OSINT 101: Understanding OSINT, its tools, benefits and risks

OSINT is an essential part of information gathering. In this article, we’ll look at what Open Source Intelligence is, its tools, its benefits and its dangers.

What is OSINT?

OSINT stands for Open-Source Intelligence. It refers to the practice of collecting information from publicly available sources to be used for intelligence purposes. This can include information from the internet, media outlets, social media platforms, and other publicly accessible databases.

Who uses OSINT?

OSINT is used by governments, law enforcement, intelligence agencies, private businesses and other organizations. It is also used by malicious actors, such as ransomware groups. It is important to understand that OSINT is a powerful tool ; but like all tools, it’s not inherently good or bad.

What is OSINT used for?

OSINT is generally used to support decision-making and risk management. Information collected through OSINT can be used to gain insights into security threats, market trends, or even the behavior of individuals and organizations.

It can also be used to verify information that has been obtained through other sources, such as human intelligence (HUMINT) or signals intelligence (SIGINT). This can help to increase the accuracy and reliability of the information, and to ensure that it is not based on false or misleading information.

For governments, OSINT can be a crucial reconnaissance tool in times of war, as seen in the prominent role it plays in the conflict in Ukraine – both off the record and in the public sphere. Some Twitter accounts even specialize in revealing positions and equipment and have thousands of followers, such as @OSINTtechnical.

For the bad guys, OSINT allows the collection of valuable info about a potential target – social security number, social connections, school where the kids go, compromising photos or statements left on the Internet, etc. Such information can fuel a future social engineering attack, or provide blackmail material.

Benefits of OSINT for cybersecurity

One of the primary uses of OSINT is to strengthen the digital security of public and private organizations. In other words, for cybersecurity purposes.

• Threat Intelligence: OSINT is useful for threat intelligence gathering. It provides organizations with a wealth of information on the tactics, techniques, and procedures (TTPs) used by cyber criminals, as well as insights into emerging threats and vulnerabilities. This can be helpful to develop and implement more effective security strategies and countermeasures.
• Incident Response and Forensics: OSINT can also support incident response and forensics investigations. For example, information gathered from social media can be used to identify potential suspects and their motives, as well as to reconstruct the events leading up to a security breach.
• Vulnerability Assessment and Management: OSINT can gather information on vulnerabilities in software and systems, including on known exploits and patches. This is valuable to prioritize vulnerability remediation efforts, and to ensure that systems are secure and up-to-date.
• Phishing and Social Engineering Attacks: Detection and prevention of phishing and social engineering attacks is another use case for OSINT. It can gather information about the techniques attackers use to trick people into revealing sensitive information or downloading malware, or help identify people who are publicly exposed and are weak links to an organization.
• Recon capacity: Some OSINT tools are widely used during the reconnaissance stage of a red team assessment or penetration test. They provide insight into the targeted asset, such as its attack surface and potential weaknesses.

Need OSINT specialists for cybersecurity needs? The Yogosha Strike Force has experts in these matters. Contact us!

Benefits of OSINT for Businesses

OSINT applications are not just about security. Open Source Intelligence can also provide several economic benefits to businesses, including:

• Improved Decision Making, by providing valuable information that can assist decision-making about various aspects of the business, such as marketing strategies, product development and customer service.
• Competitive Advantage, by gathering information about competitors, including their products, marketing strategies and customer feedback. This can be used to gain a competitive advantage and improve the business’s offerings.
• Customer Insights, by gathering info about customers, including their preferences, opinions, and behaviors. This can help to improve the customer experience and increase customer satisfaction. 
• Data Mining, by providing large amounts of data to identify patterns and trends.
• Market Research, by collecting insights about the market, including trends, consumer behavior, and industry developments. This can be used to improve the business’s offerings and stay ahead of the competition.

What tools are used to perform OSINT?

Here is a list of some of the main tools used to do OSINT:

Google	Google’s products – the search engine but also the rest – are a potentially infinite source of public data, assuming you know how to use them. Despite what one might think, not everyone has the skills to use Google in an OSINT way. Some people are specialized in this field, using both Google Dorks and much more sophisticated techniques.
Maltego	A data mining tool that helps to visualize complex relationships between people, organizations, and entities.
Mitaka	A browser extension for searching IP, domain, URL, hash, etc. via the context menu.
SpiderFoot	A reconnaissance tool that automates the process of gathering intelligence on a target by using multiple sources.
BuiltWith	A website profiler tool that shows the technologies and tools used to build a website.
Intelligence X	An OSINT search engine that allows users to search for leaks and info on domains, IP addresses, and email addresses.
Owlint	A French platform that analyzes the Clear, Deep and Dark webs to detect the risk exposure of companies and their staff.
Recon-ng	A reconnaissance tool for information gathering and vulnerability scanning.
theHarvester	A tool for gathering email addresses, subdomains, hosts, employee names, open ports, and banners from various public sources.
Shodan	Shodan is a search engine for internet-connected devices. It allows users to find information about specific systems, including IP addresses, open ports, and services.
Metagoofil	Metagoofil is a tool for extracting metadata from publicly available documents. It can be used to gather information about the authors, companies, and software used to create documents.
ANOZR WAY	A French solution to reduce the human attack surface of an organization. In other words, vulnerabilities of executives and employees.
Searchcode	Searchcode is a code search engine. It allows searching for code snippets across millions of open-source repositories.
Babel X	Babel X is a linguistics and text analytics tool which helps searching for information across the web by location.
Epieos	Epieos is a search engine that de-anonymizes and retrieve all information related to an email address on dozens of websites.
SEON	SEON provides real-time digital, social, phone, email, IP, and device data to detect and fight fraud.
Lampyre	A data analysis multitool for OSINT.
Spokeo	A people search tool that uses reverse search of phone numbers, addresses, emails, etc.
PimEyes	PimEyes is a tool used for reverse image search, which allows to search for information about an image, such as where it has been used or who has uploaded it.

A Reddit member has also put together an extensive list of OSINT tools and databases, which we invite you to check out. The original post was published in r/OSINT, a community of OSINT enthusiasts. This is a good place to start if you want to get started, along with OSINT CTFs such as the ones on TryHackMe or CTFTime. 

What is an OSINT framework?

Publicly available data are legion, and it would be easy to get lost under the amount of information available. To guide and structure their research, OSINT experts therefore use frameworks. An OSINT framework details the tools, methods and processes used during the investigation. One of the best resources on the subject is the well-named site osintframework.com.

What issues may result from OSINT?

As stated earlier, OSINT is an intelligence technique ; a tool that is neither good nor bad. But while it is normal to want to leverage it, one must also be aware of its dangers. OSINT can cause several issues, such as:

• Privacy concerns: Gathering information from publicly available sources can sometimes infringe on individuals’ privacy, especially if sensitive or personal information is disclosed.
• Misinformation: Public information is not always accurate, and relying on unreliable sources can lead to the dissemination of false information.
• Legal issues: Gathering information from certain sources may be illegal or unethical, such as scraping copyrighted material or hacking illegally into private systems. On the other hand, it may be worthwhile to do bug bounty on your systems, to detect vulnerabilities that may lead to data leaks.
• Bias and selective information: OSINT is limited to the information that is publicly available, which may be biased or incomplete, leading to incomplete or inaccurate conclusions.
• Security risks: OSINT can also reveal information that is sensitive or confidential, leading to security risks for both individuals and organizations.

Therefore, it is important to use OSINT in a responsible and ethical manner, taking into consideration the potential issues and limitations of the information obtained. 

Looking to measure the risk to your organization through OSINT? We have the experience you need, from Attack Surface Assessment to pentesting within an OSINT context.