OSINT: Open Source Intelligence, Finding the Puzzle Pieces

Some of the most powerful "hacking" involves no exploits at all, just a browser and patience. OSINT (Open Source Intelligence) is the craft of gathering intelligence from publicly available sources and connecting the pieces into a picture. This is a long lesson, because OSINT is less one trick than a whole way of looking at the world. Take it in sections.

Read this first. OSINT is dual-use. The exact techniques a tester uses to map an authorised target are the techniques a stalker uses to hurt someone. Everything below is for authorised security work or understanding your own exposure. Public does not mean permitted. Gathering data on a random person, doxxing, or harassment is illegal and unethical no matter how "open" the source. Keep that rule in front of everything else in this lesson.

What is OSINT?

OSINT is intelligence built entirely from sources anyone can legally reach: search engines, social media, public records, images, company filings, leaked datasets, the target's own website. There is no breaking in. The whole skill is finding, connecting, and interpreting information that is already out there but scattered across a hundred places. One fact is trivia; ten facts joined together are a profile.

Why hackers need it

Recon is the first stage of every engagement, and OSINT is most of it:

• It builds the target picture before you touch anything: employees, email formats, technologies, domains, third-party services.
• It feeds social engineering. A convincing phishing email is 90% OSINT, knowing the names, the lingo, the org chart, the current project.
• It fuels password guessing. People still use a pet's name, a birth year, a favourite team, all findable.
• It is passive. You query Google, LinkedIn, and public registries, never the target's servers, so there is nothing in their logs and no way for them to know you looked.

Who actually uses OSINT

It's not just attackers. Whole roles and departments live on it:

That last one matters most for a beginner: the fastest way to learn OSINT is to run it on yourself and get uncomfortable.

1. People and social media (dorking, aimed at humans)

Remember dorking? Point the same operators at people and social platforms instead of servers. Search engines have indexed profiles, posts, and bios across every network:

"firstname lastname" site:instagram.com
site:facebook.com "targetname" "works at"
site:linkedin.com "Target Name" "Company Name"
site:twitter.com OR site:x.com "targetname"
site:github.com "targetname"
"target@email.com"                      # find everywhere an email address appears
"firstname lastname" "kathmandu" ("email" OR "phone")

The real superpower is username pivoting: people reuse the same handle everywhere. Find @coolhacker99 on one site and the same handle often unlocks their accounts on ten others (tools like Sherlock automate this across hundreds of platforms). A LinkedIn job title, an Instagram geotag, a GitHub commit email, each is a puzzle piece, and together they're an identity.

2. Reverse image search and metadata

An image is intelligence twice over: for what it shows and for what's hidden inside it.

Reverse image search takes a picture and finds where else it appears. Upload a profile photo and you may find the person's real name, other accounts, or the original source:

• Google Images , broadest index.
• TinEye , great for tracking where an exact image has been used over time.
• Yandex , widely considered the strongest at matching faces and people, often finds a person when the others fail.

Image metadata (EXIF) is the hidden data a camera bakes into a photo file: GPS coordinates, camera/phone model, and the exact date and time. Read it with a tool like exiftool:

exiftool vacation.jpg
# ... GPS Position: 27.7172, 85.3240
# ... Camera Model: iPhone 14 Pro
# ... Create Date: 2026:06:14 18:22:07

A single geotagged photo someone posted can pin their home to a doorstep. Big platforms (Instagram, Facebook) usually strip EXIF on upload, but files shared directly, over email, chat, a personal blog, a marketplace listing, very often still carry it. When you post photos, this cuts both ways.

3. Public information from government sites

Governments publish an astonishing amount: company registrations, court cause lists, property and land records, gazettes, and electoral rolls. These are goldmines for tying a name to an address, a company, or a director.

For example, Nepal's Election Commission publishes a searchable voter list database: election.gov.np/np/page/voter-list-db. Similar public sources exist for company registration, land records, and court schedules. None of this requires access, it's published deliberately, and knowing it exists is half the battle. (Using it must still respect the law and the purpose it was published for.)

4. Use a checklist, don't memorise

Nobody memorises every source. Experienced OSINT people work from curated link collections that gather the useful sites for a region or topic in one place. For Nepal, this community board is a great starting map: start.me/p/ydRa8B/nepali-osint. Globally, the OSINT Framework and Bellingcat's toolkit do the same. Bookmark a good checklist and you always know where to look next.

5. Sock puppets and sample identities

Serious investigators never research from their own account, they use a sock puppet: a non-attributable research account that isn't tied to their real identity, so the target can't see who's looking (and can't retaliate). Setting one up sometimes needs placeholder details, and sample-identity generators like businer.com/fakeid.php produce test names and ID-style numbers for that purpose and for understanding how ID formats are structured.

The ethical line here is bright and hard: a sock puppet must never impersonate a real person, and generated identities must never be used to commit fraud, open accounts in someone's name, or deceive for gain. Non-attribution for legitimate research is fine; identity fraud is a crime.

