What is OSINT?
Open Source Intelligence (OSINT) refers to the collection and analysis of information gathered from public sources to be used in an intelligence context. In cybersecurity and investigations, OSINT tools help professionals discover publicly available information that might be valuable for threat intelligence, digital investigations, or penetration testing.
OSINT has become a critical component of modern cybersecurity operations, enabling organizations to proactively identify threats, monitor digital footprints, and conduct thorough investigations without relying on classified or proprietary information sources.
Table of Contents
Maltego
Data Visualization & Link AnalysisMaltego is a comprehensive tool for graphical link analyses that offers real-time data mining and information gathering. It visualizes complex networks of relationships between people, groups, websites, domains, and more through an intuitive graph-based interface.
Key Features
- Interactive graph-based data visualization with real-time updates
- Over 60 integrated data sources including social media, DNS records, and public databases
- Automated correlation of information across multiple data points
- Custom transform development capabilities for specialized investigations
- Collaboration features for team-based investigations
Shodan
Search Engine for Connected DevicesShodan is a specialized search engine that indexes Internet-connected devices and services. It's often described as "the search engine for Internet of Things" and is invaluable for discovering exposed devices, services, and vulnerabilities across the global Internet.
Key Features
- Real-time device discovery with detailed service information
- Advanced filtering by location, organization, product, and vulnerability
- Vulnerability detection and exposure assessment
- Monitoring capabilities for specific devices or networks
- API access for automated querying and integration
theHarvester
Email & Domain Information GatheringtheHarvester is a simple yet powerful tool designed to gather emails, subdomains, hosts, employee names, open ports and banners from different public sources like search engines, PGP key servers, and SHODAN. It's perfect for the initial reconnaissance phase of penetration tests.
Key Features
- Multiple data source integration including Google, Bing, LinkedIn, and more
- Passive reconnaissance without direct interaction with target
- CSV and XML output formats for easy data processing
- Integration with Shodan and DNS dumpster for expanded intelligence
- Lightweight Python-based tool with easy installation
Recon-ng
Web Reconnaissance FrameworkRecon-ng is a full-featured web reconnaissance framework written in Python. It provides a powerful environment for conducting open-source web-based reconnaissance quickly and thoroughly, with a modular approach similar to the Metasploit Framework.
Key Features
- Modular framework with numerous modules for different reconnaissance tasks
- Interactive workspace management for organized investigations
- Database support for storing and correlating results
- API integration with various services for automated data gathering
- Custom module development for specialized reconnaissance needs
SpiderFoot
Automated OSINT CollectionSpiderFoot is an open-source intelligence automation tool that integrates with just about every data source available and automates OSINT collection on IP addresses, domain names, email addresses, and more. It's designed for both offensive and defensive security operations.
Key Features
- Over 200 modules for comprehensive data collection
- Web-based UI and CLI interface for different user preferences
- Advanced data correlation and analysis capabilities
- Reporting in multiple formats including HTML, CSV, and JSON
- API access for integration with other security tools
ExifTool
Metadata ExtractionExifTool is a platform-independent Perl library plus a command-line application for reading, writing, and editing meta information in a wide variety of files. It's crucial for analyzing photos and documents in investigations to extract hidden metadata.
Key Features
- Extracts EXIF, GPS, IPTC, XMP, and other metadata from files
- Supports hundreds of file formats including images, documents, and videos
- Batch processing capabilities for large collections
- Geolocation data extraction from photos with GPS information
- Cross-platform compatibility (Windows, macOS, Linux)
Google Dorks
Advanced Search QueriesGoogle Dorking, also known as Google Hacking, uses advanced search operators to find specific information not readily available through normal searches. It's a technique rather than a tool, but essential for OSINT practitioners to uncover sensitive information exposed online.
Key Features
- Find exposed documents, databases, and configuration files
- Discover vulnerable web applications and misconfigured servers
- Locate sensitive information like passwords, API keys, and personal data
- No installation required - uses standard search engines
- Extensive public database of dorks (Exploit Database)
Social-Engineer Toolkit (SET)
Social Engineering FrameworkSET is an open-source penetration testing framework designed for social engineering. It has numerous attack vectors that allow you to make a believable attack quickly, which is useful for security awareness testing and demonstrating human vulnerabilities.
Key Features
- Spear-phishing attack vectors with customizable templates
- Website attack vectors including credential harvesting and tabnabbing
- Infectious media generator (USB/CD autorun attacks)
- QRCode generator attacks for physical social engineering
- Wireless access point attack vectors
Creepy
Geolocation OSINT ToolCreepy is a geolocation OSINT tool that allows you to gather geolocation related information from social networking platforms and image hosting services about a specific target. It aggregates location data and visualizes it on maps for analysis.
Key Features
- Aggregates geolocation data from multiple social media platforms
- Visualizes data on interactive maps for pattern analysis
- Export results in KML or CSV formats for further analysis
- Supports Twitter, Flickr, Instagram, and other platforms
- Cross-platform application with graphical interface
OSINT Framework
Resource Collection & DirectoryOSINT Framework is a web-based directory of OSINT tools and resources organized by category. It's not a tool itself but an essential collection for investigators to find the right tool for specific needs across the entire OSINT landscape.
Key Features
- Comprehensive collection of OSINT resources and tools
- Categorized by data type, source, and investigation type
- Regularly updated with new tools and resources
- Free and accessible via any web browser
- Includes both free and commercial tool listings