=%.domain.com&output=json"
3. Essential OSINT Tools
Search Engines
- Google with advanced operators
- Bing, DuckDuckGo, Yandex
- Specialized search engines (Pipl, TinEye)
Social Media Intelligence
- Sherlock - Username enumeration
- Social Mapper - Social media correlation
- Twint - Twitter intelligence
Domain and Network Tools
- Maltego - Link analysis
- Recon-ng - Web reconnaissance framework
- TheHarvester - Email and subdomain gathering
4. Advanced Techniques
Google Dorking
1
2
3
4
site:company.com filetype:pdf
intitle:"confidential" site:company.com
inurl:admin site:company.com
cache:company.com
Social Engineering Preparation
- Company organizational charts
- Employee contact information
- Business relationships and partnerships
- Technology stack identification
5. Analysis and Correlation
- Cross-reference information from multiple sources
- Identify patterns and connections
- Verify information authenticity
- Timeline creation and gap analysis
6. Reporting and Documentation
- Maintain detailed source attribution
- Create visual relationship maps
- Provide actionable recommendations
- Ensure data protection and privacy
Legal and Ethical Considerations
Always ensure your OSINT activities comply with:
- Local and international laws
- Terms of service of platforms
- Privacy regulations (GDPR, CCPA)
- Professional ethical standards
Remember: Just because information is publicly available doesn’t mean it’s legal or ethical to collect and use it in all contexts.
Conduct investigations responsibly and ethically.