appsec.fyi

Open-Source Intelligence (OSINT) Resources

Post Share

A curated AppSec resource library covering XSS, SQLi, SSRF, IDOR, RCE, XXE, OSINT, and more.

Open-Source Intelligence (OSINT)

Open-Source Intelligence (OSINT) is data collected from publicly available sources to be used in an intelligence context. In the intelligence community, "open" refers to overt, publicly available sources — as opposed to covert or clandestine sources.

In application security and bug bounty hunting, OSINT is the foundation of effective reconnaissance. Before testing a single endpoint, researchers use OSINT techniques to map an organization's attack surface: discovering subdomains through certificate transparency logs, finding exposed credentials in paste sites and code repositories, identifying employee information through social media and job postings, and locating forgotten assets through historical web archives.

OSINT tools and techniques span a broad range — from passive DNS enumeration and search engine dorking to analyzing metadata in public documents and monitoring data breach repositories. Platforms like Shodan and Censys provide internet-wide scan data that reveals exposed services, default configurations, and unpatched systems. GitHub and GitLab searches frequently surface API keys, internal URLs, and configuration files accidentally committed to public repositories.

Effective OSINT requires both technical skills and analytical thinking. The challenge is not just collecting data but correlating information from multiple sources to build actionable intelligence about a target's infrastructure, technology stack, and potential weaknesses.

This page collects OSINT tools, methodologies, and resources for security researchers and bug bounty hunters.

