Skip to main content
OSINT is reconnaissance done entirely with publicly available information, no packets sent at the target, no scope negotiation needed for most of it. On a red team engagement it’s usually the very first phase: mapping employees, email formats, exposed infrastructure, and leaked credentials before ever touching the target’s network directly. Unlike active recon, almost everything here is passive, which makes it the lowest-risk, highest-value place to start.

Passive Recon

Gathering information entirely through third parties, search engines, public databases, cached pages. The target never sees a single request from you.

Active Recon

Directly querying the target’s own infrastructure (DNS, ports, web apps). Covered on the per-service pages elsewhere on this site, not here.
OSINT findings directly feed later phases: a leaked email format turns into a phishing pretext, a breached password turns into a spray list, an exposed S3 bucket turns into initial access. Treat this phase as building the target list for everything that follows, not a one-off exercise.

​
Google Dorking

Search engine operators let you query far more precisely than a normal search, filtering by file type, site, URL structure, or exact phrasing. This is often the fastest way to find exposed documents, login panels, or misconfigurations indexed by accident.
dorksearch.pro builds and runs these queries interactively without needing to memorize operator syntax. Dorkmine is another very useful tool

​
People and Identity

WhatsMyName checks a given username against hundreds of sites at once, useful for mapping an individual’s footprint across platforms from a single handle.

​
Breach and Credential Exposure

Using leaked credentials against a live target, even ones found through these tools, is still an active attack and needs to be explicitly in scope. Finding a password in a breach dump is recon; trying it against a login is not.

​
Domain and Subdomain Recon

Before scanning anything yourself, these pull ownership, DNS, and subdomain data straight from public records and certificate logs, often surfacing a forgotten subdomain or internal hostname you’d otherwise have to brute-force.
Certificate Transparency logs record every TLS certificate ever issued for a domain, including ones for subdomains that were never meant to be public.
Pull a quick CT-log subdomain list straight from crt.sh without opening a browser:

​
Infrastructure and Network Recon

These map a target’s externally visible infrastructure, often the fastest way to find a forgotten subdomain, an exposed admin panel, or a misconfigured cloud service before ever running a port scan yourself.
Shodan and Censys both index far more than web servers, exposed databases, industrial control systems, webcams, and misconfigured cloud storage all show up. Worth searching the target’s known IP ranges and ASN directly, not just the domain name.

​
Website and URL Analysis

​
Exposed Storage, Code, and Leaks

grep.app is worth running your target’s domain, internal hostnames, or employee email format through directly, leaked API keys and internal config snippets show up in public repos far more often than you’d expect.

​
Historical and Archived Data

A page long since taken down or edited can still reveal old employee names, email formats, or infrastructure details that never got cleaned from the historical record.

​
Image Forensics

unredacter reconstructs text hidden behind pixelation (not solid black boxes) in images, exploiting the fact that pixelation is a reversible, deterministic blur rather than true redaction.
This only works against pixelated redactions, not solid-color boxes or proper blurring. It’s a reminder as much as a tool: pixelation is not a safe redaction method, and it’s worth checking any pixelated screenshot a target has published.

​
Search From a Different Region

isearchfrom.com runs a Google search as if originating from any country, useful since search results (and what gets indexed or surfaced) can vary meaningfully by region.

​
Aggregators and Frameworks

Rather than tracking individual tools, these curate large, categorized link collections, worth bookmarking as a starting point when you’re not sure which specific tool fits a given task.

OSINT Framework

A categorized, clickable tree of OSINT tools and resources by use case.

The Kitchen Sink (OSINTI4L)

A large, actively maintained collection of OSINT tools and links, strong on people search specifically.

NotLoBi OSINT Repo

Another broad collection of OSINT tools and reference links.

​
Quick Reference: All Tools by Category

OSINT itself is passive and generally low-risk, but acting on what you find (spraying leaked credentials, logging into exposed panels) is active and needs to be explicitly in scope. Keep the two phases distinct in your own notes and reporting.