Learn
LoginRegister

Part of Resources — OSINT curriculum under Resources — also taught inside relevant courses, not a parallel track.

Recon & intelligence (defensive-first)

OSINT center

Ten-section curriculum: fundamentals through legal boundaries. Authorized data, public sources only — no doxing or harassment. Document sources and timestamps for every finding.

Legal & ethical OSINT (CYNARKS standard)

  • Only collect and analyze data you are authorized to use (your org, your accounts, written consent, or public bug bounty scope).
  • OSINT is not stalking — no harassment, doxing, or bypassing access controls.
  • Hacking is not only offensive: blue teams use the same sources to reduce exposure and detect impersonation.
  • Document sources and timestamps for incident reports and breach notifications.

Standard workflow

  1. Define question & authorization (what are you trying to prove? who approved it?)
  2. Passive first: DNS, certificates, archives, breach checks — no intrusive scanning.
  3. Correlate across 2+ sources before conclusions.
  4. Report findings with remediation (take down, reset creds, harden DNS, user awareness).
  5. Practice on your own domain/username before client or bounty work.

Deep methodology: OSINT investigation playbook · Legacy recon notes: OSINT recon

Section 1 of 10

OSINT fundamentals

Questions, authorization, passive-first mindset, and case notes.

Playbook →

Taught in: cybersecurity fundamentals · ethical hacking penetration testing

collection · Curated hubs & training

OSINT Dojo

Community-driven OSINT exercises and methodology.

  1. Pick a module
  2. Follow passive-only steps
  3. Write up IOCs and limits

Training scenarios — stay in fictional or self-owned targets unless stated.

External ↗

collection · Curated hubs & training

Awesome OSINT (curated list)

Large maintained index of OSINT tools and sites — use as reference, not a scrape-everything checklist.

  1. Choose lane (people, DNS, etc.)
  2. Verify tool ToS
  3. Prefer passive sources

Third-party tools have their own terms; CYNARKS lists for education.

External ↗

collection · Curated hubs & training

Bellingcat Online Investigation Toolkit

Investigative journalism methods: geolocation, image verification, social corroboration.

  1. Verify image/time/place
  2. Cross-reference satellite/street imagery
  3. Publish responsibly

High-impact OSINT — accuracy and harm reduction matter.

Case: Bellingcat investigations (MH17, Jan 6) relied on open sources + rigorous verification.

External ↗

collection · Curated hubs & training

Start.me OSINT pages

Bookmark dashboards aggregating OSINT web tools (many analysts maintain private Start.me boards).

  1. Clone a starter board
  2. Remove tools you don't need
  3. Pin your org-approved stack

Bookmarks are not endorsement — validate each tool legally.

External ↗

guide · Start here

Where bug hunters practice (legal)

Scoped programs, VDPs, and CTFs — attackers find info via the same OSINT you use defensively.

  1. Read scope
  2. Passive recon only if allowed
  3. Report via platform

No program = no testing.

External ↗

guide · Start here

Where enthusiasts start

CYNARKS roadmap + in-browser labs → PortSwigger → TryHackMe → scoped bounty.

  1. Complete fundamentals
  2. Build home lab
  3. Join CTF
  4. Apply for junior SOC/AppSec roles

Ethics and authorization first — reputation follows.

Section 2 of 10

Search techniques

Dorks, archives, and structured queries without intrusive scanning.

Taught in: ethical hacking penetration testing · bug bounty hunting

collection · Frameworks & automation

OSINT Framework

Tree of OSINT resources by category (username, email, transport, etc.).

  1. Select category
  2. Open tool
  3. Document result in case notes

Framework links to third parties — scope and ToS apply.

External ↗

guide · Web, archives & dorks

Google dorks

Search operators to find indexed sensitive content on your domains.

  1. site:yourco.com filetype:env
  2. Remove or block indexing
  3. Repeat quarterly

Defensive dorking on owned domains is standard ASM practice.

Tool detail →

web · Web, archives & dorks

Wayback Machine

Historical page snapshots.

  1. Find removed admin paths
  2. Check for leaked params in old JS

Public archive — use for intel not exploitation.

Tool detail →

web · Web, archives & dorks

urlscan.io

Safe URL rendering and network capture for triage.

  1. Private scan phishing URL
  2. Extract IOCs
  3. Block at proxy

May notify URL owner on public scans — use private workspace.

Tool detail →

desktop · Frameworks & automation

Maltego CE

Graph-based link analysis.

  1. Seed entity (domain)
  2. Run passive transforms
  3. Export graph for report

Transforms may hit third-party APIs — mind quotas and ToS.

