Open-Source Intelligence (OSINT)
Open-Source Intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context. In the intelligence community, "open" refers to overt, publicly available sources — as opposed to covert or clandestine sources.
In application security and bug bounty hunting, OSINT is the foundation of effective reconnaissance. Before testing a single endpoint, researchers use OSINT techniques to map an organization's attack surface: discovering subdomains through certificate transparency logs, finding exposed credentials in paste sites and code repositories, identifying employee information through social media and job postings, and locating forgotten assets through historical web archives.
OSINT tools and techniques span a broad range — from passive DNS enumeration and search engine dorking to analyzing metadata in public documents and monitoring data breach repositories. Platforms like Shodan and Censys provide internet-wide scan data that reveals exposed services, default configurations, and unpatched systems. GitHub and GitLab searches frequently surface API keys, internal URLs, and configuration files accidentally committed to public repositories.
Effective OSINT requires both technical skills and analytical thinking. The challenge is not just collecting data but correlating information from multiple sources to build actionable intelligence about a target's infrastructure, technology stack, and potential weaknesses.
This page collects OSINT tools, methodologies, and resources for security researchers and bug bounty hunters.
From Wikipedia
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-08-31 2026 | How I Scraped Most Dark Stores in India — Blinkit, Zepto & Swiggy Instamart intermediate API Sec | This project reverse-engineered the store coordinates and delivery geofences for India's top quick-commerce platforms: Blinkit, Zepto, and Swiggy Instamart. The research reveals these platforms utilize thousands of "dark stores" – small, windowless warehouses strategically located within 2-3 kilometers of customers to enable rapid 10-minute grocery deliveries. An interactive map of these dark stores is available at darkstores.vercel.app. No bounty payout was mentioned. → infosecwriteups.com |
| 2026-08-21 2026 | Identity Abuse Through Trusted Communication Channels beginner 13 min read AuthN Secrets | Analysis of identity abuse through trusted communication channels, including Microsoft Teams and Slack, detailing how threat actors exploit compromised accounts, external federation, and guest access for identity phishing, credential theft, and malware delivery. The report highlights the increasing use of collaboration platforms as an attack surface and provides recommendations for detection and defense against these sophisticated social engineering campaigns. Specific techniques observed include APT29's use of Teams for credential harvesting and attacker-controlled Slack workspaces for adversary-in-the-middle phishing. → unit42.paloaltonetworks.com |
| 2026-08-18 2026 | Git repo forensics: a seven-phase process for investigating suspicious commits intermediate 15 min read | Library automating Git repository investigations into suspicious commits, employing a seven-phase process. It details preserving the repository, collecting platform-held information via a Python script interacting with GitHub and GitLab APIs, and analyzing patches for obfuscation, outbound calls, or CI definition edits. The library also helps validate committer identity against linked accounts, scrutinizes timestamps, verifies signature provenance beyond the "Verified" badge, and determines commit ref inclusion and arrival method, considering repository forks versus mirror clones. |
| 2026-08-17 2026 | The Smart TV in Your LivingRoom Is a Node in the AIScraping Economy news 11 min read AI | Library for analyzing Bright Data's residential proxy network, which utilizes an SDK embedded in consumer applications to turn devices like smart TVs into exit nodes for web scraping. This library details how the SDK functions, its integration with partner apps such as Petflix and PlayWorks, and the implications for users whose devices contribute to AI data collection without full awareness, highlighting the shift from datacenter-based scraping to utilizing residential IP addresses. → blog.includesecurity.com |
| 2026-08-16 2026 | Finding Hidden Internal Apps Through Public Certificate Logs intermediate 2 min read Recon | Reference on finding hidden internal applications via public Certificate Transparency (CT) logs. Tools like Certspotter API and Gungnir monitor CT logs, revealing internal hostnames and applications that were unintentionally exposed during certificate requests. This technique, analogous to Shodan for domains, allows attackers to discover undocumented systems, dev/staging environments, and potentially vulnerable API endpoints, highlighting the importance of private PKI or wildcard certificates for internal domains. |
