Module 2 · OSINT Collection for CTI 🔒

Open-Source Intelligence (OSINT) is the practice of collecting information from publicly available sources — no hacking, no paid access required. For CTI analysts, it fills 60-80% of the picture at zero marginal cost. This module covers the tools, techniques, tradecraft, and operational security a researcher needs to do OSINT safely and effectively.

What OSINT covers

• Surface web — search engines, social media, company websites, press releases
• Technical data — DNS records, WHOIS, SSL certs, passive DNS
• Code / infrastructure — GitHub, Docker Hub, PyPI, cloud metadata
• Dark web / paste sites — forums, marketplaces, leaked data dumps
• Archive / historical — Wayback Machine, archive.today, cached versions
• Adjacent data — business records, court filings, regulatory disclosures

Core tool categories

Search engine operators

site:linkedin.com "security engineer" "target company"
intitle:"index of" "backup" site:target.com
filetype:pdf "confidential" site:target.com
-site:target.com "target company" "password"
cache:target.com/admin            # Google's cached version

Google dorks still work but are rate-limited. Rotate search engines (Bing, DuckDuckGo, Yandex, Baidu) — different indices surface different results.

Technical infrastructure

• Shodan — every internet-exposed service, indexed by banner/port/cert. Core tool
• Censys — similar to Shodan with stronger certificate/protocol search
• BinaryEdge — another competitor, strong leak data
• SecurityTrails — historical DNS, subdomain enumeration
• crt.sh — free certificate transparency search (subdomain discovery via issued certs)
• dnsdumpster.com / ViewDNS.info — DNS and reverse-DNS lookups
• Censys certs — search certificates by organization, SAN, fingerprint

Subdomain enumeration

# Free, passive
subfinder -d target.com
assetfinder target.com
amass enum -passive -d target.com

# Cert-based
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq -r '.[].name_value' | sort -u

# Combine with active resolution
subfinder -d target.com | dnsx -resp -a -silent

Social / people

• LinkedIn — employee enumeration. Sales Navigator if budget; otherwise manual scraping
• Have I Been Pwned — email breach history
• Hunter.io / Snov.io — email pattern inference
• Maltego — graph-based OSINT pivot tool; commercial + community editions
• OSINT Framework (osintframework.com) — directory of tools organized by category

Code and leaks

• GitHub dorks: "target.com" password, "target.com" api_key, org:target-inc extension:env
• GitLeaks / TruffleHog — scan git history for leaked secrets (run against the target’s public repos)
• pastebin.com + DuckDuckGo — site:pastebin.com "target.com"
• Grep.app — fast code search across millions of repos

Historical / archive

• Wayback Machine — historical snapshots of web pages. Find deleted content, old API endpoints
• archive.today — similar; sometimes captures what Wayback misses
• Google cache — short-term but sometimes surfaces same-day deletions

Breach data

• Dehashed, IntelligenceX, BreachForums (commercial or careful browsing) — leaked credentials by domain
• DeHashed API is the commercial version — for research, often integrated into CTI workflows

OpSec for researchers

Researchers sometimes touch adversary infrastructure, dark web forums, or closed communities. OpSec: