MUST-HAVE
RESOURCES
FOR OPEN
SOURCE
INTELLIGENCE
(OSINT)
INTRODUCTION
Open Source Intelligence, or OSINT, is an essential skill for
aspiring penetration testers to learn. OSINT techniques can
help you uncover passwords and logins, develop successful
social engineering campaigns, and identify risks to an
organization. Luckily, there are many tools out there that can
help enhance your OSINT methodology. The following list
was developed from the resources you’ll learn about in the
Open Source Intelligence Fundamentals course in TCM
Security Academy.
Find the GitHub repo here: [Link]
Resources/Open-Source-Intellingence-Resources
See the course curriculum here:
[Link]
Get OSINT certified with the Practical OSINT Research
Professional (PORP):
[Link]
[Link] 2
SOCK PUPPET RESOURCES
First, you’ll need to create a sock puppet account to conceal
your true identity and access content on various websites
and applications where a login is required.
Intro to Creating an Effective Sock Puppet (Wayback
Machine)
[Link]
[Link]/sock-puppets/
The Art Of The Sock
[Link]
My Process for Setting up Anonymous Sock Puppet
Accounts (Reddit)
[Link]
ss_for_setting_up_anonymous_sockpuppet/
Fake Name Generator [Link]
This Person Does Not Exist
[Link]
[Link]
[Link]
[Link] 3
SEARCH ENGINE OSINT
Knowing how to manipulate search engines can deliver a
goldmine of information. Check out these resources for
advanced searching:
Google Advanced Search
[Link]
Google Search Guide
[Link]
Bing Search Guide
[Link]
search-operators/
Yandex
[Link]
DuckDuckGo Search Guide
[Link]
pages/results/syntax
Baidu
[Link]
[Link] 4
IMAGE OSINT TOOLS
There are a few other image search tools that can aid your
OSINT efforts:
Google Image Search
[Link]
Yandex
[Link]
TinEye
[Link]
[Link] 5
EMAIL OSINT
Finding a user’s email address can be the first step in
guessing their login or to launching a social engineering
campaign. Use these resources to get started:
[Link]
[Link]
[Link]
[Link]
VoilaNorbert
[Link]
Email Hippo
[Link]
Email Checker
[Link]
[Link] 6
USERNAME OSINT
If the email address isn’t the username, there are ways to
search publicly available data for that as well! Check these
out:
NameChk
[Link]
WhatsMyName
[Link]
NameCheckup
[Link]
[Link] 7
PASSWORD OSINT
Once you have an email address and a username, you
probably want to find a password to gain access to an
account. One place to look is in previous data breaches:
Dehashed
[Link]
WeLeakInfo
[Link]
LeakCheck
[Link]
SnusBase
[Link]
HaveIBeenPwned
[Link]
[Link] 8
SOCIAL MEDIA OSINT
Individuals divulge a lot of personal information on their
social media accounts. These tools will help you efficiently
search social media platforms.
[Link]
[Link]
Tinfoleak
[Link]
Sowdust
[Link]
IntelligenceX Facebook Search
[Link]
InstaDP
[Link]
ImgInn
[Link]
Snapchat Maps
[Link]
[Link] 9
PEOPLE OSINT
There’s a lot of information about individuals available online
(one reason to improve your personal OPSEC!). Information
found in these sources can be used to craft a convincing
phish, divulge the answer to a security question, or hint at
possible passwords.
WhitePages
[Link]
TruePeopleSearch
[Link]
FastPeopleSearch
[Link]
FastBackgroundCheck
[Link]
Spokeo
[Link]
That's Them
[Link]
Voter Records
[Link]
[Link] 10
PEOPLE OSINT
TrueCaller
[Link]
CallerID Test
[Link]
Infobel
[Link]
WIRELESS OSINT TOOL
Gather intel on wireless networks with this handy tool:
WiGLE
[Link]
[Link] 11
WEBSITE OSINT TOOLS
If you are pentesting a web application or looking for
information on a company or its employees, these tools can
help you find a way in.
BuiltWith
[Link]
Domain Dossier
[Link]
DNSlytics
[Link]
Virus Total
[Link]
Visual Ping
[Link]
Back Link Watch
[Link]
View DNS
[Link]
[Link] 12
WEBSITE OSINT
Pentest-Tools Subdomain Finder
[Link]
subdomains-of-domain#
[Link]
[Link]
Shodan
[Link]
Wayback Machine
[Link]
BUSINESS OSINT TOOLS
These tools can help you unlock information about a
company’s structure and important business data.
Open Corporates
[Link]
AI HIT
[Link]
[Link] 13
CONCLUSION
Check out the full list of resources on our Github! If you want
to learn more about how to use these tools and develop an
OSINT methodology, check out the OSINT Fundamentals
course or the Practical OSINT Research Professional
certification. We also offer an Introduction to OSINT live
training that will provide hands on experience with many of
the tools mentioned in this guide.
[Link] 14