Skip to content

Latest commit

 

History

History
296 lines (225 loc) · 18.4 KB

README.md

File metadata and controls

296 lines (225 loc) · 18.4 KB
description
Open Source Intelligence

OSINT

Intro

The focus of this section is to provide helpful resources for OSINT and Passive reconnaissance on a given target. There will be certain tools and sites you might be familiar with that could be applicable in this section, that I have omitted and with good reason.

  1. This section is "Passive" recon, which does not entail touching or interacting with your target in any way. For offensive operations, staying off radar is key. But can we check with other sources that may have already scanned out target? You bet.
  2. There are many research tools that provide similar output to the ones listed in the later sections. The ones that I have specifically omitted (and will document in another section) are tailored more to defensive operations and contain information like reputation data and historical activity.

OSINT Resources

OSINT Guides and Methodology

Specific for what you need to look for and how to find it, during the passive recon phase of a penetration test, or the proper way to OSINT.

OSINT training courses.
OSINT CTFs and Modules
Youtube Channels and Web Casts
OSINT communities and thier resources
  • OSINTCurious - Great community and training for those who are interested in OSINT skills and tools.
  • OSINT Techniques Blog - Fantastic site with tool lists, video guides, and blog on the latest techniques.
  • Osintion - OSINT and Social Engineering master Joe Grey's website. Resources, OSINT Courses, and consultation services.
  • OSINT Dojo - A project that provides those new to OSINT a number of free resources and simple challenges that build on one another to provide a simple road map for learning more about the field and polishing up related skills while also earning badges to show off your hard work.
  • Bellingcat's OSINT How-To - Bellingcat is a collective of researchers and journalists that use OSINT tools and techniques for a variety of purposes and that have come together to share thier latest and greatest tools and techniques. They have a slow of guides for researching specific things with OSINT.
  • Aware-Online - Aware Online is a Netherlands based training institute specialized in providing training in the field of Open Source intelligence (OSINT) and Social Media Intelligence (SOCMINT).
  • https://exposingtheinvisible.org/ - Exposing the Invisible is a project of Tactical Tech, an international NGO that engages with citizens and civil-society organizations to explore and mitigate the impacts of technology on society.
OSINTer Blogs

All of these are fantastic resource. Check them regularly for new tools and techniques.

Forums/Groups/Chatrooms

Forums

Discord/Slack

Volunteer OSINT

There are a few interesting organizations out there that take OSINT researchers and have them help with certain public good tasks like finding missing children or stopping pedophiles. It can be a heavy ask but can really do some good in the world with the skills that we have. Please check out and If you can donate some time to help, please do!

OSINT Tools

OSINT Tool and Resource Collections

These are misc tools and collections out there. Many overlap, but there are fantastic things in each.

OSINT Virtual Machines
Frameworks
  • https://nitinpandey.in/ihunt/# - Detailed OSINT framework with dozens of tools grouped by purpose.
  • osrframework - This package contains a set of libraries developed by i3visio to perform Open Source Intelligence tasks. They include references to a bunch of different applications related to username checking, DNS lookups, information leaks research, deep web search, regular expressions extraction and many others.
  • Scrummage — Ultimate OSINT and Threat Hunting Framework
  • Mr.Holmes — osint toolkit for gathering information about domains, phone numbers and social media accounts

{% content-ref url="../../red-offensive/scanning-active-recon/recon-frameworks.md" %} recon-frameworks.md {% endcontent-ref %}

Tools by Category

{% content-ref url="search-engines/" %} search-engines {% endcontent-ref %}

{% content-ref url="cyber-search.md" %} cyber-search.md {% endcontent-ref %}

{% content-ref url="dark-web-search.md" %} dark-web-search.md {% endcontent-ref %}

{% content-ref url="ip-address.md" %} ip-address.md {% endcontent-ref %}

{% content-ref url="domain.md" %} domain.md {% endcontent-ref %}

{% content-ref url="username-email.md" %} username-email.md {% endcontent-ref %}

{% content-ref url="name-phone-gov-record.md" %} name-phone-gov-record.md {% endcontent-ref %}

{% content-ref url="socmint-social-media.md" %} socmint-social-media.md {% endcontent-ref %}

{% content-ref url="files-media-breach-paste-code.md" %} files-media-breach-paste-code.md {% endcontent-ref %}

{% content-ref url="misc-osint.md" %} misc-osint.md {% endcontent-ref %}