What is OSINT (open-source intelligence)?

OSINT, open-source intelligence, is information collected from publicly available sources and analysed to answer a question: search engines, DNS and certificate logs, code repositories, company filings, social media. In security it is the first step of reconnaissance, mapping what an organisation exposes before anyone sends a single request to its systems.

Why it matters

Attackers start here because it is cheap and leaves no trace on the target. MITRE ATT&CK describes a whole reconnaissance tactic of this kind: gathering victim identity, network and organisation information from open sources before an attack. Leaked credentials in a public repository, a forgotten staging subdomain in certificate transparency logs, or an employee list that reveals the email format all make the next step easier.

That is also why defenders do it to themselves. Running OSINT on your own domain and your own organisation shows you the same picture an attacker would build, early enough to remove what should not be public. The OWASP Web Security Testing Guide starts its information-gathering phase with the same sources.

Example: a first OSINT pass on your own domain

Run these against a domain you own; your-app.example stands in for it here. Each source is public, and none of these steps touches someone else's systems:

# Subdomains that ever had a TLS certificate (certificate transparency)
https://crt.sh/?q=%25.your-app.example

# DNS records you publish: mail, verification tokens, third-party services
$ dig +short TXT your-app.example
$ dig +short MX your-app.example

# What search engines indexed that you did not mean to publish
site:your-app.example filetype:pdf
site:your-app.example inurl:staging

Read the results as an attacker would. Certificate logs often list staging, admin or old marketing subdomains that still resolve. TXT records name the SaaS tools you use. Indexed PDFs carry author names and internal paths in their metadata. Each finding goes on your attack surface map, and anything that should not be public gets removed or locked down.

Keep the scope to yourself and your own organisation. Looking up private individuals is a different activity with its own legal and ethical limits, and it is not what this page teaches.

Common mistakes

  • Collecting without a question. OSINT without a goal produces piles of data. Decide first what you want to know, such as 'which of our hosts are public?'.
  • Trusting a single source. Public data is stale and sometimes wrong. Confirm a finding in a second source before acting on it.
  • Forgetting history. Deleted pages and old DNS records live on in archives and logs. Rotate a leaked secret; deleting the file is not enough.
  • Crossing from public sources into access. Logging in with found credentials is no longer OSINT, and without permission it is unauthorised access.

Related terms

Go deeper

Sources

Test only sites you own or have written permission to test. To practise without one, use CyberGym, a legal, deliberately vulnerable target. Practise on CyberGym.