From Wikipedia

Date Added Link Excerpt
2026-05-06 NEW 2026Best OSINT Tools for Investigations and Threat Intelligence in 2026 beginnerLibrary for OSINT investigations, offering tools like Maltego for relationship mapping, ShadowDragon for social media analysis, VenariX for cyber threat monitoring and ransomware tracking, Arrests.org for public records, Telegago for Telegram monitoring, Shodan for internet-connected device discovery, OSINT Framework for tool discovery, and SpiderFoot for automated data collection. → hackread.com
2026-05-05 NEW 2026GhostTrack Explained: Track IPs Phones and Usernames Easily beginner ReconTool for OSINT reconnaissance, GhostTrack consolidates IP, phone, and username lookup into a single Python script. Version 2.2 on GitHub boasts 8.1k stars and 1.1k forks but shows limited development with only 23 commits and 2 contributors. It targets Debian-based Linux and Termux, pulling data from public APIs for country, ISP, and carrier information. While a useful learning aid, it falls short compared to professional tools like PhoneInfoga and Sherlock, offering less depth on phone details and fewer username targets. Installation issues often stem from urllib3 version conflicts.
2026-04-29 2026The Top 10 OSINT Software Tools for Research and Investigation (2026) beginnerThis article lists the top 10 Open Source Intelligence (OSINT) software tools for research and investigation in 2026. OSINT involves gathering information from publicly available sources. The tools discussed are essential for professionals in cybersecurity, journalism, and law enforcement to conduct effective investigations. While the article provides a comprehensive overview of these tools, it does not mention any specific bug bounty payout amounts.
2026-04-27 2026OSINT Tools for Cybersecurity: A Practical Guide for Security Teams intermediateLibrary of OSINT tools for cybersecurity teams, categorized by function: Domain and IP Intelligence (Shodan, DNSDumpster), Email and Credential Exposure (Have I Been Pwned, Holehe), People and Social Media Intelligence (Maltego, Sherlock), Dark Web and Paste Site Monitoring (SOCRadar, IntelligenceX), and Metadata and Search Engine Intelligence (Google Hacking Database, ExifTool). It also highlights key websites like osintframework.com and crt.sh, and details a practical investigation workflow emphasizing initial question framing and passive reconnaissance.
2026-04-22 2026Master Google Dorking: Advanced Techniques for OSINT and Ethical Hacking intermediateReference listing techniques for Google Dorking, including `site:`, `-` operator for exclusion, exact phrase searching with quotes, `intitle:` for page titles, and `intext:` for body content. These methods are applicable for bug bounty hunting, OSINT, and cybersecurity audits to uncover vulnerabilities like open directories, misconfigured settings, and publicly accessible sensitive information.
2026-04-22 2026Lessons from Building an Online Toolkit to Aid Open-Source Investigations intermediateToolkit for open-source investigations, built collaboratively by Bellingcat volunteers, offers detailed guides, limitations, and pricing for research tools. This resource addresses challenges faced by journalists, such as navigating tool discovery and ensuring information remains current, even after tools like Twint and Crowdtangle were discontinued. The toolkit emphasizes clear, accurate documentation, identifies potential weaknesses alongside usefulness, and fosters iterative development based on user feedback, highlighting the success of a collaborative, user-focused approach in the field of investigative journalism.
2026-04-22 2026IntelTechniques Books (Michael Bazzell) beginnerBook detailing OSINT techniques and self-reliance, updated for 2024. The 11th edition focuses on creating local investigative resources, including custom search tools and a Debian Linux OSINT virtual machine. It covers 47 chapters on virtual machine setup, search engines, social networks (Facebook, Instagram, TikTok, LinkedIn, YouTube), data leaks, breaches, and methodology. Digital purchases include downloadable scripts, cheat sheets, and a command to build a complete OSINT VM.
2026-04-22 2026Epieos: The Ultimate OSINT Tool beginnerEpieos: The Ultimate OSINT Tool
2026-04-22 2026Bellingcat's Online Investigation Toolkit beginnerBellingcat's Online Investigation Toolkit
2026-04-22 2026Automating Google Dorking: From Manual OSINT Technique to Continuous Monitoring intermediateLibrary for automating Google dorking, transforming this manual OSINT technique into a continuous exposure monitoring process. It maintains a query library, schedules regular runs, compares results against a baseline, and alerts on new findings. This approach focuses on content discoverable through search engines, complementing other monitoring methods like social media, domain registration, dark web, and credential breach checks.
2026-04-22 2026mosint: An automated e-mail OSINT tool beginnerLibrary for automated email OSINT, Mosint, written in Go, consolidates numerous services to provide fast and efficient investigation of target emails. It supports email verification, social media account checking, data breach scanning, finding related emails and domains, Pastebin dump scanning, Google searches, DNS/IP lookups, and JSON output. Mosint requires API keys and configuration via a YAML file.
2026-04-22 2026Telegram-OSINT: In-depth repository of Telegram OSINT resources beginnerLibrary of Telegram OSINT resources, including blogs detailing techniques like VM builds and chat analysis, browser extensions for scraping and searching, and tools for geolocalization, data analysis, and phone number checking, alongside a comprehensive list of Telegram bots for various investigative purposes.
