[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Cybersecurity](/category/cybersecurity) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [Open Source Intelligence (OSINT): Top Tools and Techniques](/blog/open-source-intelligence) Publish date September 20, 2026 {x} minute read # Open Source Intelligence (OSINT): Top Tools and Techniques [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Catherine Chipeta](/team/catherine-chipeta) Cybersecurity Writer Catherine's work has influenced leaders in technology, SaaS, government, and financial services. Reviewed by [Phil Ross](/team/phil-ross) Chief Information Security Officer Phil is a Forrester Zero Trust Strategist leveraging decades of experience in enterprise cybersecurity architectures. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) [Open source intelligence (OSINT)](https://www.upguard.com/glossary/open-source-intelligence) is the process of identifying, harvesting, processing, analyzing, and reporting data obtained from publicly available sources for [intelligence purposes](https://www.upguard.com/blog/threat-intelligence).  Open source intelligence analysts use specialized methods to explore the diverse landscape of open source intelligence and pinpoint any data that meets their objectives. OSINT analysts regularly discover information that is not broadly known to be accessible to the public. OSINT includes any offline or online information that is publicly available, whether free of cost, purchasable or obtainable by request. Below are some examples of offline and online information used for open source intelligence. ### Offline * **Diplomatic: **Government, law enforcement and courts, NGOs, international agencies * **Academic: **Academic research, journals, dissertations * **Corporate:** Annual reports, conference proceedings, press releases, employee profiles, résumés * **Mass media: **Television, radio, newspapers, magazines ### Online * **Internet Search/Database:** Google, Bing, Yahoo, Wayback Machine, Whois * **Social Media Platforms: ** Facebook, Twitter, LinkedIn, Instagram * **Sharing & Publishing:** Youtube, Flickr, Pinterest, Dailymotion * **Blogging, Forums, and Online Communities:** WordPress, Medium, Reddit, 4Chan * **Deep web:** The deep web consists of any non-indexed web pages (sites that are not reachable by internet search engines). * [**Dark web**](https://www.upguard.com/blog/dark-web)**:** The dark web is only accessible through darknets. Darknets can be small peer-to-peer or friend-to-friend networks, as well as large networks like Tor and I2Ps. Many sites on the dark web host illegal content. [Learn how to choose the best attack surface management product for the tech industry >](https://www.upguard.com/blog/choosing-a-tech-attack-surface-management-product) ## History of Open Source Intelligence The origins of OSINT span much further than the introduction of digital technologies and the Internet. OSINT became a leading intelligence discipline during the Cold War, especially for gathering intelligence on the Soviet Union and China. Following the Cold War, significant global technological, commercial, and political developments further increased the capabilities and scope of OSNIT.  Notably, the broadening distribution of media publications, the invention of the television, and the advent of the Internet have all enhanced and enriched the intelligence community's access to open sources. Source: [*Mercado, S., 2004. Sailing the Sea of OSINT in the Information Age. Studies in Intelligence, \[online\] 48(3), pp.44-55.*](https://www.cia.gov/resources/csi/studies-in-intelligence/archives/vol-48-no-3/sailing-the-sea-of-osint-in-the-information-age/) ## Open Source Intelligence Uses [Information security](https://www.upguard.com/blog/information-security) teams use OSINT for two main reasons: ### Discovering Public-Facing Internal Assets OSINT analysts use penetration testing to discover an organization's publicly available assets. Also known as ethical hacking, penetration testing involves testing a computer system, network, or web application's [cybersecurity](https://www.upguard.com/blog/cyber-security) to find [exploitable](https://www.upguard.com/blog/exploit) [security vulnerabilities](https://www.upguard.com/blog/vulnerability). Relevant intelligence that security teams can uncover through penetration testing includes: * [Data leaks](https://www.upguard.com/blog/data-leak), e.g., the recent [Microsoft PowerApps data leaks](https://www.upguard.com/breaches/power-apps) occurred through portals configured to allow public access to [personally identifiable information (PII)](https://www.upguard.com/blog/personally-identifiable-information-pii).  * Unpatched software, such as [zero-day vulnerabilities](https://www.upguard.com/blog/zero-day) * [Open ports](https://www.upguard.com/blog/open-port) and unsecured devices * Exposed assets, such as IP addresses, networks, device names, and software versions. ### Identifying External Information Organizations must also consider external [cyber threats](https://www.upguard.com/blog/cyber-threat) when assessing their [attack surfaces](https://www.upguard.com/blog/attack-surface). [Assessing external threats](https://www.upguard.com/product/vendorrisk) is particularly important for an organization's [Third-Party Risk Management](https://www.upguard.com/blog/third-party-risk-management) program, as [third parties](http://what-is-third-party-risk) rise as common [attack vectors](https://www.upguard.com/blog/attack-vector).  Content on social media, including professional social networks, could appear benign on its own. Still, threat actors can launch [cyber attacks](https://www.upguard.com/blog/cyber-attack) by leveraging information disclosed by employees and suppliers in combination with existing vulnerabilities.  