> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # OSINT (Open Source Intelligence) OSINT is reconnaissance done entirely with publicly available information, no packets sent at the target, no scope negotiation needed for most of it. On a red team engagement it's usually the very first phase: mapping employees, email formats, exposed infrastructure, and leaked credentials before ever touching the target's network directly. Unlike active recon, almost everything here is passive, which makes it the lowest-risk, highest-value place to start. > **Passive Recon** > > Gathering information entirely through third parties, search engines, public databases, cached pages. The target never sees a single request from you. > **Active Recon** > > Directly querying the target's own infrastructure (DNS, ports, web apps). Covered on the per-service pages elsewhere on this site, not here. > [!TIP] > > OSINT findings directly feed later phases: a leaked email format turns into a phishing pretext, a breached password turns into a spray list, an exposed S3 bucket turns into initial access. Treat this phase as building the target list for everything that follows, not a one-off exercise. *** ## Google Dorking Search engine operators let you query far more precisely than a normal search, filtering by file type, site, URL structure, or exact phrasing. This is often the fastest way to find exposed documents, login panels, or misconfigurations indexed by accident. | Operator | Purpose | | - | - | | `site:domain.com` | Restrict results to one domain | | `filetype:pdf` | Restrict to a specific file extension | | `intitle:"index of"` | Find open directory listings | | `inurl:admin` | Find URLs containing a specific string | | `intext:"password"` | Find pages containing a specific string in the body | | `cache:domain.com` | View Google's cached version of a page | | `"exact phrase"` | Force an exact match | | `-term` | Exclude a term from results | | `site:domain.com filetype:xlsx` | Combine operators for a narrower search | ```text theme={null} site:target.com filetype:pdf site:target.com inurl:login intitle:"index of" site:target.com ``` > [!NOTE] > > [dorksearch.pro](https://dorksearch.pro/index.html) builds and runs these queries interactively without needing to memorize operator syntax. [Dorkmine](https://dorkmine.codebygk.com/) is another very useful tool *** ## People and Identity **Username Search** [WhatsMyName](https://whatsmyname.app/) checks a given username against hundreds of sites at once, useful for mapping an individual's footprint across platforms from a single handle. **Email / Phone Lookup** [Epieos](https://epieos.com/) performs reverse lookups on email addresses and phone numbers, often revealing linked accounts (Google, social platforms) tied to the same identifier. **Reverse Image Search** [PimEyes](https://pimeyes.com/en) is a facial-recognition-based reverse image search, considerably more capable at matching faces across the web than a standard reverse image search. *** ## Breach and Credential Exposure > [!WARNING] > > Using leaked credentials against a live target, even ones found through these tools, is still an active attack and needs to be explicitly in scope. Finding a password in a breach dump is recon; trying it against a login is not. ```text theme={null} https://breachdirectory.org/ # search breach databases for a domain, email, or username https://leakpeek.com/ # similar breach/leak search https://leakix.net/ # indexed leaks and exposed services found by LeakIX's own scanning https://www.proxynova.com/tools/comb # searches against the COMB (Compilation of Many Breaches) dataset https://intelx.io/ # broad search across leaks, documents, and historical web data https://haveibeenpwned.com/ # check whether an email or domain shows up in known breaches ``` *** ## Domain and Subdomain Recon Before scanning anything yourself, these pull ownership, DNS, and subdomain data straight from public records and certificate logs, often surfacing a forgotten subdomain or internal hostname you'd otherwise have to brute-force. ```text theme={null} https://who.is/ # WHOIS lookup, registrant and registrar info for a domain https://sitereport.netcraft.com/ # hosting history, tech stack, and ownership details for a site ``` Certificate Transparency logs record every TLS certificate ever issued for a domain, including ones for subdomains that were never meant to be public. ```text theme={null} https://crt.sh/?q=target.com # search CT logs for issued certs, a fast way to enumerate subdomains ``` > [!TIP] > > Pull a quick CT-log subdomain list straight from crt.sh without opening a browser: > > ```text theme={null} > curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u > ``` ```text