| 2026-07-11 2026 | Show HN: Osint tool that finds exposed files on domains beginner | This "Show HN" post introduces an OSINT tool designed to discover exposed files on various domains. The tool aids in identifying potentially sensitive information that might be unintentionally accessible via websites. No bug bounty payout amount is mentioned in the provided content. |
| 2026-07-02 2026 | Beyond Canarytokens: Building a DIY Document Tripwire with Passive OS Fingerprinting intermediate 6 min read | Library for building a DIY document tripwire using a Python HTTP listener and passive OS fingerprinting with p0f. This approach enhances CTI, pentest, and red team analysis by enriching standard Canarytoken alerts with detailed callback metadata and inferred operating system characteristics, offering deeper insights into system interactions. → infosecwriteups.com |
| 2026-07-01 2026 | Hacking With Google beginner 5 min read Recon | Writeup on using Google Search for reconnaissance and dorking, detailing techniques to uncover vulnerabilities via specific service versions, identify exposed cloud assets like S3 buckets, and enumerate subdomains. It explains advanced search operators such as quotes, wildcards, `site:`, `-`, `filetype:`, `inurl:`, `intitle:`, and `intext:`, referencing the Google Hacking Database and emphasizing ethical usage within authorized penetration tests and bug bounty programs. → infosecwriteups.com |
| 2026-06-20 2026 | Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a… advanced | Phone Numbers and Emails to Hidden Subdomains: The OSINT Acquisition Pipeline That Uncovered a Critical Bug A deep technical blog on using phone numbers and email addresses to discover hidden domains,... → infosecwriteups.com |
| 2026-06-19 2026 | Unmasking Phishing: Strategies for identifying 0ktapus domains and beyond intermediate 14 min read | Reference detailing strategies for identifying phishing domains, with a focus on the 0ktapus threat actor. It categorizes and analyzes various Document Object Model (DOM) templates used by 0ktapus, providing unique characteristics, example domains, and activity periods for each. This resource aids in detecting known and unknown phishing campaigns by offering a framework for analyzing phishing infrastructure, including techniques for pivoting between landing pages and identifying specific phishing kits like EIGHTBAIT. → wiz.io |
| 2026-06-17 2026 | PrizeBuzz phishing network analysis intermediate 8 min read | Analysis of PrizeBuzz reveals a phishing-as-a-service network operating numerous configurable "prize survey" kits. These kits impersonate nearly 29 brands across the Middle East, Africa, and Latin America, using disposable `.buzz` domains, Cloudflare for evasion, and WhatsApp for distribution. The report details the kit's construction, its brand-cloning capabilities, cloaking techniques, and provides indicators for defenders, specifically mentioning OMT and Coca-Cola impersonations. |
| 2026-06-13 2026 | Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered advanced 3 min read | Reference detailing the App.MenuItem artifact in macOS Tahoe 26, a new Biome stream logging specific user menu selections. This stream, located at ~/Library/Biome/streams/restricted/App.MenuItem/local and formatted in SEGB, provides granular user intent by recording actions like file compression and trash emptying. Examiners can utilize open-source tools such as ccl-segb to parse this data, offering crucial context for reconstructing user workflows and investigating activities like data exfiltration, when correlated with file system logs. → unit42.paloaltonetworks.com |
| 2026-05-05 2026 | GhostTrack Explained: Track IPs Phones and Usernames Easily beginner 6 min read Recon | Tool for OSINT reconnaissance, GhostTrack consolidates IP, phone, and username lookup into a single Python script. Version 2.2 on GitHub boasts 8.1k stars and 1.1k forks but shows limited development with only 23 commits and 2 contributors. It targets Debian-based Linux and Termux, pulling data from public APIs for country, ISP, and carrier information. While a useful learning aid, it falls short compared to professional tools like PhoneInfoga and Sherlock, offering less depth on phone details and fewer username targets. Installation issues often stem from urllib3 version conflicts. |
