OSINT command center

guide

Where bug hunters practice (legal)

Scoped programs, VDPs, and CTFs — attackers find info via the same OSINT you use defensively.

1. Read scope
2. Passive recon only if allowed
3. Report via platform

No program = no testing.

guide

Where enthusiasts start

CYNARKS roadmap + in-browser labs → PortSwigger → TryHackMe → scoped bounty.

1. Complete fundamentals
2. Build home lab
3. Join CTF
4. Apply for junior SOC/AppSec roles

Ethics and authorization first — reputation follows.

cli

Sherlock

Username enumeration across hundreds of sites.

1. Confirm username spelling
2. Run with timeout
3. Manually verify hits

Authorized impersonation/fraud investigations only.

cli

Maigret

Deep username search with reporting.

1. Start narrow (--site)
2. Expand if needed
3. Export JSON for case file

Same as Sherlock — no targeting private individuals without cause.

cli

theHarvester

Emails, hosts, and names from public search engines and APIs.

1. Passive sources only
2. Merge with subfinder
3. Remove false positives

Scoped domain only.

web

DNSDumpster

DNS map and subdomain hints.

1. Run for your domain
2. Compare to internal CMDB
3. Fix shadow DNS

Passive.

web

SecurityTrails

Historical DNS and subdomain intelligence.

1. Baseline history
2. Detect hijack or dangling records

Commercial API — use for owned assets.

cli

Holehe

Email registered-site discovery.

1. Use test emails you control
2. Map account sprawl
3. Drive password resets/MFA

Work with privacy/legal for employee email checks.

web

Have I Been Pwned

Breach exposure for emails and domains.

1. Domain search for org
2. Notify affected users
3. Force reset + MFA

Public breach data — use for defense.

Case: Collection #1 (2019) drove enterprise-wide credential resets and MFA adoption industry-wide.

guide

Google dorks

Search operators to find indexed sensitive content on your domains.

1. site:yourco.com filetype:env
2. Remove or block indexing
3. Repeat quarterly

Defensive dorking on owned domains is standard ASM practice.

web

Wayback Machine

Historical page snapshots.

1. Find removed admin paths
2. Check for leaked params in old JS

Public archive — use for intel not exploitation.

web

urlscan.io

Safe URL rendering and network capture for triage.

1. Private scan phishing URL
2. Extract IOCs
3. Block at proxy

May notify URL owner on public scans — use private workspace.

web

Censys

Certificates and internet-wide host data.

1. Query org name/ASN
2. Open tickets for unexpected ports

Research platform — not authorization to exploit findings.

web

Shodan

Search engine for internet-connected devices (use org account filters).

1. Monitor org IP ranges
2. Alert on new exposures

Monitor what you own; don't probe random IPs.

Case: Repeated ransomware entry via exposed RDP/VPN found via exposure search — fixed by firewall + MFA.

web

VirusTotal

Multi-engine file/URL/domain reputation.

1. Hash lookup from SIEM
2. Pivot on related files in enterprise VT

Upload policy — sensitive malware only in private org account.

guide

LinkedIn / professional networks

Validate roles, detect fake exec profiles used in BEC.

1. Verify profile age/connections
2. Cross-check company site
3. Report impersonation

Scraping may violate ToS — manual review for fraud cases.

Case: BEC often uses look-alike domains + fake LinkedIn profiles — combine email auth (DMARC) with user training.

cli

ExifTool

Metadata extraction for images/video/PDF.

1. Extract EXIF
2. Check GPS/device
3. Strip before republishing

Victim media requires legal chain of custody.

guide

Reverse image search

Google Lens / Bing Visual Search / TinEye for provenance and duplicate detection.

1. Upload image
2. Find earliest appearance
3. Correlate with EXIF and shadows

Verify before accusing — deepfakes break simple reverse search.

Case: Misinformation campaigns often reuse old disaster photos — reverse search debunks quickly.

guide

AI-generated image signals

Combine metadata, noise patterns, anatomical errors, and detector tools (e.g. hive moderation API, academic detectors) — no single tool is perfect.

1. Check EXIF/software field for AI generators
2. Look for inconsistent lighting, fingers, text in image
3. Run authorized detector API on sample
4. Correlate with source account history

Detectors false-positive — use for triage not sole evidence.

Case: 2024–2025 deepfake fraud cases combined voice clone + fake ID photos — defense uses multi-factor verification.

collection

OSINT Framework

Tree of OSINT resources by category (username, email, transport, etc.).

1. Select category
2. Open tool
3. Document result in case notes

Framework links to third parties — scope and ToS apply.

desktop

Maltego CE

Graph-based link analysis.

1. Seed entity (domain)
2. Run passive transforms
3. Export graph for report

Transforms may hit third-party APIs — mind quotas and ToS.

cli

SpiderFoot

Automated modular OSINT scans (self-hosted).

1. Define target scope
2. Enable passive modules only first
3. Review correlation tab

Self-host in lab network; scope written approval.

cli

Recon-ng

Modular recon console.

1. Create workspace
2. Load domain module
3. Export to CSV

Engagement-scoped.

collection

OSINT Dojo

Community-driven OSINT exercises and methodology.

1. Pick a module
2. Follow passive-only steps
3. Write up IOCs and limits

Training scenarios — stay in fictional or self-owned targets unless stated.

collection

Awesome OSINT (curated list)

Large maintained index of OSINT tools and sites — use as reference, not a scrape-everything checklist.

1. Choose lane (people, DNS, etc.)
2. Verify tool ToS
3. Prefer passive sources

Third-party tools have their own terms; CYNARKS lists for education.

collection

Bellingcat Online Investigation Toolkit

Investigative journalism methods: geolocation, image verification, social corroboration.

1. Verify image/time/place
2. Cross-reference satellite/street imagery
3. Publish responsibly

High-impact OSINT — accuracy and harm reduction matter.

Case: Bellingcat investigations (MH17, Jan 6) relied on open sources + rigorous verification.

collection

Start.me OSINT pages

Bookmark dashboards aggregating OSINT web tools (many analysts maintain private Start.me boards).

1. Clone a starter board
2. Remove tools you don't need
3. Pin your org-approved stack

Bookmarks are not endorsement — validate each tool legally.