2026-04-22 2026Email-Username-OSINT Toolbox beginnerLibrary of OSINT tools and techniques for discovering email addresses and usernames. It details numerous resources like Any Mail Finder, GHunt, Haveibeenpwned, Hunter.io, Maigret, Sherlock, and WhatsMyName, alongside methods like manipulating URLs, altering usernames (e.g., O to 0), and leveraging Google advanced search for effective data aggregation.
2026-04-22 2026Awesome OSINT for Everything beginnerLibrary of OSINT tools and resources for penetration testing, bug bounty, and red team operations. It encompasses categories such as AI, breaches, recon, social media enumeration, domain analysis, and data leak analysis, featuring tools like GreyNoise for IP and CVE searching, Dehashed for breach data, and WhatsMyName for username enumeration. The collection also includes AI-specific tools like AnonChatGPT for anonymous interaction, Decktopus for presentation creation, and Perplexity AI for sourced answers.
2026-04-19 2026OSINT Framework: How to Build a Custom Maltego Transform intermediateLibrary for creating custom Maltego transforms, integrating the Sherlock OSINT tool to discover social media accounts by username. This library utilizes the `maltego-trx` Python package, allowing developers to define input and output entities, process search results, and provide logging directly within the Maltego interface. The guide details setting up the project, writing the transform logic, and containerizing the solution with Docker for reproducible execution.
2026-04-19 2026Top 10 OSINT Tools, Products & Solutions — SocialLinks beginnerLibrary of top OSINT tools for 2025, including SL Crimewall for comprehensive data extraction across 500+ sources, i2 for advanced data visualization and risk mitigation, Sayari Graph for supply chain and counterparty due diligence, Logically Intelligence for AI-driven data reliability and cross-platform analysis, and Spokeo for researching individuals across billions of records.
2026-04-19 2026OSINT Industries — Online Investigations Platform beginnerPlatform for online investigations that aggregates data from 1500+ sources, including social media, messaging apps like WhatsApp and Telegram, and lifestyle apps like Strava and Airbnb. It offers real-time data retrieval, geospatial visualization of digital footprints, and an interactive timeline of online activity. The platform can identify linked accounts for email addresses or phone numbers, flags data breached from services like haveibeenpwned.com, and allows data export in PDF, DOC, EXCEL, or JSON formats, with API access for integration into existing workflows.
2026-04-19 2026OSINT Tools Security Analysts Should Know for 2025 beginnerLibrary for OSINT analysts, detailing tools and techniques for 2025. It covers metadata extraction with Metagoofil and ExifTool, advanced Google Dorking for uncovering exposed information, and people/social media intelligence platforms like Liferaft, AlertMedia, and Skopenow for operationalizing data. The library also addresses misinformation detection, including deepfake analysis using HyperVerge and Intel's FakeCatcher, alongside AI-driven tools for audio and video synthesis.
2026-04-17 2026Geolocation 101: image-based OSINT tips beginnerReference listing OSINT image geolocation techniques and tools such as Google Images, TinEye, and EXIF analysis. It details how to verify image authenticity by checking for manipulation, identifying original sources through reverse image searching, and analyzing visual cues like landmarks, shadows, and metadata. The entry also highlights tools like SunCalc, Google Maps, Forensically, FotoForensics, and Silo Image Metadata Viewer for geolocation and manipulation detection.
2026-04-17 2026Image Analysis and Geolocation with OSINT (OSINT Combine) intermediateWriteup on OSINT techniques for image geolocation, detailing how visual clues from traffic, buildings, pedestrian attire, and signage, alongside reverse image searching with tools like Google Lens and AI assistance via ChatGPT, can pinpoint an image's location. The analysis highlights identifying distinctive vehicles, architectural styles, national flags, and even police uniforms to confirm a subject's whereabouts, demonstrating a methodical approach to drawing intelligence from visual data.
2026-04-17 2026spiderfoot: OSINT automation for threat intel (GitHub) intermediatespiderfoot: OSINT automation for threat intel (GitHub)
2026-04-17 2026OSINT Framework: The Ultimate Guide for Ethical Hackers beginnerOSINT Framework: The Ultimate Guide for Ethical Hackers
2026-04-17 2026Spiderfoot vs Maltego for OSINT Research Cases intermediateSpiderfoot vs Maltego for OSINT Research Cases → osintteam.blog
2026-04-17 2026Operational Technology Discovery: ICS OSINT intermediateOperational Technology Discovery: ICS OSINT
2026-04-17 2026Beyond Google: Navigating the Hidden Internet with Shodan and Censys beginnerBeyond Google: Navigating the Hidden Internet with Shodan and Censys
2026-04-17 2026OSINT Gathering Using Censys (Hackers Arise) intermediateTool for OSINT gathering on internet-connected systems, Censys leverages Zmap to provide near real-time data. It allows granular searches using keywords, IP addresses, Boolean operators, and regular expressions within parsed fields like certificate issuers. Censys also employs heuristic "tags" to categorize hosts, enabling specific searches for targets like SCADA systems, as demonstrated with queries for Siemens manufacturers and the modbus protocol, even utilizing boosting to prioritize search terms.
2026-04-17 2026Top 5 OSINT Sources for Pentesting and Bug Bounties (Intel 471) beginnerLibrary for OSINT reconnaissance, detailing top sources like SecurityTrails, Shodan, and Spyse for penetration testing and bug bounties. These tools provide extensive data on external assets, including DNS history, historical WHOIS, ports, subdomains, and website technologies. Specific features highlighted include SecurityTrails' SurfaceBrowser for attack surface mapping and Shodan's device-centric search engine with SSL certificate filtering. Spyse offers a "one-stop-shop" with detailed domain information and various pricing tiers for its services.