Tool detail →

cli · Frameworks & automation

SpiderFoot

Automated modular OSINT scans (self-hosted).

  1. Define target scope
  2. Enable passive modules only first
  3. Review correlation tab

Self-host in lab network; scope written approval.

Tool detail →

cli · Frameworks & automation

Recon-ng

Modular recon console.

  1. Create workspace
  2. Load domain module
  3. Export to CSV

Engagement-scoped.

Tool detail →

Section 3 of 10

Domain and DNS intelligence

DNS maps, certificates, historical records, and shadow DNS.

Taught in: networking fundamentals · network security · ethical hacking penetration testing

cli · Domain, DNS & certificates

theHarvester

Emails, hosts, and names from public search engines and APIs.

  1. Passive sources only
  2. Merge with subfinder
  3. Remove false positives

Scoped domain only.

Tool detail →

web · Domain, DNS & certificates

DNSDumpster

DNS map and subdomain hints.

  1. Run for your domain
  2. Compare to internal CMDB
  3. Fix shadow DNS

Passive.

Tool detail →

web · Domain, DNS & certificates

SecurityTrails

Historical DNS and subdomain intelligence.

  1. Baseline history
  2. Detect hijack or dangling records

Commercial API — use for owned assets.

Tool detail →

Section 4 of 10

Public infrastructure intelligence

Internet-wide exposure views for owned assets and scoped assessments.

Taught in: network security · cloud security · ethical hacking penetration testing

web · Infrastructure & exposure

Censys

Certificates and internet-wide host data.

  1. Query org name/ASN
  2. Open tickets for unexpected ports

Research platform — not authorization to exploit findings.

Tool detail →

web · Infrastructure & exposure

Shodan

Search engine for internet-connected devices (use org account filters).

  1. Monitor org IP ranges
  2. Alert on new exposures

Monitor what you own; don't probe random IPs.

Case: Repeated ransomware entry via exposed RDP/VPN found via exposure search — fixed by firewall + MFA.

Tool detail →External ↗

web · Infrastructure & exposure

VirusTotal

Multi-engine file/URL/domain reputation.

  1. Hash lookup from SIEM
  2. Pivot on related files in enterprise VT

Upload policy — sensitive malware only in private org account.

Tool detail →

Section 5 of 10

Breach exposure awareness

Credential and email exposure checks for defensive notification workflows.

Taught in: cybersecurity fundamentals · soc analyst blue team

cli · Email & breach intelligence

Holehe

Email registered-site discovery.

  1. Use test emails you control
  2. Map account sprawl
  3. Drive password resets/MFA

Work with privacy/legal for employee email checks.

Tool detail →

web · Email & breach intelligence

Have I Been Pwned

Breach exposure for emails and domains.

  1. Domain search for org
  2. Notify affected users
  3. Force reset + MFA

Public breach data — use for defense.

Case: Collection #1 (2019) drove enterprise-wide credential resets and MFA adoption industry-wide.

Tool detail →External ↗

Section 6 of 10

Social media verification

Username/persona corroboration — never harassment or doxing.

Taught in: ethical hacking penetration testing · soc analyst blue team

cli · People & identity

Sherlock

Username enumeration across hundreds of sites.

  1. Confirm username spelling
  2. Run with timeout
  3. Manually verify hits

Authorized impersonation/fraud investigations only.

Tool detail →

cli · People & identity

Maigret

Deep username search with reporting.

  1. Start narrow (--site)
  2. Expand if needed
  3. Export JSON for case file

Same as Sherlock — no targeting private individuals without cause.

Tool detail →

guide · Social media & communities

LinkedIn / professional networks

Validate roles, detect fake exec profiles used in BEC.

  1. Verify profile age/connections
  2. Cross-check company site
  3. Report impersonation

Scraping may violate ToS — manual review for fraud cases.

Case: BEC often uses look-alike domains + fake LinkedIn profiles — combine email auth (DMARC) with user training.

Section 7 of 10

Image and media verification

Provenance, reverse search, and deepfake triage.

Playbook →

Taught in: soc analyst blue team · digital forensics incident response

cli · Image, media & deepfakes

ExifTool

Metadata extraction for images/video/PDF.

  1. Extract EXIF
  2. Check GPS/device
  3. Strip before republishing

Victim media requires legal chain of custody.

Tool detail →

guide · Image, media & deepfakes

Reverse image search

Google Lens / Bing Visual Search / TinEye for provenance and duplicate detection.