| 2026-04-29 2026 | The Top 10 OSINT Software Tools for Research and Investigation (2026) beginner | This article lists the top 10 Open Source Intelligence (OSINT) software tools for research and investigation in 2026. OSINT involves gathering information from publicly available sources. The tools discussed are essential for professionals in cybersecurity, journalism, and law enforcement to conduct effective investigations. While the article provides a comprehensive overview of these tools, it does not mention any specific bug bounty payout amounts. |
| 2026-04-27 2026 | OSINT Tools for Cybersecurity: A Practical Guide for Security Teams intermediate 7 min read | Library of OSINT tools for cybersecurity teams, categorized by function: Domain and IP Intelligence (Shodan, DNSDumpster), Email and Credential Exposure (Have I Been Pwned, Holehe), People and Social Media Intelligence (Maltego, Sherlock), Dark Web and Paste Site Monitoring (SOCRadar, IntelligenceX), and Metadata and Search Engine Intelligence (Google Hacking Database, ExifTool). It also highlights key websites like osintframework.com and crt.sh, and details a practical investigation workflow emphasizing initial question framing and passive reconnaissance. → socradar.io |
| 2026-04-22 2026 | Master Google Dorking: Advanced Techniques for OSINT and Ethical Hacking intermediate 14 min read | Reference listing techniques for Google Dorking, including `site:`, `-` operator for exclusion, exact phrase searching with quotes, `intitle:` for page titles, and `intext:` for body content. These methods are applicable for bug bounty hunting, OSINT, and cybersecurity audits to uncover vulnerabilities like open directories, misconfigured settings, and publicly accessible sensitive information. |
| 2026-04-22 2026 | Lessons from Building an Online Toolkit to Aid Open-Source Investigations intermediate 6 min read | Toolkit for open-source investigations, built collaboratively by Bellingcat volunteers, offers detailed guides, limitations, and pricing for research tools. This resource addresses challenges faced by journalists, such as navigating tool discovery and ensuring information remains current, even after tools like Twint and Crowdtangle were discontinued. The toolkit emphasizes clear, accurate documentation, identifies potential weaknesses alongside usefulness, and fosters iterative development based on user feedback, highlighting the success of a collaborative, user-focused approach in the field of investigative journalism. |
| 2026-04-22 2026 | IntelTechniques Books (Michael Bazzell) beginner 5 min read | Book detailing OSINT techniques and self-reliance, updated for 2024. The 11th edition focuses on creating local investigative resources, including custom search tools and a Debian Linux OSINT virtual machine. It covers 47 chapters on virtual machine setup, search engines, social networks (Facebook, Instagram, TikTok, LinkedIn, YouTube), data leaks, breaches, and methodology. Digital purchases include downloadable scripts, cheat sheets, and a command to build a complete OSINT VM. |
| 2026-04-22 2026 | Epieos: The Ultimate OSINT Tool beginner | Epieos: The Ultimate OSINT Tool |
| 2026-04-22 2026 | Bellingcat's Online Investigation Toolkit beginner | Bellingcat's Online Investigation Toolkit |
| 2026-04-22 2026 | Automating Google Dorking: From Manual OSINT Technique to Continuous Monitoring intermediate 3 min read | Library for automating Google dorking, transforming this manual OSINT technique into a continuous exposure monitoring process. It maintains a query library, schedules regular runs, compares results against a baseline, and alerts on new findings. This approach focuses on content discoverable through search engines, complementing other monitoring methods like social media, domain registration, dark web, and credential breach checks. |
| 2026-04-22 2026 | mosint: An automated e-mail OSINT tool beginner 1 min read | Library for automated email OSINT, Mosint, written in Go, consolidates numerous services to provide fast and efficient investigation of target emails. It supports email verification, social media account checking, data breach scanning, finding related emails and domains, Pastebin dump scanning, Google searches, DNS/IP lookups, and JSON output. Mosint requires API keys and configuration via a YAML file. |
| 2026-04-22 2026 | Telegram-OSINT: In-depth repository of Telegram OSINT resources beginner 7 min read | Library of Telegram OSINT resources, including blogs detailing techniques like VM builds and chat analysis, browser extensions for scraping and searching, and tools for geolocalization, data analysis, and phone number checking, alongside a comprehensive list of Telegram bots for various investigative purposes. |