theme={null} https://dnsdumpster.com/ # visual DNS recon, resolves and maps hosting https://www.nslookup.io/ # DNS record lookups (A, MX, TXT, NS, etc.) https://pentest-tools.com/information-gathering/find-subdomains-of-domain # automated subdomain enumeration https://subdomainfinder.c99.nl/ # another subdomain enumeration service ``` *** ## Infrastructure and Network Recon These map a target's externally visible infrastructure, often the fastest way to find a forgotten subdomain, an exposed admin panel, or a misconfigured cloud service before ever running a port scan yourself. ```text theme={null} https://www.shodan.io/ # search engine for internet-connected devices and exposed services https://search.censys.io/ # similar to Shodan, strong at certificate and host attribution https://bgp.he.net/ # IP allocation, ASN, and routing information https://viewdns.info/ # a broad set of DNS lookup tools in one place ``` > [!TIP] > > Shodan and Censys both index far more than web servers, exposed databases, industrial control systems, webcams, and misconfigured cloud storage all show up. Worth searching the target's known IP ranges and ASN directly, not just the domain name. *** ## Website and URL Analysis ```text theme={null} https://urlscan.io/ # submits a URL and returns a full breakdown: requests made, certificates, screenshots, related domains https://pulsedive.com/ # threat intelligence lookups on domains, IPs, and URLs https://web-check.xyz/ # aggregates DNS, headers, certificates, and hosting info for a domain in one report ``` *** ## Exposed Storage, Code, and Leaks ```text theme={null} https://grayhatwarfare.com/ # search publicly exposed cloud storage buckets (S3, Azure, GCP) by keyword https://grep.app/ # full-text search across public GitHub repositories https://osint.sh/ # DNS and bucket-focused OSINT toolset ``` > [!TIP] > > `grep.app` is worth running your target's domain, internal hostnames, or employee email format through directly, leaked API keys and internal config snippets show up in public repos far more often than you'd expect. *** ## Historical and Archived Data ```text theme={null} https://archive.org/ # the Wayback Machine, over 866 billion archived web pages ``` A page long since taken down or edited can still reveal old employee names, email formats, or infrastructure details that never got cleaned from the historical record. *** ## Image Forensics [unredacter](https://github.com/bishopfox/unredacter) reconstructs text hidden behind pixelation (not solid black boxes) in images, exploiting the fact that pixelation is a reversible, deterministic blur rather than true redaction. > [!NOTE] > > This only works against pixelated redactions, not solid-color boxes or proper blurring. It's a reminder as much as a tool: pixelation is not a safe redaction method, and it's worth checking any pixelated screenshot a target has published. *** ## Search From a Different Region [isearchfrom.com](https://isearchfrom.com/) runs a Google search as if originating from any country, useful since search results (and what gets indexed or surfaced) can vary meaningfully by region. *** ## Aggregators and Frameworks Rather than tracking individual tools, these curate large, categorized link collections, worth bookmarking as a starting point when you're not sure which specific tool fits a given task. > **[OSINT Framework](https://osintframework.com/)** > > A categorized, clickable tree of OSINT tools and resources by use case. > **[The Kitchen Sink (OSINTI4L)](https://github.com/OSINTI4L/The-Kitchen-Sink/blob/main/OSINTials.md#people-search)** > > A large, actively maintained collection of OSINT tools and links, strong on people search specifically. > **[NotLoBi OSINT Repo](https://github.com/NotLoBi/NotLoBi)** > > Another broad collection of OSINT tools and reference links. *** ## Quick Reference: All Tools by Category | Category | Tools | | - | - | | Infrastructure | Shodan, Censys, bgp.he.net, ViewDNS | | Domain / Subdomain | who.is, Netcraft, crt.sh, dnsdumpster, nslookup.io, pentest-tools subdomain finder, c99.nl | | People / Identity | WhatsMyName, Epieos, PimEyes | | Breach / Leaks | BreachDirectory, LeakPeek, LeakIX, ProxyNova COMB, Intelligence X, Have I Been Pwned | | Website Analysis | urlscan.io, Pulsedive, web-check.xyz | | Storage / Code | GrayhatWarfare, grep.app, osint.sh | | Archives | Wayback Machine | | Dorking | dorksearch.pro | | Frameworks | OSINT Framework, The Kitchen Sink, NotLoBi | > [!WARNING] > > OSINT itself is passive and generally low-risk, but acting on what you find (spraying leaked credentials, logging into exposed panels) is active and needs to be explicitly in scope. Keep the two phases distinct in your own notes and reporting. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.