OSINT & Recon: Open Source Intelligence Basics

What OSINT Is and Why It Matters

Open Source Intelligence (OSINT) is the practice of collecting and analyzing information from publicly available sources: websites, search engines, social media, public records, and technical data like DNS records. Because the information is already public, gathering it is generally legal.

In security work, OSINT is the reconnaissance phase of a test. It helps an authorized tester understand an organization's attack surface before touching anything, and it helps defenders find their own exposed information before attackers do.

The ethical line is simple: use only what is publicly available, do not evade access controls, and only gather information about organizations or individuals you have a legitimate, authorized reason to investigate. Never use OSINT for stalking, harassment, or targeting people without consent.

dig example.com ANY +short
dig -x 93.184.216.34 +short
# public DNS records are one of the most basic OSINT sources

Passive Reconnaissance: Sources You Already Know

Search engines are the most powerful OSINT tool most people underestimate. Search operators let you find exact phrases, file types, and site-specific content that a plain query never surfaces.

Domain infrastructure is rich with data: WHOIS records show registration details, DNS records reveal mail servers and subdomains, and certificate transparency logs expose hostnames an organization never intended to publicize.

Social media and job postings are legitimate OSINT goldmines for understanding an organization's technology stack, employee roles, and naming conventions, all from public information.

• •WHOIS registration data and DNS records
• •Certificate transparency logs for discovering hostnames
• •Public job postings revealing technology choices
• •Social media profiles and public company pages
• •Public code repositories and package registries

curl -s "<ct-log-query-url>?q=example.com&output=json" | python3 -m json.tool
# certificate transparency logs list every public certificate for a domain

Active Reconnaissance and the Legal Boundary

Passive reconnaissance collects what the world already shows you. Active reconnaissance sends traffic to the target: pinging hosts, scanning ports, and requesting web pages. This is where permission becomes critical, because your traffic is now observable and may itself be considered an attack.

Active techniques like port scanning and banner grabbing are only acceptable on systems you own or have written permission to test. A bug bounty program's scope document tells you exactly which domains and IP ranges are permitted; anything outside that scope is off limits.

Before any active step, record your authorization: the program scope, the engagement contract, or your own infrastructure. Keep records of exactly what you scanned and when, because you may need to explain your actions.

ping -c 3 example.com
nmap -sV -p 80,443 example.com
# only ever run these against in-scope targets

Turning OSINT Findings Into a Recon Report

OSINT is only valuable when it is organized. Record every finding with its source, its date, and its relevance. Unverified facts belong in a separate list from confirmed ones, and everything needs a timestamp because the web changes constantly.

Build a simple picture of the target: the domain names that matter, the IP ranges they resolve to, the technologies in use, and the people or accounts connected to them. This becomes the roadmap for the rest of an authorized engagement.

For defenders, do the same exercise on your own organization. The report you produce is a list of what an attacker already knows about you, which is exactly the information your security team needs to reduce the attack surface.

• •Domain names and their relationships
• •IP ranges and hosting providers
• •Technologies and versions visible publicly
• •Publicly connected accounts and individuals
• •Data exposure, like credentials in public leaks

mkdir -p recon/example.com && cd recon/example.com
hostname -I
dig example.com MX +short
# structure your notes as files you can review and share

Ethics, Privacy, and Responsible Use

OSINT skills make you powerful against information that is technically public, which is exactly why you must set your own guardrails. Respect platform terms of service, never use stolen or breached data, and never use what you learn to harm people.

Remember that a public post was written for a context, not for an investigator. Treat people's public information with the same care you would want for your own. The goal of OSINT in security is protection, not intrusion.

Stay on the right side of the law and of your own conscience: only test systems you own or have written permission to test, and only investigate people when you have a legitimate, authorized purpose.