What OSINT is and the tools people actually use

It has become a buzzword and lost most of its meaning along the way. OSINT is not googling with quotation marks, and it isn't having five hundred tools saved in your bookmarks. It's a method.

What OSINT is, in one sentence

Open source intelligence: collecting publicly available information, verifying it, cross-referencing it and turning it into something that supports a decision.

The word that matters is intelligence. A list of subdomains is not intelligence, it's a list. It becomes intelligence when it says something like: "this subdomain exposes an admin panel for a CMS not updated since 2021, and the administrator's email appears in three old breaches".

The cycle, which almost nobody follows

Without this cycle you end up with a folder of screenshots and no conclusion.

1. Requirement. What question needs answering. "Investigate this company" is not a requirement; "what internet-facing surface does this company have and which of its credentials are circulating" is.
2. Collection. The tools part. The most visible phase and the least difficult.
3. Processing. Normalise, deduplicate, discard noise.
4. Analysis. Cross-reference sources, look for contradictions, find the pattern.
5. Dissemination. The report. If it isn't delivered in a format someone can use, the work doesn't exist.

Most people live in step 2 and believe that's OSINT.

The tools, by phase

Infrastructure and domains

• Amass — attack surface mapping and subdomain enumeration. The standard.
• Subfinder — faster than Amass for a first sweep.
• crt.sh — issued TLS certificates reveal subdomains nobody ever linked. What turns up is often surprising.
• Shodan and Censys — search engines for connected devices. Cameras, industrial panels, open databases.
• Wayback Machine — a website as it was five years ago, with the files they've since deleted.

# Passive subdomains, without touching the target
amass enum -passive -d company.com

# Certificates, which usually give what nothing else does
curl -s "https://crt.sh/?q=%25.company.com&output=json" | jq -r '.[].name_value' | sort -u

People and emails

• theHarvester — emails, names and subdomains from public sources.
• Hunter.io — corporate email patterns. Knowing a company uses first.last@ gives you every address from just a staff list.
• Have I Been Pwned — which breaches an address appears in.
• Sherlock — the same username across hundreds of platforms.

theHarvester -d company.com -b bing,duckduckgo,crtsh -l 500
sherlock username

This is where real legal responsibility begins. All of it is personal data, and the GDPR applies exactly the same even though you found it on a public page.

Code and leaks

• GitHub Dorks / trufflehog / gitleaks — API keys and passwords inside public repositories.
• Google Dorks — still works and is still among the highest return per minute invested.

site:company.com filetype:pdf
site:github.com "company.com" password
intitle:"index of" "backup"

Credential dumps from old breaches are the source that explains most real intrusions. Not because the password still works on the breached site, but because the person reused it on their corporate email.

Analysis and relationships

• Maltego CE — the map of relationships between entities. The tool that turns a list into a graph and the graph into a conclusion.
• SpiderFoot — automates a hundred sources at once. Useful for the initial sweep, dangerous if you believe the output without verifying it.
• ExifTool — metadata in photos and documents. Author, software, sometimes coordinates.

exiftool document.pdf | grep -i "author\|creator\|producer"

A corporate PDF usually carries the name of the employee who generated it, the software version and sometimes the internal path of the file server. Three free data points per document.

What separates an investigator from someone with a lot of tools

Verification. Any open source can be wrong, out of date or deliberately planted. The rule is simple: nothing goes into the report on a single source.

The record. Every finding with its date, its origin and its screenshot. If you can't reconstruct how you reached a conclusion, it's worthless in a professional context and worse still in a legal one.

Isolation. You investigate from a separate environment: dedicated browser, clean sessions, VPN. Not to hide, but to avoid contaminating the result with your own personalisation bubble and to avoid telling the target you're looking.

The limits, which are real

In Spain and the EU:

• Consulting public sources is legal.
• Processing personal data needs a legal basis, even if you found it in the open. A documented professional engagement usually provides one; curiosity does not.
• Using a leaked credential to access a system is unauthorised access, and that's a criminal offence. Finding it does not authorise you to use it.
• Sustained collection of information about a specific person can amount to harassment, regardless of how public each individual piece was.

The difference between a professional and a problem is almost always a signed engagement document.

Where to go next

If this has hooked you, the OSINT course walks the full cycle with real cases: infrastructure, people, leaks, geolocation and writing the final report. It's advanced level, so if you're starting from zero it's worth going through the Kali Linux course first, which is free and leaves you comfortable in a terminal.

And to place OSINT inside the wider work of an audit, see the phases of a pentest: recon is the first, and the one that most determines the outcome of all the others.