| 2026-04-22 2026 | Email-Username-OSINT Toolbox beginner 1 min read | Library of OSINT tools and techniques for discovering email addresses and usernames. It details numerous resources like Any Mail Finder, GHunt, Haveibeenpwned, Hunter.io, Maigret, Sherlock, and WhatsMyName, alongside methods like manipulating URLs, altering usernames (e.g., O to 0), and leveraging Google advanced search for effective data aggregation. |
| 2026-04-22 2026 | Awesome OSINT for Everything beginner 115 min read | Library of OSINT tools and resources for penetration testing, bug bounty, and red team operations. It encompasses categories such as AI, breaches, recon, social media enumeration, domain analysis, and data leak analysis, featuring tools like GreyNoise for IP and CVE searching, Dehashed for breach data, and WhatsMyName for username enumeration. The collection also includes AI-specific tools like AnonChatGPT for anonymous interaction, Decktopus for presentation creation, and Perplexity AI for sourced answers. |
| 2026-04-19 2026 | OSINT Framework: How to Build a Custom Maltego Transform intermediate 6 min read | Library for creating custom Maltego transforms, integrating the Sherlock OSINT tool to discover social media accounts by username. This library utilizes the `maltego-trx` Python package, allowing developers to define input and output entities, process search results, and provide logging directly within the Maltego interface. The guide details setting up the project, writing the transform logic, and containerizing the solution with Docker for reproducible execution. |
| 2026-04-19 2026 | Top 10 OSINT Tools, Products & Solutions — SocialLinks beginner 9 min read | Library of top OSINT tools for 2025, including SL Crimewall for comprehensive data extraction across 500+ sources, i2 for advanced data visualization and risk mitigation, Sayari Graph for supply chain and counterparty due diligence, Logically Intelligence for AI-driven data reliability and cross-platform analysis, and Spokeo for researching individuals across billions of records. |
| 2026-04-19 2026 | OSINT Industries — Online Investigations Platform beginner 3 min read | Platform for online investigations that aggregates data from 1500+ sources, including social media, messaging apps like WhatsApp and Telegram, and lifestyle apps like Strava and Airbnb. It offers real-time data retrieval, geospatial visualization of digital footprints, and an interactive timeline of online activity. The platform can identify linked accounts for email addresses or phone numbers, flags data breached from services like haveibeenpwned.com, and allows data export in PDF, DOC, EXCEL, or JSON formats, with API access for integration into existing workflows. |
| 2026-04-19 2026 | OSINT Tools Security Analysts Should Know for 2025 beginner 2 min read | Library for OSINT analysts, detailing tools and techniques for 2025. It covers metadata extraction with Metagoofil and ExifTool, advanced Google Dorking for uncovering exposed information, and people/social media intelligence platforms like Liferaft, AlertMedia, and Skopenow for operationalizing data. The library also addresses misinformation detection, including deepfake analysis using HyperVerge and Intel's FakeCatcher, alongside AI-driven tools for audio and video synthesis. |
| 2026-04-17 2026 | Geolocation 101: image-based OSINT tips beginner 7 min read | Reference listing OSINT image geolocation techniques and tools such as Google Images, TinEye, and EXIF analysis. It details how to verify image authenticity by checking for manipulation, identifying original sources through reverse image searching, and analyzing visual cues like landmarks, shadows, and metadata. The entry also highlights tools like SunCalc, Google Maps, Forensically, FotoForensics, and Silo Image Metadata Viewer for geolocation and manipulation detection. |
| 2026-04-17 2026 | Image Analysis and Geolocation with OSINT (OSINT Combine) intermediate 10 min read | Writeup on OSINT techniques for image geolocation, detailing how visual clues from traffic, buildings, pedestrian attire, and signage, alongside reverse image searching with tools like Google Lens and AI assistance via ChatGPT, can pinpoint an image's location. The analysis highlights identifying distinctive vehicles, architectural styles, national flags, and even police uniforms to confirm a subject's whereabouts, demonstrating a methodical approach to drawing intelligence from visual data. |
| 2026-04-17 2026 | spiderfoot: OSINT automation for threat intel (GitHub) intermediate | spiderfoot: OSINT automation for threat intel (GitHub) |