2026-04-17 2026sarenka: OSINT tool (Shodan/Censys) (GitHub) intermediateTool for OSINT and attack surface discovery, SARENKA gathers information from Shodan, Censys, and Criminal IP, mapping CVEs to CWEs. It also retrieves local machine data, including installed software and network information, alongside utilities for hash calculation, Shannon entropy, and port scanning. Future plans include more cryptography tools and reconnaissance scripts.
2026-04-17 2026Domain and IP Investigation with OSINT: Complete Guide (OSINTBench) beginnerLibrary for domain and IP investigation using OSINT, covering WHOIS, DNS history, IP geolocation, and ASN analysis. This guide details practical workflows for tracking threat actors, scrutinizing suspicious sites, and mapping infrastructure. Techniques include using tools like `whois`, `dig`, `nslookup`, Security Trails, DomainTools, and scanning databases such as Shodan and Censys to pivot between domains, IPs, and name servers for comprehensive intelligence gathering.
2026-04-17 2026OSINT Techniques & Tools (Imperva) beginnerLibrary for open-source intelligence (OSINT) techniques and tools, detailing how both defenders and attackers leverage publicly available information for security purposes. It covers passive, semi-passive, and active collection methods, highlighting popular tools like Maltego and Spiderfoot. The library also touches on the role of artificial intelligence in enhancing OSINT capabilities and its use in identifying risks such as unpatched software, open ports, and leaked credentials on platforms like GitHub and LinkedIn. → imperva.com
2026-04-17 2026Top OSINT Tools For Dark Web (Brandefense) beginnerTop OSINT Tools For Dark Web (Brandefense)
2026-04-17 2026OSINT Basics: What is Dark Web Intelligence (DARKInt)? beginnerLibrary for dark web intelligence (DARKInt) gathering, complementing open source intelligence (OSINT) by focusing on encrypted and hidden networks. It enables investigators to monitor hacker forums, marketplaces, and other dark web hubs for illicit activity, stolen datasets, and cyber-attack plans, aiding threat intelligence and fraud prevention through techniques like data scraping, deanonymization, content analysis, and cryptocurrency tracking.
2026-04-17 2026Top 15 OSINT Tools in 2025 (OSINT BYLE) beginnerTop 15 OSINT Tools in 2025 (OSINT BYLE)
2026-04-17 2026OSINT 2025: New and updated digital investigative tools beginnerSurvey of over 45 new and updated digital investigative tools for 2025, categorized by AI, Social Media, and Websites. This resource highlights contributions from developers and companies like Cyber Detective and Logan Woodward, and acknowledges insightful newsletters from Jake Creps, Henk van Ess, and Ritu Gill, among others. It also recognizes the efforts of Niko Dekens, Griffin Glynn, Micah Hoffman, Alicja Pawlowska, and Benjamin Strick for their work in the OSINT community.
2026-04-17 2026How to Use the OSINT Framework: Sources, Tools, Steps (BitSight) beginnerLibrary cataloging an OSINT framework that categorizes tools for gathering and organizing open-source intelligence. It details sources like social media and public records, and highlights specific tools such as Maltego, Shodan, theHarvester, and SpiderFoot. The entry also outlines the five core steps of the OSINT process: planning, data collection, processing, analysis, and reporting, while acknowledging how cybercriminals leverage OSINT for phishing, credential harvesting, and reconnaissance.
2026-04-17 2026OSINT Tools And Techniques (Neotas) beginnerGuide to Open Source Intelligence (OSINT) for risk and compliance investigations, detailing how publicly available data from diverse sources like websites, social media, and dark web content can uncover hidden threats, support due diligence, and streamline risk management. It emphasizes OSINT's legal and ethical application, its critical role in regulated industries for demonstrating compliance, and its real-world use cases in financial crime, vendor vetting, reputation monitoring, and AML. The guide highlights the importance of a structured workflow and effective techniques, such as Boolean search operators, to transform raw information into actionable, evidence-grade intelligence.
2026-04-17 2026Complete OSINT Guide 2025: Find Anyone Online beginnerGuide outlining Open Source Intelligence (OSINT) techniques for individuals and professionals, detailing the five phases of an OSINT investigation: defining requirements, source discovery (including layers like personal websites, public records, and digital residue), processing and correlation using timeline construction and network mapping with tools like Maltego, analysis and interpretation of behavioral patterns, and reporting. It also lists essential tools such as Google Dorking, Maltego, SpiderFoot, Social Searcher, Twint, BeenVerified, Spokeo, Pipl, and Dehashed for effective data collection and analysis.
2026-04-16 2026I Participated in a Trace Labs CTF - Now I'm Hooked on OSINT beginnerLibrary of OSINT resources compiled from participation in Trace Labs CTFs and other OSINT challenges. Includes links to training from Trace Labs, SANS (SEC487, SEC537), OSINT Combine, Aware Online, and McAfee Institute, alongside practice platforms like TryHackMe, GeoGuessr, and Europol Trace an Object. Also lists notable OSINT conferences, YouTube channels, books, blogs, and Twitter accounts for further learning and community engagement.
2026-04-16 2026Recon Village - OSINT and Reconnaissance Village at DEF CON 33 beginnerTalks from DEF CON 33's Recon Village cover autonomous video analysis with AI agents to extract OSINT from live streams, building offline OSINT repositories using Knowledge Graphs and RDF to bypass API throttling, and automating cyber threat intelligence extraction from reports into battlecards using LLM agents and ReAct frameworks. Additional topics include Discord OSINT techniques beyond basic searches and profile analysis, and practical challenges of scaling and reducing false positives in AI-driven intelligence gathering.
