The Intel Made of Public Information

Open Source Intelligence (OSINT) is the discipline of gathering and correlating publicly available information — search engines, social media, DNS, certifications, job postings, photo metadata — into actionable insight. It is attack preparation for pentesters, a reconnaissance engine for threat-intel teams, and a compliance tool for defenders checking their own exposure. The entire field rests on one fact: attackers do not need a vulnerability if your disclosure is the vulnerability.

The OSINT Toolkit

The workhorse sources: WHOIS (registration and contact records for domains), DNS (subdomain enumeration via certificate transparency logs, dnsrecon, amass — "which hosts exist" is often the crown of a recon), search engines and operator-based dorking (site:target.com filetype:pdf inurl:admin exposed docs), Shodan/Censys/FOFA (scans of everything on the internet — a control panel or database port open to the world is logged there and searchable), social media and job boards (an org revealing its tech stack and internal tooling via job descriptions), GitHub/GitLab (accidentally committed source, keys, internal domain references), and metadata from published documents (PDF author names, internal paths, software versions).

# subdomain discovery via certificate transparency
curl "https://crt.sh/?q=%25.target.example&output=json" | grep -oE '"name_value":[^,]*'

Turning Data into Decisions

OSINT outputs correlation, not just data points. The threat-intel analyst's job is the link: a compromised contractor account on LinkedIn, a leaked internal hostname on a paste site, and an open Shodan port on the same range are the start of "the attackers likely already have a foothold here". For the defender, OSINT is your own self-audit — run the same searches against your brand, domains and staff that an attacker would, publish the exposure list, and let the discovery drive hardening (disable the exposed port, rotate the leaked key, re-train the repeat phisher).

The Ethical and Legal Line

Here is the boundary that stops the curse: OSINT is information you are allowed to see — public records, indexed pages, consenting users' posts. It turns illegal the moment you cross into what is not public or not authorized: scraping behind a login, hacking a password-protected archive, interrogating an employee, or collecting personal data that exposure of another person (in most jurisdictions, that second-hand PII becomes regulated data). Every OSINT engagement needs scope and authorization written (the pen-testing lesson's rules of engagement), and "it was public" is no legal defense at all — public-and-sensitive is still regulated when it is personal data.

The Practitioner Discipline

OSINT rewards method, not speed. Document every step (your chain of evidence is the report); preserve raw data before interpretation (screenshots and original responses, not your summary); and re-verify at the source the information you plan to act on — a single stale posting can send a whole investigation down a wrong path. Properly bounded, OSINT is the highest-value per dollar in security: it costs a search engine and a URL, and it routinely identifies the exact tree on which the whole forest will be attacked. Build the discipline into the defenders calendar — a half-day per quarter re-running the same queries against your own estate is the cheapest attacker-simulation exercise an organization runs, and the artifacts it produces (the exposed-host list, the leaked-credential scan, the impersonating-domain report) are exactly the items the incident-response team reaches for when the real investigation starts.