| 2026-04-17 2026 | OSINT Framework: The Ultimate Guide for Ethical Hackers beginner | OSINT Framework: The Ultimate Guide for Ethical Hackers |
| 2026-04-17 2026 | Spiderfoot vs Maltego for OSINT Research Cases intermediate | Spiderfoot vs Maltego for OSINT Research Cases → osintteam.blog |
| 2026-04-17 2026 | Operational Technology Discovery: ICS OSINT intermediate | Operational Technology Discovery: ICS OSINT |
| 2026-04-17 2026 | Beyond Google: Navigating the Hidden Internet with Shodan and Censys beginner | Beyond Google: Navigating the Hidden Internet with Shodan and Censys |
| 2026-04-17 2026 | OSINT Gathering Using Censys (Hackers Arise) intermediate 5 min read | Tool for OSINT gathering on internet-connected systems, Censys leverages Zmap to provide near real-time data. It allows granular searches using keywords, IP addresses, Boolean operators, and regular expressions within parsed fields like certificate issuers. Censys also employs heuristic "tags" to categorize hosts, enabling specific searches for targets like SCADA systems, as demonstrated with queries for Siemens manufacturers and the modbus protocol, even utilizing boosting to prioritize search terms. |
| 2026-04-17 2026 | Top 5 OSINT Sources for Pentesting and Bug Bounties (Intel 471) beginner 9 min read | Library for OSINT reconnaissance, detailing top sources like SecurityTrails, Shodan, and Spyse for penetration testing and bug bounties. These tools provide extensive data on external assets, including DNS history, historical WHOIS, ports, subdomains, and website technologies. Specific features highlighted include SecurityTrails' SurfaceBrowser for attack surface mapping and Shodan's device-centric search engine with SSL certificate filtering. Spyse offers a "one-stop-shop" with detailed domain information and various pricing tiers for its services. |
| 2026-04-17 2026 | sarenka: OSINT tool (Shodan/Censys) (GitHub) intermediate 2 min read | Tool for OSINT and attack surface discovery, SARENKA gathers information from Shodan, Censys, and Criminal IP, mapping CVEs to CWEs. It also retrieves local machine data, including installed software and network information, alongside utilities for hash calculation, Shannon entropy, and port scanning. Future plans include more cryptography tools and reconnaissance scripts. |
| 2026-04-17 2026 | Domain and IP Investigation with OSINT: Complete Guide (OSINTBench) beginner 10 min read | Library for domain and IP investigation using OSINT, covering WHOIS, DNS history, IP geolocation, and ASN analysis. This guide details practical workflows for tracking threat actors, scrutinizing suspicious sites, and mapping infrastructure. Techniques include using tools like `whois`, `dig`, `nslookup`, Security Trails, DomainTools, and scanning databases such as Shodan and Censys to pivot between domains, IPs, and name servers for comprehensive intelligence gathering. |
| 2026-04-17 2026 | OSINT Techniques & Tools (Imperva) beginner 10 min read | Library for open-source intelligence (OSINT) techniques and tools, detailing how both defenders and attackers leverage publicly available information for security purposes. It covers passive, semi-passive, and active collection methods, highlighting popular tools like Maltego and Spiderfoot. The library also touches on the role of artificial intelligence in enhancing OSINT capabilities and its use in identifying risks such as unpatched software, open ports, and leaked credentials on platforms like GitHub and LinkedIn. → imperva.com |
| 2026-04-17 2026 | Top OSINT Tools For Dark Web (Brandefense) beginner | Top OSINT Tools For Dark Web (Brandefense) |
| 2026-04-17 2026 | OSINT Basics: What is Dark Web Intelligence (DARKInt)? beginner 8 min read | Library for dark web intelligence (DARKInt) gathering, complementing open source intelligence (OSINT) by focusing on encrypted and hidden networks. It enables investigators to monitor hacker forums, marketplaces, and other dark web hubs for illicit activity, stolen datasets, and cyber-attack plans, aiding threat intelligence and fraud prevention through techniques like data scraping, deanonymization, content analysis, and cryptocurrency tracking. |
| 2026-04-17 2026 | Top 15 OSINT Tools in 2025 (OSINT BYLE) beginner | Top 15 OSINT Tools in 2025 (OSINT BYLE) |
| 2026-04-17 2026 | OSINT 2025: New and updated digital investigative tools beginner 1 min read | Survey of over 45 new and updated digital investigative tools for 2025, categorized by AI, Social Media, and Websites. This resource highlights contributions from developers and companies like Cyber Detective and Logan Woodward, and acknowledges insightful newsletters from Jake Creps, Henk van Ess, and Ritu Gill, among others. It also recognizes the efforts of Niko Dekens, Griffin Glynn, Micah Hoffman, Alicja Pawlowska, and Benjamin Strick for their work in the OSINT community. |
