OSINT (Open Source Intelligence): Meaning, Tools and Research

What Does OSINT Mean?

OSINT stands for open source intelligence. Here, "open source" means open, public sources. The term has nothing to do with open source software. "Intelligence" means insight gained through research.

The term comes from the military and intelligence services. There, OSINT is one of several types of intelligence, next to HUMINT (information from people) and SIGINT (intercepted signals), for example. Today, companies, public bodies, journalists and security researchers use OSINT too.

Note: OSINT is more than a web search. Only checking, linking and rating the findings turns them into useful knowledge.

Common OSINT Sources

Websites and Search Engines

Company websites, blogs and job ads reveal a lot. A job ad often names the software in use. With advanced search commands, known as Google dorks, you can find certain file types or pages.

Social Networks

Business and private profiles show names, roles, contacts and sometimes photos from the office. From this, you can work out who reports to whom and how email addresses are built.

Public Registers

Company registers, patent databases and official records give facts on firms, their heads and their owners.

Technical Sources

DNS records, WHOIS data and public certificate logs (certificate transparency) show domains, subdomains and servers. Special search engines list devices and services that can be reached from the internet.

News, Forums and Code

Press reports, forums and public code stores often hold details. Sometimes even passwords or keys end up there by mistake.

Metadata

PDF, Word or image files often store author names, software versions or location data. Whoever publishes them also gives away this data.

The OSINT Cycle

Good OSINT work follows a set process. It is based on the cycle used by intelligence services:

1. Planning: set the question, the goal and the limits of the research.
2. Collection: gather information from suitable sources.
3. Processing: sort the data and remove duplicates.
4. Analysis: check findings, compare them with other sources and rate them.
5. Sharing: report the results clearly and derive measures.

After that, the cycle often starts again, with new questions from the results.

OSINT in IT Security

• Check your own attack surface: which systems can be reached from the internet? Are there forgotten subdomains? See attack surface management.
• Find leaked credentials: do staff passwords show up in data leaks? See dark web monitoring.
• Rate the phishing risk: how easy is it to collect names, roles and email addresses for spear phishing?
• Understand threats: what are attacker groups planning, and which weak spots do they use? OSINT is a key source for threat intelligence.
• Penetration tests: many tests start with research. The testers first collect public facts about the target.

An example: a company has an outside team check what is publicly known about it. The research finds an old test site with outdated software, a job ad naming the exact firewall version and, in a data leak, the credentials of a sales rep. All three issues can be fixed quickly, before an attacker uses them.

Other Uses

• Journalism: newsrooms check photos and videos and rebuild events.
• Investigations: police and private investigators look for clues about people and networks.
• Due diligence: before a deal or a partnership, companies check who they are dealing with.
• Market analysis: companies watch competitors, trends and customer opinions.

Well-Known OSINT Tools

• theHarvester: collects email addresses, subdomains and host names from public sources.
• Shodan: a search engine for devices and services that can be reached from the internet.
• Maltego: shows links between people, domains and companies as a graph.
• SpiderFoot: automates research across many sources.
• OSINT Framework: a website that sorts many tools and sources by category.

Tools make the work easier, but they do not replace your own judgment. Every finding must be checked. The SecTepe product SnapScan reads open sources and finds the subdomains and network ranges of a company.

OSINT Research: Legal Limits

Researching public information is allowed in general. But there are clear limits:

• Data protection: personal data falls under the GDPR even when it is public. Only collect what you need for the purpose, and delete it afterwards.
• Do not get around access controls: guessing passwords or bypassing protection is no longer OSINT and can be a criminal offense.
• No deception: fake profiles used to join closed groups are risky, both legally and ethically.
• Agree on the scope: when you research for others, set the goal and scope in writing.

Challenges

• Too much data: the amount of information is huge. Without a clear question, you get lost.
• False information: not everything online is true. A second source should confirm each finding.
• Outdated data: information changes. What was true yesterday can be wrong today.
• Leaving traces: research also leaves traces, for example in server logs. Passive methods attract less attention.

Conclusion

OSINT gains knowledge from public sources. Attackers use it to prepare attacks. That is why companies should use it themselves and check on a regular basis what is known about them. A clear question, checked findings and respect for legal limits are what count.