Skip to main content

OSINT

Open-source intelligence reference: how to collect, verify, and analyze publicly available information about people, organizations, and infrastructure, and how defenders limit what can be discovered about them.

This category is written in the two-track format (Offensive / Defensive), with an additional section ## Pentest and Red Team Application in every file that ties the technique to authorized offensive engagements.

CAUTION

Authorized use only. All material is provided for educational purposes and authorized testing.
See ../SECURITY.md for the full policy.

Scope​

  • OSINT methodology: collection planning, source evaluation, verification.
  • People search: identity resolution, social media, public records.
  • Infrastructure OSINT: domains, certificates, DNS, cloud assets, Shodan/Censys.
  • Social media and content: platform-specific collection, geolocation, media forensics.
  • Corporate and business OSINT: corporate registries, filings, employee mapping, supply chain.

Subcategories​

#SubcategoryFilesFocus
01OSINT Methodology4Collection planning, source evaluation, verification
02People Search4Identity resolution, social media, public records
03Infrastructure OSINT0Domains, certificates, DNS, cloud assets, Shodan/Censys
04Social Media and Content0Platform-specific collection, geolocation, media forensics
05Corporate and Business OSINT0Corporate registries, filings, employee mapping, supply chain

Format​

Files in this category follow the two-track skeleton plus one OSINT-specific section:

## 1. Overview
## 2. Reconnaissance / Collection
## 3. Common Attack Vectors
## 4. Exploitation Recipes
## 5. Post-Exploitation
## 6. Preventive Controls
## 7. Detection Controls
## 8. Verification
## 9. Pentest and Red Team Application
## 10. Legal and Ethical Notes
## 11. Production Notes
## 12. References

The Offensive track covers sections 2-5 (collection through post-exploitation). The Defensive track covers sections 6-8 (preventive controls, detection, verification). Section 9 ties the technique to authorized offensive engagements. Section 10 covers jurisdiction, consent, and legal boundaries - OSCP does not cover OSINT, so the exam-notes section is replaced by legal notes.

  • APPLICATIONS - web application security and API testing.
  • INFRASTRUCTURE - infrastructure attack and defense.
  • CLOUD - cloud security and asset discovery.
  • INFORMATION_SECURITY - governance, risk, compliance.
  • CTI (planned) - threat intelligence that consumes OSINT sources.

Authorized Use Only​

The techniques in this category are for authorized security testing, CTF environments, and educational purposes only. Do not use them against people or systems you do not own or have explicit written permission to investigate. OSINT collection about individuals may be subject to privacy law in your jurisdiction (GDPR, CCPA, and others). See SECURITY.md in the repository root.

References​