2026-04-16 2026A Beginner's Guide to OSINT Investigation with Maltego beginnerA Beginner's Guide to OSINT Investigation with Maltego
2026-04-16 2026Social Media Intelligence (SOCMINT) in Modern Investigations beginnerAnalysis of Social Media Intelligence (SOCMINT) details its definition as the process of gathering and interpreting data from social media platforms for actionable insights, highlighting its applications in threat analysis, cybersecurity, and crisis management. It distinguishes SOCMINT from broader Open Source Intelligence (OSINT) by its exclusive focus on social media and online communications, and addresses legal frameworks such as GDPR, Canada's Privacy Act, CALEA, and the UK Investigatory Powers Act, alongside ethical considerations regarding public versus private information and data scraping.
2026-04-16 2026OSINT Challenge in 30: Social Media Geolocation intermediateOSINT Challenge in 30: Social Media Geolocation
2026-04-16 2026Trace Labs OSINT Educational Series beginnerSeries on Open-Source Intelligence (OSINT) covering three progressive levels of training. Level 1 focuses on fundamental data collection, introducing Google Dorking, metadata extraction, and social media footprint scraping. Level 2 builds upon these skills for real-world investigations, emphasizing clear documentation, data verification, and structured workflow execution. Level 3 delves into advanced cybersecurity applications, including geolocation workflows, GEOINT techniques, Personally Identifiable Behavior analysis, OPSEC, and the Berkeley Protocol for high-integrity investigations.
2026-04-16 2026OSINT Investigation Techniques for Missing Person Cases (Trace Labs) beginnerOSINT Investigation Techniques for Missing Person Cases (Trace Labs)
2026-04-16 2026Automated OSINT Techniques for Digital Asset Discovery and Cyber Risk Assessment intermediateAutomated OSINT Techniques for Digital Asset Discovery and Cyber Risk Assessment
2026-04-16 2026Awesome OSINT - A Curated List of OSINT Resources beginnerLibrary: A curated list of open-source intelligence (OSINT) tools and resources for cyber threat intelligence, threat hunting, and OSINT practitioners of all levels. It organizes resources into categories like General Search, Google Dorks, Privacy Focused Search Engines, Data Breach Search Engines, Visual Search, Document Search, Social Networks, Domain and IP Research, and Threat Intelligence. Specific tools mentioned include DorkEye, DorkGenius, DorkGPT, and the Google Hacking Database (GHDB) for Google Dorking, alongside various national and privacy-focused search engines.
2026-04-16 2026OSINT Techniques: Complete List for Investigators beginnerTechniques enumerate 100+ methods for gathering, verifying, and analyzing publicly available information from diverse sources like social media, public records, and multimedia. These passive, non-intrusive OSINT approaches include social media analysis, network mapping, hashtag tracking, profile analysis, and geolocation, focusing on legality, ethics, and transforming raw data into actionable intelligence through verification and cross-referencing.
2026-04-10 2026OWASP OSINT Resources beginnerLibrary of OSINT tools and techniques for cybersecurity professionals, journalists, and researchers. It details resources like Shodan, Censys, Maltego, TheHarvester, Recon-ng, SpiderFoot, OSINT Framework, and Google Dorking for reconnaissance, threat monitoring, and uncovering exposed assets. The entry also covers metadata analysis and social media intelligence tools, offering a structured approach to defining goals, identifying sources, collecting and analyzing data, and documenting findings.
2026-04-10 2026OSINT Framework - GeeksforGeeks beginnerLibrary for Open Source Intelligence (OSINT) techniques, detailing methods like search engine reconnaissance, social media monitoring, and metadata analysis. It highlights tools such as Have I Been Pwned for breach detection, BeenVerified for background checks, Censys and Shodan for internet-scanning and device discovery, Maltego for link analysis, SpiderFoot for automated reconnaissance, and Recon-ng for reconnaissance operations. This resource aids cybersecurity professionals, investigators, and researchers in gathering and analyzing publicly available information. → geeksforgeeks.org
2026-04-10 2026Top 10 OSINT Tools and Software for 2026 beginnerTop 10 OSINT Tools and Software for 2026

Frequently Asked Questions

What is OSINT in cybersecurity?
In cybersecurity, OSINT (Open-Source Intelligence) refers to gathering information from publicly available sources to assess an organization's security posture. This includes discovering subdomains, exposed credentials, employee information, technology stacks, and forgotten assets — all without directly interacting with the target's systems.
What are the best OSINT tools for bug bounty?
Key tools include Shodan and Censys for internet-wide scanning, theHarvester for email and subdomain discovery, SpiderFoot for automated reconnaissance, Maltego for relationship mapping, and Google Dorking for finding exposed files and admin panels. Certificate Transparency logs and GitHub search are also essential.
How is passive recon different from active recon?
Passive recon gathers information without sending any traffic to the target — using public databases, search engines, DNS records, and archived content. Active recon directly interacts with the target through port scanning, directory brute-forcing, and fingerprinting. Passive recon is undetectable; active recon may trigger security alerts.

Weekly AppSec Digest

Get new resources delivered every Monday.