OSINT.

OSINT

Open Source Intelligence — using publicly available information to gather insights about individuals, organizations, and systems. OSINT can be one of the most powerful tools a hacker or cybersecurity professional can use.

Responsibility & Ethics

Be aware of privacy implications when engaging in OSINT research. OSINT should be used for ethical research without causing harm to those involved. Similar to social engineering, you should strive to leave people better off than before you started. WITH GREAT POWER COMES GREAT RESPONSIBILITY!

What is OSINT?

Open Source Intelligence (OSINT) is the collection and analysis of publicly available information. Journalists have used satellite images and social media posts to document war crimes. Researchers have found corporate passwords exposed in plain public search results. Law enforcement has identified suspects from a single background detail in a photo. The same internet you use every day is the tool.

  • Social media platforms
  • News outlets and public records
  • Government publications and filings
  • Academic research and conference proceedings
  • Publicly accessible databases and forums

Real-World Applications

OSINT is used across many legitimate fields — but threat actors misuse it too. Many breaches begin with effective OSINT research combined with social engineering.

  • Threat intelligence gathering by security agencies and researchers
  • Investigative journalism to uncover hidden information and corruption
  • Competitive intelligence for understanding market trends
  • Humanitarian crisis monitoring via social media analysis
  • Security research and responsible vulnerability disclosure
  • Attackers: profiling targets, building phishing campaigns, mapping infrastructure

Digital Footprints

A digital footprint is the trail of data you leave behind as you engage with digital systems. Every interaction adds to a profile that others — including threat actors — can access.

  • Social Media: Posts, comments, likes, and interactions
  • Web Browsing: Sites visited, search queries, time spent
  • Location Data: GPS data, app check-ins, Google Maps history
  • Online Registrations: Usernames, profile information, account metadata
  • Email: Metadata, attachments, sent and received history
  • Digital Breadcrumbs: IP addresses, user-agent strings, device fingerprints

Your Data as Training Data

Every post, photo, check-in, and search you make is publicly accessible — and at scale, that data is scraped and used to train AI models. Individually, each data point seems harmless. Combined, they build a profile more detailed than most people realize.

  • Social media posts reveal your opinions, relationships, and daily routine
  • Photos contain metadata (time, location) and can be used for facial recognition training
  • Writing style and word choice can identify you across anonymous accounts
  • Behavioral patterns — when you are online, what you engage with — are as revealing as what you post

AI-Powered OSINT

AI doesn't replace OSINT — it supercharges it. Tasks that once took hours of manual research can now be automated and scaled across thousands of targets simultaneously.

  • Facial recognition can match a photo against millions of public images to find accounts and locations
  • Natural language models can analyze writing to infer personality, location, or intent
  • AI tools aggregate data across platforms to build profiles from fragments
  • Voice samples from public videos can be cloned with just minutes of audio

AI + Social Engineering

Combining OSINT with AI creates some of the most convincing social engineering attacks seen today. The attacker knows everything about you — and now they can sound and look like someone you trust.

  • Spear phishing: AI generates personalized emails using your name, job, colleagues, and recent activity
  • Vishing: Voice cloning lets attackers impersonate coworkers, family, or executives on a phone call
  • Deepfakes: AI-generated video calls have been used to authorize fraudulent wire transfers
  • Synthetic personas: AI builds fake LinkedIn profiles and social histories to gain trust over time

Key OSINT Tools

Beyond search engines, specialized tools help practitioners collect, aggregate, and visualize OSINT data. Most are free and open source — knowing what exists is the first step.

  • Maltego: maps connections between people, domains, IPs, and emails as interactive visual graphs
  • Shodan: a search engine for internet-connected devices — servers, cameras, and industrial systems
  • theHarvester: automatically collects emails, subdomains, and employee names from public sources
  • crt.sh: certificate transparency log search — reveals subdomains and infrastructure through SSL records
  • OSINT Framework (osintframework.com): a directory of tools organized by the type of data you need
  • Social media, publicly available background check websites, public records, etc.

Google Dorking

Google dorking uses advanced search operators to find information that regular searches miss. These results expose real vulnerabilities — an open directory may contain passwords or private files, a login page may be running unpatched software, a log file may contain live session tokens. Dorking is often one of the first steps in a real-world attack. For more, see the Google Hacking Database (GHDB) at exploit-db.com/google-hacking-database

  • intitle:"Index of" — exposes open directory listings
  • intitle:"Login — WordPress" — finds WordPress admin login pages
  • filetype:log inurl:"access.log" — finds exposed server logs
  • site:example.com inurl:admin — finds admin pages on a specific domain

Data is Everywhere

In the digital age, data is everywhere. Nearly everything we do results in some sort of digital artifact. This may be a log somewhere, an image taken by someone/something, a social media post, receipts, public records, data used in phone suggestions, location history, etc. All of this data can be used by someone to learn more about you and your behaviors. And, unfortunately, all of this data can be used against you! Some of this is NOT public information but private data can become public very quickly through data breaches, system compromises, or just simple mistakes.

  • Social media checkins, location tracking, image metadata, system logs, images and posts from other people, interactions with the internet, images/video from street cameras, etc.
  • People should know what type of data is out there, and how to potentially avoid having this data used against them.
  • Data removal is difficult! Once your data is out there, it can be very difficult to get back...
Challenges
Multiple Choice

What should be considered when engaging in and utilizing OSINT?

✓ Solved!
Flag Challenge

We are looking for a hash used as a subdomain on a domain related to 'the-petting-zoo.com'. What is the subdomain?

✓ Solved!
Multiple Choice

Our local group (DC702) worked with a computer scientist. Where is Grace from?

✓ Solved!
Flag Challenge

Grace accidentally pushed something sensitive to one of her projects. What is the key used in her encryption project?

✓ Solved!
Multiple Choice

Which Google dork finds login pages associated with WordPress?

✓ Solved!
Multiple Choice

What is a common tool for mapping out information gathered from multiple sources?

✓ Solved!
Multiple Choice

An attacker wants to impersonate your manager to trick you into sending money. Which combination of AI techniques makes this most convincing?

✓ Solved!
Flag Challenge

We are tracking an access point around the valley. We think we have the BSSID but dont want to know the SSID so we can keep an eye out for it. What is the SSID? BSSID: 00:24:C8:70:47:40 -- FLAG Format: SSID

✓ Solved!
Flag Challenge

All we know is that the secret was published before.theunknown.space.

✓ Solved!

For More Information

OSINT Techniques

One of the best resources for learning about privacy and various OSINT techniques. Also associated with top books and free content on the subject.

Visit →

OSINT Framework

Provides a good overview of various tools for finding different types of data. A good place to get exposure to different data sources and databases.

Visit →

Google Hacking Database

A large collection of Google Dorks. Maintained by the Exploit DB team.

Visit →

Awesome OSINT

A huge collection of tools, techniques, and data sources on GitHub.

Visit →