Learning paths

OSINT learning path

12 resources, ordered. Work down the list — each stage assumes the one above it.

Open-Source Intelligence (OSINT)

A route through the library rather than a dump of it. Items are drawn from the full OSINT collection, filtered to teaching material (news items are excluded) and ordered within each stage by depth signals — whether the piece carries code, how substantial it is, and what readers actually open.

All OSINT resources → 📖 Read the OSINT guide All learning paths
1

Start here

5 resources

Orientation and first principles — what the bug class is and how it behaves.

  1. Awesome OSINT for Everything
    115 min readgithub.com2026
    Library of OSINT tools and resources for penetration testing, bug bounty, and red team operations. It encompasses categories such as AI, breaches, recon, social media enumeration, domain analysis, and data leak analysis, featuring tools like GreyNoise for IP and CVE searching, Dehashed for breach data, and WhatsMyName for username enumeration. The collection also includes AI-specific tools like AnonChatGPT for anonymous interaction, Decktopus for presentation creation, and Perplexity AI for sourced answers.
  2. Awesome OSINT - A Curated List of OSINT Resources
    58 min readgithub.com2026
    Library: A curated list of open-source intelligence (OSINT) tools and resources for cyber threat intelligence, threat hunting, and OSINT practitioners of all levels. It organizes resources into categories like General Search, Google Dorks, Privacy Focused Search Engines, Data Breach Search Engines, Visual Search, Document Search, Social Networks, Domain and IP Research, and Threat Intelligence. Specific tools mentioned include DorkEye, DorkGenius, DorkGPT, and the Google Hacking Database (GHDB) for Google Dorking, alongside various national and privacy-focused search engines.
  3. OSINT Bible: Comprehensive 2026 Guide
    26 min readgithub.com2026
    Library for responsible OSINT practices, offering a structured 4-step methodology, a tools mind map, and detailed sections on internet search, social networks, geoINT, domain/IP/DNS, and deep/dark web investigations. It covers automation with Python, report templates, legal considerations, and specific tools like Twint-fork, Maigret, Amass, Recon-ng, and SpiderFoot, alongside crucial techniques such as advanced Google Dorking. The resource also includes sections on AI intelligence, facial recognition, data breaches, and cryptocurrency OSINT, with a notable tip to explore Abster Intelligence for local-first evidence organization.
  4. Open Source Intelligence Tools and Resources Collection
    5 min readgithub.com2026
    Collection of Open Source Intelligence tools and resources designed for gathering and analyzing publicly available information. It includes a comprehensive meta-resource, the OSINT Framework, linking to various free tools such as MISP for threat intelligence sharing, SpiderFoot for automating OSINT, Shodan for internet-connected device discovery, urlscan.io for website analysis, Maltego for link analysis, Recon-ng for web reconnaissance, IntelOwl for threat intelligence management, DNS Twister for anti-phishing, Insecam for surveillance camera directories, IP Logger for IP tracking, That's Them for people search, and ImgOps for image analysis.
  5. mosint: An automated e-mail OSINT tool
    1 min readgithub.com2026
    Library for automated email OSINT, Mosint, written in Go, consolidates numerous services to provide fast and efficient investigation of target emails. It supports email verification, social media account checking, data breach scanning, finding related emails and domains, Pastebin dump scanning, Google searches, DNS/IP lookups, and JSON output. Mosint requires API keys and configuration via a YAML file.
2

Build depth

5 resources

Real testing methodology, tooling, and writeups that show the work.

  1. Master Google Dorking: Advanced Techniques for OSINT and Ethical Hacking
    14 min readneospl0it.github.io2026
    Reference listing techniques for Google Dorking, including `site:`, `-` operator for exclusion, exact phrase searching with quotes, `intitle:` for page titles, and `intext:` for body content. These methods are applicable for bug bounty hunting, OSINT, and cybersecurity audits to uncover vulnerabilities like open directories, misconfigured settings, and publicly accessible sensitive information.
  2. OSINT Framework: How to Build a Custom Maltego Transform
    6 min readnetragard.com2026
    Library for creating custom Maltego transforms, integrating the Sherlock OSINT tool to discover social media accounts by username. This library utilizes the `maltego-trx` Python package, allowing developers to define input and output entities, process search results, and provide logging directly within the Maltego interface. The guide details setting up the project, writing the transform logic, and containerizing the solution with Docker for reproducible execution.
  3. Image Analysis and Geolocation with OSINT (OSINT Combine)
    10 min readosintcombine.com2026
    Writeup on OSINT techniques for image geolocation, detailing how visual clues from traffic, buildings, pedestrian attire, and signage, alongside reverse image searching with tools like Google Lens and AI assistance via ChatGPT, can pinpoint an image's location. The analysis highlights identifying distinctive vehicles, architectural styles, national flags, and even police uniforms to confirm a subject's whereabouts, demonstrating a methodical approach to drawing intelligence from visual data.
  4. OSINT Tools for Cybersecurity: A Practical Guide for Security Teams
    7 min readsocradar.io2026
    Library of OSINT tools for cybersecurity teams, categorized by function: Domain and IP Intelligence (Shodan, DNSDumpster), Email and Credential Exposure (Have I Been Pwned, Holehe), People and Social Media Intelligence (Maltego, Sherlock), Dark Web and Paste Site Monitoring (SOCRadar, IntelligenceX), and Metadata and Search Engine Intelligence (Google Hacking Database, ExifTool). It also highlights key websites like osintframework.com and crt.sh, and details a practical investigation workflow emphasizing initial question framing and passive reconnaissance.
  5. Automating Google Dorking: From Manual OSINT Technique to Continuous Monitoring
    3 min readdigitalstakeout.com2026
    Library for automating Google dorking, transforming this manual OSINT technique into a continuous exposure monitoring process. It maintains a query library, schedules regular runs, compares results against a baseline, and alerts on new findings. This approach focuses on content discoverable through search engines, complementing other monitoring methods like social media, domain registration, dark web, and credential breach checks.
3

Go deep

2 resources

Novel research, edge cases, and the techniques that push the class forward.

  1. Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a…
    infosecwriteups.com2026
    Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a Critical Bug A deep technical blog on using phone numbers and email addresses to discover hidden domains,...
  2. Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered
    3 min readunit42.paloaltonetworks.com2026
    Reference detailing the App.MenuItem artifact in macOS Tahoe 26, a new Biome stream logging specific user menu selections. This stream, located at ~/Library/Biome/streams/restricted/App.MenuItem/local and formatted in SEGB, provides granular user intent by recording actions like file compression and trash emptying. Examiners can utilize open-source tools such as ccl-segb to parse this data, offering crucial context for reconstructing user workflows and investigating activities like data exfiltration, when correlated with file system logs.