| 2026-04-17 2026 | How to Use the OSINT Framework: Sources, Tools, Steps (BitSight) beginner 6 min read | Library cataloging an OSINT framework that categorizes tools for gathering and organizing open-source intelligence. It details sources like social media and public records, and highlights specific tools such as Maltego, Shodan, theHarvester, and SpiderFoot. The entry also outlines the five core steps of the OSINT process: planning, data collection, processing, analysis, and reporting, while acknowledging how cybercriminals leverage OSINT for phishing, credential harvesting, and reconnaissance. |
| 2026-04-17 2026 | OSINT Tools And Techniques (Neotas) beginner 14 min read | Guide to Open Source Intelligence (OSINT) for risk and compliance investigations, detailing how publicly available data from diverse sources like websites, social media, and dark web content can uncover hidden threats, support due diligence, and streamline risk management. It emphasizes OSINT's legal and ethical application, its critical role in regulated industries for demonstrating compliance, and its real-world use cases in financial crime, vendor vetting, reputation monitoring, and AML. The guide highlights the importance of a structured workflow and effective techniques, such as Boolean search operators, to transform raw information into actionable, evidence-grade intelligence. |
| 2026-04-17 2026 | Complete OSINT Guide 2025: Find Anyone Online beginner 11 min read | Guide outlining Open Source Intelligence (OSINT) techniques for individuals and professionals, detailing the five phases of an OSINT investigation: defining requirements, source discovery (including layers like personal websites, public records, and digital residue), processing and correlation using timeline construction and network mapping with tools like Maltego, analysis and interpretation of behavioral patterns, and reporting. It also lists essential tools such as Google Dorking, Maltego, SpiderFoot, Social Searcher, Twint, BeenVerified, Spokeo, Pipl, and Dehashed for effective data collection and analysis. |
| 2026-04-16 2026 | I Participated in a Trace Labs CTF - Now I'm Hooked on OSINT beginner 5 min read | Library of OSINT resources compiled from participation in Trace Labs CTFs and other OSINT challenges. Includes links to training from Trace Labs, SANS (SEC487, SEC537), OSINT Combine, Aware Online, and McAfee Institute, alongside practice platforms like TryHackMe, GeoGuessr, and Europol Trace an Object. Also lists notable OSINT conferences, YouTube channels, books, blogs, and Twitter accounts for further learning and community engagement. |
| 2026-04-16 2026 | Recon Village - OSINT and Reconnaissance Village at DEF CON 33 beginner 21 min read | Talks from DEF CON 33's Recon Village cover autonomous video analysis with AI agents to extract OSINT from live streams, building offline OSINT repositories using Knowledge Graphs and RDF to bypass API throttling, and automating cyber threat intelligence extraction from reports into battlecards using LLM agents and ReAct frameworks. Additional topics include Discord OSINT techniques beyond basic searches and profile analysis, and practical challenges of scaling and reducing false positives in AI-driven intelligence gathering. |
| Browse all 124 Open-Source Intelligence (OSINT) resources → | ||
Frequently Asked Questions
- What is OSINT in cybersecurity?
- In cybersecurity, OSINT (Open-Source Intelligence) refers to gathering information from publicly available sources to assess an organization's security posture. This includes discovering subdomains, exposed credentials, employee information, technology stacks, and forgotten assets — all without directly interacting with the target's systems.
- What are the best OSINT tools for bug bounty?
- Key tools include Shodan and Censys for internet-wide scanning, theHarvester for email and subdomain discovery, SpiderFoot for automated reconnaissance, Maltego for relationship mapping, and Google Dorking for finding exposed files and admin panels. Certificate Transparency logs and GitHub search are also essential.
- How is passive recon different from active recon?
- Passive recon gathers information without sending any traffic to the target — using public databases, search engines, DNS records, and archived content. Active recon directly interacts with the target through port scanning, directory brute-forcing, and fingerprinting. Passive recon is undetectable; active recon may trigger security alerts.
Weekly AppSec Digest
Get new resources delivered every Monday.