Open source intelligence (OSINT) is the practice of collecting information from publicly available sources. Whether we are conducting security assessments, researching threats, or verifying information, these resources help us gather intelligence effectively and ethically.

Network Tools

  • dnsstuff.com/tools – DNSstuff Toolbox
  • network-tools.com – Network-Tools
  • centralops.net – CentralOps
  • lg.he.net – Hurricane Electric
  • bgp4.as/looking-glasses – BGP Looking Glasses
  • shodan.io – Shodan - Search engine for internet-connected devices
  • viz.greynoise.io – GreyNoise - Internet noise analysis
  • mxtoolbox.com/NetworkTools.aspx – MxToolBox
  • iana.org/numbers – IANA IP and ASN Lookup

Whois Resources

Regional internet registries and lookup services for domain and IP ownership information.

  • icann.org – ICANN
  • iana.com – IANA
  • nro.net – NRO
  • afrinic.net – AFRINIC (Africa)
  • apnic.net – APNIC (Asia-Pacific)
  • ws.arin.net – ARIN (North America)
  • lacnic.net – LACNIC (Latin America)
  • ripe.net – RIPE (Europe, Middle East, Central Asia)
  • internic.net – InterNIC

Reconnaissance Tools

Tools for automating the collection and analysis of open source intelligence.

  • github.com/ElevenPaths/FOCA – FOCA - Metadata extraction tool
  • github.com/laramies/theHarvester – theHarvester - Email and subdomain discovery
  • maltego.com – Maltego - Link analysis and data mining
  • github.com/lanmaster53/recon-ng – Recon-ng Framework - Web reconnaissance framework

Google Search Operators

These operators help us refine searches and find specific information. For more examples, see the Google Hacking Database at exploit-db.com/google-hacking-database.

  • site:url – Search within a specific site
  • numrange:start...end – Search within a number range
  • date:number – Search within past number of months
  • link:url – Find pages linking to a URL
  • related:url – Find pages related to a URL
  • intitle:text – Find pages with text in the title
  • inurl:text – Find pages with text in the URL
  • filetype:extension – Search for specific file types
  • phonebook:name – Find phone book listings

Resources for finding information about individuals (use responsibly and in accordance with privacy laws).

  • peekyou.com – PeekYou
  • spokeo.com – Spokeo
  • pipl.com – Pipl
  • intelius.com – Intelius
  • publicrecords.searchsystems.net – Search Systems

Additional Reading

  • vulnerabilityassessment.co.uk/Penetration%20Test.html
  • securitysift.com/passive-reconnaissance/
  • pentest-standard.org/index.php/Intelligence_Gathering
  • onstrat.com/osint/