OSINT stands for Open Source Intelligence.
It’s the art of collecting information from public sources to answer a question.
No hacking. No illegal tools. Just smart Googling, social media, and public records.
Law enforcement, journalists, bug bounty hunters, and recruiters all use OSINT every day.
If you want to get into cybersecurity, DFIR, or threat intelligence, OSINT is skill
1 you must master.
In this guide, I’ll break down what OSINT is, the tools, techniques, and 3 real examples you can try today.
What Is OSINT?
OSINT = Information that is legally available to the public.
Sources include:
- Social Media: Facebook, LinkedIn, X, Instagram, TikTok
- Websites: Company pages, blogs, press releases
- Public Records: Domain WHOIS, court records, business registration
- Leaked Databases: Breach data from HaveIBeenPwned
- Technical Data: DNS records, Shodan, GitHub, Google Dorks
- Images & Maps: Google Street View, EXIF data, reverse image search
Rule: If you need a password or have to hack to get it, it’s NOT OSINT.
Why OSINT Matters in Cybersecurity
- Incident Response: Find out who is attacking you. Trace a phishing domain to the owner.
- Threat Intelligence: Track hacker groups. See what tools they talk about on forums.
- Bug Bounty: Find employee emails, subdomains, and exposed assets before you hack.
- Corporate Security: Vet a vendor. Check if their CEO posts company secrets.
- Journalism: Verify facts and find sources.
Companies pay $60k-$120k for OSINT analysts. The skill is in demand.
The OSINT Process: 5 Steps
Use the "OSINT Cycle" used by professionals:
Step 1: Define the Objective
Bad: "Find info about John"
Good: "Find John Doe's work email and LinkedIn to send a phishing simulation test"
The clearer your goal, the faster you find results.
Step 2: Collect Data
Start broad, then go narrow. Use the "Snowball Method".
Find 1 piece of data → that leads to 3 more pieces → that leads to 10 more.
Step 3: Process and Analyze
Put everything in a spreadsheet. Look for patterns.
Does the same username appear on 5 sites? Do 2 companies share the same IP address?
Step 4: Verify
Never trust 1 source. Cross-check.
If LinkedIn says someone works at Google, check their company email domain and GitHub.
Step 5: Report
Write down what you found, where you found it, and the date. This is critical for DFIR and legal cases.
Top 15 OSINT Tools You Need in 2026
You don’t need to pay for tools to start.
People Searched
- LinkedIn - Job titles, company, education
- Facebook - Family, location, photos
- Pipl.com - Aggregates people data
- FaceCheck.ID - Reverse face search
Domain & Technical
- WHOIS.domaintools.com - Who owns a domain
- Shodan.io - Find exposed cameras, servers, IoT devices
- SecurityTrails.com - Subdomains and DNS history
- GitHub Search - Find leaked API keys: org:target password
Images & Location
- Google Reverse Image Search - Find where a photo was posted
- Google Earth + Wikimapia - Verify locations
- ExifTool - Pull GPS data from photos
Data Aggregation
- Maltego - Map connections between people and companies
- theHarvester - Find emails and subdomains from Google/Bing
- HaveIBeenPwned.com - Check if an email was breached
- Google Dorks - Advanced Google searches. Example: site:target.com filetype:pdf confidential
3 Real OSINT Examples You Can Try
Example 1: Find a Company's Tech Stack
Goal: You want to bug bounty a company.
- Go to SecurityTrails → Search target.com → Get all subdomains
- Go to BuiltWith.com → See if they use WordPress, Cloudflare, AWS
- Go to LinkedIn → Search "target.com security engineer" → Find employee names
Result: You now have attack surface + potential contacts.
Example 2: Verify a Phishing Email
You get an email from "ceo@microsft-support.com"
- WHOIS the domain → Registered 2 days ago in Nigeria. Red flag.
- Search the domain on VirusTotal → 3 vendors flag it as phishing
- Google the exact email → Found on 2 scam report sites
Result: Confirmed phishing. Block and report.
Example 3: Track a Username
Goal: Find all accounts for username "CyberNinja99"
- Go to namechk.com → Check 50+ social sites at once
- Found them on Twitter, Reddit, GitHub
- Check GitHub → They committed code with their real email
- Take that email → Search on HaveIBeenPwned → 2 breaches
Result: Full profile mapped in 10 minutes.
OSINT Ethics and Legal Rules
This is critical. OSINT is legal, but how you use it matters.
DO:
- Use only public data
- Respect privacy. Don’t dox people.
- Document your sources
DON'T:
- Hack accounts
- Use pretexting to trick people
- Harass or stalk
If you’re doing this for a company, get written permission first.
How to Practice OSINT and Get Good
- TryHackMe Room: "OSINT" - Free hands-on labs
- Challenge: Pick a celebrity. Find 10 facts about them using only public sources. No login.
- Challenge: Pick your own domain. Map all subdomains and employees.
- Follow: @Intel techniques on X and r/OSINT on Reddit
Do 30 minutes a day for 30 days and you’ll be better than 90% of people.
Final Thoughts
OSINT is not about being a hacker. It’s about being a detective with the internet.
The internet never forgets. People leak info in resumes, forum posts, photos, and code commits.
Your job as an OSINT analyst is to connect those dots.
Master this, and you can get into DFIR, threat intel, bug bounty, or corporate security.
Next step: Open 3 tabs right now: LinkedIn, Shodan, and Google. Pick a company and start digging.
---
What do you want to learn next?
Comment below: "Tools" if you want my full OSINT toolkit, or "Cases" if you want a real investigation walkthrough.
0 Comments