OSINT (Open Source Intelligence) is the systematic collection and analysis of publicly available data. To the untrained eye, a LinkedIn post or a public GitHub repository is harmless. To a systematic analyst, it is a blueprint for an attack.
1. What is OSINT?
OSINT is the practice of collecting and analyzing information that is legally and publicly available. In the context of security, we treat OSINT as the “External System View.”
This is seriously about the logic of tracking personal data. A single data point, such as a photo of a server rack, is just a pixel. When layered with other sources, it forms a high-definition map of an organization’s vulnerabilities.
2. Core Factors: What We Focus On and Why
To secure high-stakes infrastructure, we focus on three critical “Leaked” categories:
A. Infrastructure Mapping (“Where”)
Public DNS records, SSL certificate history, and WHOIS data. Why?: These reveal cloud provider dependencies (AWS/Azure) and hidden subdomains. If a “backup” server is visible on a public index, your DRP (Disaster Recovery Plan) is compromised.
B. Human Intelligence (“Who”)
Job postings and professional profiles. Why?: A job post for a “Senior Engineer with 5 years of “vendors” and “OS” experience” tells an attacker exactly what hardware and legacy software is behind your firewall. You are providing the attack vector for free.
C. Metadata (“How”)
PDF/Office metadata and GitHub commit histories. Why?: Documents often contain the internal naming conventions of servers or the usernames of staff. On GitHub, “accidental commits” of API keys provide a direct “translate” from the public world into your private database.
3. The Bridge: OSINT and Social Engineering
OSINT provides the intelligence required for Social Engineering; an effective social engineering attack is rarely possible without a successful OSINT phase.
4. How to Check Your Own Footprint
To verify your organizational security, you must look at your infrastructure from the outside-in using these systematic checks:
Passive Reconnaissance: Use tools like Shodan or Censys to see what your IP range looks like to the world. If you see a database port (3306/5432) open, your “Inner Infrastructure” is exposed. Dorking: Use advanced search operators (e.g., site:yourdomain.com filetype:pdf “confidential”) to see what files are indexed that shouldn’t be. Credential Leaks: Use databases like HaveIBeenPwned (domain-wide) to see if corporate emails have been leaked in third-party breaches, which provides the starting point for brute-force or “credential stuffing” attacks.
You can check all resort at gfxtm’s resource