Open-Source Intelligence (OSINT) Resources

Open-Source Intelligence (OSINT)

Open-Source Intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context. In the intelligence community, "open" refers to overt, publicly available sources — as opposed to covert or clandestine sources.

In application security and bug bounty hunting, OSINT is the foundation of effective reconnaissance. Before testing a single endpoint, researchers use OSINT techniques to map an organization's attack surface: discovering subdomains through certificate transparency logs, finding exposed credentials in paste sites and code repositories, identifying employee information through social media and job postings, and locating forgotten assets through historical web archives.

OSINT tools and techniques span a broad range — from passive DNS enumeration and search engine dorking to analyzing metadata in public documents and monitoring data breach repositories. Platforms like Shodan and Censys provide internet-wide scan data that reveals exposed services, default configurations, and unpatched systems. GitHub and GitLab searches frequently surface API keys, internal URLs, and configuration files accidentally committed to public repositories.

Effective OSINT requires both technical skills and analytical thinking. The challenge is not just collecting data but correlating information from multiple sources to build actionable intelligence about a target's infrastructure, technology stack, and potential weaknesses.

This page collects OSINT tools, methodologies, and resources for security researchers and bug bounty hunters.

From Wikipedia