6. Nepal in focus: a phone number is not anonymous

One of the most eye-opening OSINT lessons for people in Nepal: your phone number quietly leaks your name.

• Payment apps , eSewa, Khalti, and many banking apps show the registered account holder's name the moment you enter a number on a send-money screen. It's meant to prevent sending to the wrong person, but it doubles as a number-to-name lookup.
• Truecaller , a giant crowdsourced database that maps numbers to names, built from the contact lists of everyone who installed it. Your number is probably in it even if you never signed up, because your friends did.

The takeaway runs both ways. As a tester or investigator, a phone number is often a direct line to a real name. As a person, treat your number as semi-public: it is far closer to your identity than most people assume, which is exactly why "just give me your number" is a bigger deal than it feels.

7. Emails, accounts, and web archives

• The web remembers what sites delete. The Wayback Machine (web.archive.org) stores historical snapshots of pages. An employee list, a phone directory, or a careless page that was "taken down" often still lives in the archive. Always check it.
• Email and phone to accounts , epieos.com takes an email address or phone number and reveals linked accounts and services (Google profile, connected apps, and more). Tools like holehe do this on the command line.
• Finding corporate emails , hunter.io and apollo.io map a company's email address format and list staff addresses, invaluable for building a target's people list (and for the phishing that so often follows).

8. The physical world is online too

OSINT isn't only digital identities; movement and assets are trackable:

• Flightradar24 (flightradar24.com) shows live aircraft positions worldwide, used to track private jets, executive travel, and patterns of life.
• MarineTraffic does the same for ships.

Watching when and where things move is often more revealing than any single document.

9. Blockchain OSINT

Cryptocurrency is pseudonymous, not anonymous. Every transaction on a public blockchain is permanent and visible to everyone. Block explorers like Etherscan and blockchain.com, plus tracing tools, let investigators follow the flow of funds between wallets, cluster addresses that belong to the same person, and connect an on-chain address to a real identity once it touches a regulated exchange. Following the money has never been more public.

Graduating from the browser: tools

Once the manual work gets repetitive, tools scale it up. These three are the workhorses.

Shodan and Censys , the two device search engines

Shodan and Censys both continuously scan the whole internet and index devices by their banners (servers, cameras, routers, databases), not web pages. They're the same idea with two different query languages: Shodan uses short key:value filters, Censys uses longer field paths joined with AND. Learn a goal once and you know it in both.

# Shodan
org:"Acme Corp"

# Censys
autonomous_system.organization:"Acme Corp"

Shodan has a CLI (shodan search 'org:"Acme Corp"', shodan host 198.51.100.20) and, for members, a vuln: filter that flags hosts affected by a given CVE, e.g. org:"Acme Corp" vuln:CVE-2021-44228 (Log4Shell). Censys tends to carry the freshest TLS/certificate data, which makes it the stronger pick for certificate-based pivots.

The same hunt in both tools

Pick a goal, then run it in whichever engine you have access to. These are the queries you'll reach for most (swap Acme Corp/acme.com for your authorised target):

In the Censys column, ... stands for the autonomous_system.organization:"Acme Corp" AND prefix from the first row. A favicon hash is a fingerprint of a site's little browser-tab icon: grab it once and you'll find every host serving the same app, even on unexpected IPs and forgotten subdomains, one of the most powerful pivots in either tool.

You don't have to invent queries from scratch. Learn from the community collections: github.com/jakejarvis/awesome-shodan-queries for Shodan, and Censys's own built-in search examples for Censys.

theHarvester , automate the people & host sweep

theHarvester hits dozens of public sources at once to collect emails, subdomains, hosts, and names for a domain:

theHarvester -d acme.com -b google,bing,duckduckgo   # emails & hosts from search engines
theHarvester -d acme.com -b linkedin                 # employee names and job titles
theHarvester -d acme.com -b crtsh,hackertarget       # subdomains from certificate logs
theHarvester -d acme.com -b all -f acme_report       # every source, saved to a report

-d is the target domain, -b picks the sources (or all), -f writes the results to a file. It's the fastest way to turn one domain into a ready-made list of emails and hosts for the next stage.

More to meet later

IntelligenceX (a search engine over leaks, historical data, and the darkweb), Maltego and SpiderFoot (visual link analysis), recon-ng, Sherlock (find a username across hundreds of sites), holehe (email to accounts).

You don't need to learn them all. This huge, curated collection is a map of the whole field, skim it for ideas: github.com/frangelbarrera/OSINT-BIBLE.

Why this matters

OSINT is not a single tool or a magic query. It's a mindset: treat every public breadcrumb, a photo's metadata, a reused username, an archived page, a leaked email, a phone number, as a puzzle piece, and get good at fitting them together into a picture. That picture is what every later stage of an attack, and every good defence, is built on. Learn it well, and the first thing you'll want to do is go clean up your own trail.