OSINT Masterclass

Open Source Intelligence is intelligence derived from publicly available sources — information that anyone could access without hacking, without breaking any laws, and without requiring special authorisation. The word "open" does not mean "easy to find" — it means "not secret." Court documents, company registrations, satellite imagery, forum posts, and domain registration records are all open source. A skilled OSINT analyst finds in hours what a casual searcher cannot find in weeks.

The critical distinction is between collection and misuse. Finding information that is publicly available is generally legal. What you do with it, and who you target, determines legality. Stalking an individual using OSINT is illegal in every jurisdiction regardless of how the information was obtained. Using OSINT to investigate your own organisation's threat exposure is standard security practice. The same techniques — different legal status depending on purpose and target.

Every website you visit logs your IP address. Every Google search is associated with your account and browser fingerprint. When you investigate a target using your personal browser and home IP, the target's server logs show that someone at your ISP's IP range was looking at their website — and if they are security-aware, they may be able to identify your employer or location. Professional OSINT requires an isolated investigation environment that cannot be traced back to you or your organisation.

This is not about doing anything illegal — it is about maintaining professional integrity and preventing your target from detecting that they are under investigation. A threat actor who knows they are being investigated will change their infrastructure, delete accounts, and disappear. A corporate espionage target who detects due diligence research may tip off their co-conspirators. Investigation integrity requires investigator invisibility.

Google indexes far more than you see on the first page of a normal search. Search operators — special commands that modify how Google processes your query — allow you to surgically extract specific types of information from the entire indexed web. A single well-crafted dork can find exposed configuration files, credentials in repositories, publicly accessible login pages, and sensitive documents that were indexed accidentally.

Google dorking (also called Google hacking) is entirely legal — you are querying publicly accessible information through Google's normal search functionality. The ethical line is what you do with what you find: reporting an exposed credential file to the affected organisation is responsible disclosure; using it to access systems is a crime.

Every internet-facing service has a domain name, and every domain name has DNS records. DNS records are publicly queryable by design — they must be, because the entire internet depends on it. This makes DNS one of the richest and most reliable sources of OSINT on any organisation. Beyond simple A records, DNS reveals: mail servers (MX records), anti-spoofing policies (SPF, DKIM, DMARC), secondary domains, internal naming conventions, hosting providers, and CDN usage.

Certificate Transparency (CT) is the other major pillar of domain OSINT. Every SSL certificate issued by a trusted Certificate Authority must be logged to public CT logs. These logs are searchable and reveal every subdomain that has ever had an SSL certificate issued for it — including internal services, development environments, and long-forgotten test systems. crt.sh aggregates CT logs and is searchable free of charge.

Shodan is a search engine that continuously scans the entire internet and indexes the banners returned by every open port on every IP address. Where Google indexes web pages, Shodan indexes devices — routers, servers, webcams, industrial control systems, printers, medical devices, and anything else with an IP address and an open port. Shodan shows you what services a target is running, what software versions, what SSL certificates, what default banners — all without touching the target.

For OSINT investigators, Shodan answers the question: "What is actually running on this IP address?" For security assessors, it answers: "What attack surface is our organisation exposing?" For threat intelligence, it answers: "Who else is using this same C2 infrastructure signature?"

An email address is the most powerful single identifier in modern OSINT. Unlike a name (many people share names) or a phone number (frequently changed), an email address is unique and persistent — people use the same email address for years and register it across dozens of services. A single email address can unlock: the person's real name, their social media accounts, their professional profile, their shopping habits, data breach records, and sometimes their physical location.

The starting point for email intelligence is format discovery. Most organisations use a consistent email format (firstname.lastname@company.com, firstinitial+lastname@company.com). Once you identify the format from one known employee, you can construct email addresses for any other employee whose name you know.

People reuse usernames. The same handle used on Reddit, GitHub, Twitter, and a gaming forum is often the same person — and collectively those accounts reveal far more about the individual than any single account shows. Username OSINT maps a person's digital identity across platforms, aggregating the information disclosed across all their accounts to build a comprehensive profile.

The most powerful insight from username analysis is information asymmetry — people share different things in different contexts. A person uses their real name professionally on LinkedIn, reveals their political views on Twitter (under a handle they think is not linked), discusses personal problems on Reddit (same handle), and posts their location on a gaming forum (same handle). The OSINT analyst links these contexts and sees the complete picture that the person never intended to present in any single place.

LinkedIn is the most valuable OSINT source for corporate intelligence. People voluntarily disclose their employer, job title, team structure, reporting relationships, technologies they work with, certifications they hold, courses they have completed, and their entire career history. For a security researcher, a threat actor, or a competitor intelligence analyst, LinkedIn is a goldmine.

