OSINT basics

In a nutshell OSINT — Open-Source Intelligence — is building a picture of a target purely from information that's already public: search engines, social media, company sites, leaked databases, DNS records. No hacking, no touching the target's systems — just careful looking. It's the quiet first move of almost every real engagement.

Why start here

Two reasons. It's invisible — you're reading public sources, so the target learns nothing (this is passive recon). And it's cheap — a surprising amount is simply out there.

Analogy — a detective before a stakeout. Before watching the house, the detective reads the newspaper archive, public records, and social media. By the time they act, they already know the names, the routine, the weak points — all without knocking on a single door.

What OSINT looks for

• People — names, roles, emails, phones. Emails reveal the format (first.last@company.com), which fuels password-guessing and phishing.
• Infrastructure — domains and subdomains, IP ranges, technologies (a job ad demanding "FastAPI + PostgreSQL" just handed you the stack).
• Leaked data — has an employee's password appeared in a past breach? Have I Been Pwned answers that.
• Metadata — a PDF or photo on the site can carry the author's name, software version, even GPS.

The everyday toolkit

Google dorking — precise, operator-driven searches:

site:example.com filetype:pdf          # PDFs on their site
site:example.com intitle:index.of      # exposed directory listings
site:example.com inurl:admin           # admin panels
"@example.com" -site:example.com       # emails leaked elsewhere

The catch — accuracy and ethics

OSINT is public, but it's still about real people. Two rules: verify (public ≠ true; cross-check before you rely on it) and stay in scope (collecting is usually legal; using it to impersonate or intrude is not, unless the engagement allows it).