Open Source Intelligence (OSINT)

After this lesson, you will be able to: Use OSINT collection, for both defensive recon and red team prep.

OSINT (Open Source Intelligence) is the systematic gathering of publicly available info. Red teams use it to map your attack surface; blue teams use it to anticipate threats.

Prerequisites:Indicators of Compromise

OSINT sources

Search engines (Google, Bing, DuckDuckGo). Social media (LinkedIn for org charts, Twitter for breach announcements). Code (GitHub for leaked secrets). Web archives (Wayback Machine). Domain/cert (crt.sh, censys, shodan). Job postings (tech stack disclosure).

Useful Google dorks

Search operators that turn Google into an OSINT engine:

tsx

site:targetcompany.com filetype:pdf      # all PDFs on their site
site:targetcompany.com "confidential"    # leaked docs
site:linkedin.com/in "Engineering" "TargetCo"  # employee list
site:github.com "TARGETCO" password      # leaked secrets
site:pastebin.com "@targetcompany.com"   # leaked emails

Defensive OSINT

Run the same queries against YOUR org. What's public? What did employees post on LinkedIn? Are there secrets on GitHub? This is your attack surface.

←Indicators of Compromise

Back to Threat Intelligence

Threat Hunting→