From LinkedIn alone, an organisation's complete structure can be mapped: executives and their direct reports, the size and composition of the IT/security team, which security tools they use (from job postings and employee skills), which cloud providers they work with, which compliance frameworks they follow, and which vendors they have relationships with. This is the intelligence base from which targeted spear-phishing campaigns are constructed.

Twitter/X is uniquely valuable for real-time intelligence — breaking security incidents, threat actor announcements, researcher disclosures, and geopolitical developments all appear on Twitter before anywhere else. Advanced search operators make Twitter searchable in ways the standard interface does not surface. Reddit contains deep technical discussions, corporate complaints, and community intelligence. Forums (specialised security forums, paste sites, underground communities) are where threat actors communicate and leak information.

Metadata in social posts is often as valuable as the content. Posting times reveal timezone and schedule. The evolution of posts reveals when opinions and situations changed. Location tags (when present) are precise to metres. Photos in posts contain EXIF data (if not stripped) and visual location clues.

A photograph contains vastly more information than most people realise. Even with EXIF metadata stripped, a skilled geolocation analyst can determine where a photo was taken using: visible landmarks, architecture style, vegetation, road markings, signage (even partially visible or in other languages), sun angle and shadow direction, and satellite imagery comparison. This technique was used by Bellingcat to geolocate Russian military equipment in Ukraine, by journalism teams to verify airstrike claims, and by law enforcement to locate kidnapping suspects.

The workflow is systematic: start with the most obvious clues (visible landmarks, unique architecture), narrow to a country or region, then to a city, then to a specific street or building. Each step uses different tools — landmark recognition, satellite imagery, street-level imagery, and local knowledge sources.

Companies are among the most thoroughly documented entities in public records — by legal requirement. Corporate registrations, annual reports, regulatory filings, court documents, and patent applications all contain rich information about a company's operations, finances, relationships, and vulnerabilities. Business OSINT is the primary technique for due diligence, competitive intelligence, and pre-engagement research for security assessments.

The dark web is not a single place — it is a set of networks (primarily Tor, also I2P and Freenet) that require specific software to access and are not indexed by standard search engines. It contains both legitimate privacy tools (used by journalists, activists, and dissidents) and criminal marketplaces, ransomware leak sites, and hacker forums. For security professionals, the dark web is an intelligence source — it provides early warning of breaches, shows what threat actors are discussing, and reveals what stolen data from your organisation is available for sale.

Monitoring the dark web for defensive intelligence is legal in most jurisdictions. What is not legal is purchasing stolen data (receiving stolen goods), communicating with threat actors to facilitate attacks, or accessing services that distribute CSAM. Stay in the intelligence collection lane — observe and report, never transact.

As investigations grow complex — multiple domains, dozens of IP addresses, hundreds of social accounts — keeping track of relationships manually becomes impossible. Maltego is a graph-based link analysis tool that maps relationships between OSINT entities visually. Instead of a spreadsheet of IOCs, Maltego shows you a graph where nodes are entities (domains, IPs, emails, people) and edges are relationships (this IP hosts this domain; this email is registered to this person; this domain is linked to this IP).

Maltego Community Edition is free and includes a significant number of transforms (automated OSINT queries) from VirusTotal, Shodan, PassiveTotal, and others. Professional investigators use the full Maltego platform, but the Community Edition is sufficient to learn the methodology and conduct real investigations.

Operational Security (OPSEC) for investigators answers the question: "What does my target learn about me from my investigation activities?" Every web request you make reaches a server somewhere. Every search engine query is associated with your IP and account. Every social media profile you visit may trigger "profile viewed" notifications. Every DNS query may be logged. The professional investigator plans their OPSEC before beginning collection, not after.

The severity of OPSEC required scales with the risk of the investigation. Researching a publicly traded company's technology stack requires basic VPN + clean browser. Investigating an organised criminal group requires Tor + dedicated VM + separate hardware. Investigating a nation-state-level threat actor requires physical isolation, purpose-built hardware, and potentially Tails OS on air-gapped systems.

An OSINT investigation is only as valuable as its documentation. Your report must stand on its own — a reader who was not present for the investigation must be able to: verify every finding from the sources cited, understand the methodology used, assess the confidence level of each conclusion, and act on the recommendations. Poor documentation means poor credibility and wasted investigation effort.

Responsible disclosure applies when you find security vulnerabilities or exposed sensitive data during OSINT research. The ethical obligation is to notify the affected organisation before making any findings public. This protects the organisation, protects the people whose data is exposed, and builds your reputation as a trustworthy researcher. Document when you found the vulnerability, when you notified the organisation, and what their response was.