  1. Upload image
  2. Find earliest appearance
  3. Correlate with EXIF and shadows

Verify before accusing — deepfakes break simple reverse search.

Case: Misinformation campaigns often reuse old disaster photos — reverse search debunks quickly.

External ↗

guide · Image, media & deepfakes

AI-generated image signals

Combine metadata, noise patterns, anatomical errors, and detector tools (e.g. hive moderation API, academic detectors) — no single tool is perfect.

  1. Check EXIF/software field for AI generators
  2. Look for inconsistent lighting, fingers, text in image
  3. Run authorized detector API on sample
  4. Correlate with source account history

Detectors false-positive — use for triage not sole evidence.

Case: 2024–2025 deepfake fraud cases combined voice clone + fake ID photos — defense uses multi-factor verification.

Section 8 of 10

Digital footprint analysis

Reduce your org’s public attack surface using the same sources adversaries use.

Taught in: cybersecurity fundamentals · cloud security · web application security

cli · People & identity

Sherlock

Username enumeration across hundreds of sites.

  1. Confirm username spelling
  2. Run with timeout
  3. Manually verify hits

Authorized impersonation/fraud investigations only.

Tool detail →

cli · People & identity

Maigret

Deep username search with reporting.

  1. Start narrow (--site)
  2. Expand if needed
  3. Export JSON for case file

Same as Sherlock — no targeting private individuals without cause.

Tool detail →

cli · Domain, DNS & certificates

theHarvester

Emails, hosts, and names from public search engines and APIs.

  1. Passive sources only
  2. Merge with subfinder
  3. Remove false positives

Scoped domain only.

Tool detail →

web · Domain, DNS & certificates

DNSDumpster

DNS map and subdomain hints.

  1. Run for your domain
  2. Compare to internal CMDB
  3. Fix shadow DNS

Passive.

Tool detail →

web · Domain, DNS & certificates

SecurityTrails

Historical DNS and subdomain intelligence.

  1. Baseline history
  2. Detect hijack or dangling records

Commercial API — use for owned assets.

Tool detail →

web · Infrastructure & exposure

Censys

Certificates and internet-wide host data.

  1. Query org name/ASN
  2. Open tickets for unexpected ports

Research platform — not authorization to exploit findings.

Tool detail →

web · Infrastructure & exposure

Shodan

Search engine for internet-connected devices (use org account filters).

  1. Monitor org IP ranges
  2. Alert on new exposures

Monitor what you own; don't probe random IPs.

Case: Repeated ransomware entry via exposed RDP/VPN found via exposure search — fixed by firewall + MFA.

Tool detail →External ↗

web · Infrastructure & exposure

VirusTotal

Multi-engine file/URL/domain reputation.

  1. Hash lookup from SIEM
  2. Pivot on related files in enterprise VT

Upload policy — sensitive malware only in private org account.

Tool detail →

Section 9 of 10

Investigation documentation

Sources, timestamps, confidence, and remediation recommendations.

Playbook →

Taught in: ethical hacking penetration testing · soc analyst blue team

collection · Frameworks & automation

OSINT Framework

Tree of OSINT resources by category (username, email, transport, etc.).

  1. Select category
  2. Open tool
  3. Document result in case notes

Framework links to third parties — scope and ToS apply.

External ↗

desktop · Frameworks & automation

Maltego CE

Graph-based link analysis.

  1. Seed entity (domain)
  2. Run passive transforms
  3. Export graph for report

Transforms may hit third-party APIs — mind quotas and ToS.

Tool detail →

cli · Frameworks & automation

SpiderFoot

Automated modular OSINT scans (self-hosted).

  1. Define target scope
  2. Enable passive modules only first
  3. Review correlation tab

Self-host in lab network; scope written approval.

Tool detail →

cli · Frameworks & automation

Recon-ng

Modular recon console.

  1. Create workspace
  2. Load domain module
  3. Export to CSV

Engagement-scoped.

Tool detail →

guide · Start here

Where bug hunters practice (legal)

Scoped programs, VDPs, and CTFs — attackers find info via the same OSINT you use defensively.

  1. Read scope
  2. Passive recon only if allowed
  3. Report via platform

No program = no testing.

External ↗

guide · Start here

Where enthusiasts start

CYNARKS roadmap + in-browser labs → PortSwigger → TryHackMe → scoped bounty.

  1. Complete fundamentals
  2. Build home lab
  3. Join CTF
  4. Apply for junior SOC/AppSec roles

Ethics and authorization first — reputation follows.

Test concepts in Quizzes (search OSINT) and Playbooks.