Ethical Hacking OSINT Techniques
OSINT stands for Open Source Intelligence. It means collecting information from public sources that anyone can reach legally. Ethical hackers use OSINT to learn about a target organization before any technical test begins. Public data often reveals more than the company expects.
What Counts as Open Source
Open source here refers to openly available information, not open source software. Examples include websites, social media posts, news articles, job listings, public records, and search engine results. No hacking is needed to read them.
The OSINT Cycle
[1. Set Goal]
|
v
[2. Collect Public Data]
|
v
[3. Sort and Verify]
|
v
[4. Connect the Dots]
|
v
[5. Write Findings]
|
+----> (new questions) back to step 2
The cycle repeats. Each new fact raises new questions, and the tester loops back to collect more.
Common OSINT Sources
Search Engines
Search engines accept special operators that narrow results. The operator site: limits results to one website, and filetype: finds documents of one kind. A tester can search for public PDF files on a company domain to spot leaked internal documents.
Social Media and Job Boards
Employees share details about their work without thinking. A job listing that asks for "Oracle 12 database experience" tells an observer which database the company runs. Staff photos can reveal badge designs, office layouts, and computer screens.
Domain and Website Records
Public lookup services show who registered a domain, which name servers it uses, and which subdomains exist. Certificate transparency logs list website certificates, which often exposes forgotten test sites.
Code Repositories
Developers sometimes upload passwords or keys to public code sites by mistake. Testers search these sites for company names to find leaked secrets.
Popular OSINT Tools
| Tool | Purpose |
|---|---|
| Maltego | Draws link maps between people, domains, and companies |
| theHarvester | Collects email addresses and subdomains |
| Shodan | Searches for internet-connected devices |
| Wayback Machine | Shows old versions of websites |
| WHOIS lookup | Shows domain ownership records |
Example: Mapping a Fictional Company
A tester receives approval to assess "BrightMart", a made-up retail firm. A search reveals the company domain and its public email format: firstname.lastname@brightmart.com. A job post mentions a specific cloud provider. A staff member's public profile shows the name of the IT manager.
BrightMart |-- Domain: brightmart.com |-- Email pattern: firstname.lastname |-- Cloud provider: from job post |-- IT manager: from public profile |-- Old test site: from certificate logs
Within an hour, the tester holds a clear picture of the company without sending a single packet to its servers.
Organizing Findings
Keep notes in a structured file. Record the source, the date, and the link for every fact. Verified facts help the final report, and unverified claims stay marked as such.
Ethics and Privacy
Public does not mean unlimited. Testers collect only information that supports the agreed goal. Following private citizens, contacting family members, or gathering unrelated personal details crosses an ethical line, and some privacy laws forbid it. Keep the work focused on the organization.
Defending Against OSINT
Companies reduce exposure by training staff on safe posting, removing metadata from public documents, hiding old test sites, and scanning code sites for leaked keys. A regular self-check using the same OSINT methods shows what outsiders can see.