While even a simple internet search can reveal an [organization's vulnerabilities](https://www.upguard.com/blog/vulnerability), security teams also look into deeper layers of the Internet to identify external threats. For example, open source intelligence analysts access the deep and dark web to gather further intelligence, like [data leaks](https://www.upguard.com/blog/data-leak). Try a [dark web scan](/tools/dark-web-scan) of your own domain first. For these reasons, OSINT is vital in optimizing [Operations Security (OPSEC)](https://www.upguard.com/blog/opsec). OPSEC is the process of identifying friendly actions that could be useful for a potential attacker if properly analyzed and grouped with other data to reveal critical information or [sensitive data](https://www.upguard.com/blog/sensitive-data). ## OSINT Techniques OSINT reconnaissance (recon) techniques fall into one of two main categories: passive and active. Passive recon involves gathering information about a target network or device without directly engaging with the system. OSINT analysts rely on third-party information using passive recon tools, such as [Wireshark](https://www.upguard.com/blog/what-is-wireshark), which analyzes network traffic in real-time for Windows, Mac, Unix, and Linux systems. They piece together these different OSINT data points to find and map patterns. Active recon directly engages with the target system, offering more accurate and timely information. OSINT analysts use active recon tools like [Nmap](https://www.upguard.com/blog/how-to-use-nmap), a network discovery tool that provides a granular view of a [network's security](https://www.upguard.com/blog/network-security). Targets are more likely to notice active scanning as [intrusion detection systems (IDS) or intrusion prevention systems (IPS)](https://www.upguard.com/blog/ids-vs-ips) can detect attempts to [access open ports](https://www.upguard.com/blog/open-port) and scan for vulnerabilities. While [information security](https://www.upguard.com/blog/information-security) teams need to adopt unique OSINT techniques specific to their organizational needs, following a general process helps lay the foundations for effective intelligence gathering. The [Open Web Application Security Project (OWASP)](https://owasp.org/www-chapter-ghana/assets/slides/OWASP_OSINT_Presentation.pdf) outlines a 5-step OSINT process: ### Source Identification Determine where to find the information for the specific intelligence requirement. ### Harvesting Gather relevant information from the identified source.  ### Data Processing Process the identified source's data and extract meaningful insights. ### Analysis  Combine the processed data from multiple sources.  ### Reporting Create a final report on findings.  ‍ ## OSINT Tools There are many free and paid open source intelligence tools available for a variety of purposes, such as:  * Searching metadata and code * Researching phone numbers * Investigating people and identities * Verifying email addresses * Analyzing images * Detecting wireless networks and analyzing packets. Listed below are some useful open source intelligence tools. ### [Babel X](https://babelstreet.com/platform/babel-x) Babel X is a multilingual Internet search tool that finds publicly available information from sources like social media, forums, news sites, and blogs across 200 different languages. It filters relevant information into different categories for OSINT analysis.  ### [BuiltWith](https://builtwith.com/) BuiltWith is a website profiling tool that shows current and historical information about a website's technology usage, technology versions, and hosting.  ### [Creepy](https://www.geocreepy.com/) Creepy is an open source intelligence gathering tool that collects geolocation information through social networking platforms. ### [DarkSearch.io](https://darksearch.io/) DarkSearch is a dark web search engine that allows organizations to research and access sites directly through Tor2Web. ### [GHunt](https://github.com/mxrch/GHunt) GHunt is an OSINT tool used to find data associated with Google accounts, including account owner name, Google ID, YouTube, and other services like Photos and Maps.  ### Google Dorking Google Dorking, also known as a Google Dork, involves using advanced search queries to find security and configuration information about websites. ### [Greg.app](https://grep.app/) Greg.app is a search engine that searches code from public repositories on [GitHub](https://www.upguard.com/blog/bitbucket-vs-github). ### [Intel Owl](https://github.com/intelowlproject/IntelOwl) Intel Owl is an OSINT tool that gathers threat intelligence data about a specific file, an IP, or a domain through a single API request.  ### [Intelligence X](https://intelx.io/) Intelligence X is a search engine and data archive that Searches Tor, I2P, data leaks, and the public web by email, domain, IP, CIDR, Bitcoin address, and more. ### [Maltego](https://www.maltego.com/) Maltego is an OSINT and graphical link analysis tool for gathering and connecting information for investigative tasks.  ### [O365 Squatting](https://github.com/O365Squad/O365-Squatting) O365 Squatting is a Python tool used to check inputted domains against O365 infrastructure to identify typo-squatted domains that do not appear in DNS requests. ### [OSINT Framework](https://osintframework.com/) The OSINT framework is an online directory that lists open source tools for OSINT gathering, sorted by source type. ### [ReNgine](https://github.com/yogeshojha/rengine) reNgine is an automated reconnaissance framework used for OSINT gathering that streamlines the recon process. ### [Recon-ng](https://github.com/lanmaster53/recon-ng) Recon-ng is an open source intelligence gathering tool used to conduct web-based reconnaissance. ### [Searchcode](https://searchcode.com/) Searchcode is a source code search engine that indexes API documentation, code snippets, and open source (free software) repositories. ### [Shodan](https://www.shodan.io/) Shodan is a search engine used for gathering intelligence information from a variety of [IoT devices](https://www.upguard.com/blog/internet-of-things-iot) like webcams, routers, and servers. ### [Social Mapper](https://github.com/Greenwolf/social_mapper) Social Mapper is an OSINT tool that uses facial recognition to correlate social media profiles across different sites on a large scale. ### [Spiderfoot](https://www.spiderfoot.net/) Spiderfoot is a reconnaissance tool that automatically queries over 100 public data sources (OSINT) to gather intelligence on IP addresses, domain names, email addresses, names, and more. ### [Sublist3r](https://github.com/aboul3la/Sublist3r) Sublist3r is a python tool designed to [enumerate](https://www.upguard.com/blog#cybersecurity) subdomains of websites, using search engines such as Google, Yahoo, Bing, Baidu, and Ask. ### [theHarvester](https://github.com/laramies/theHarvester) theHarvester is a penetration testing tool used to gather information about emails, subdomains, hosts, employee names, open ports, and banners from different public sources like search engines, PGP key servers, and SHODAN computer database. ### [TinEye](https://tineye.com/) TinEye is a reverse image search engine and image recognition tool. ### [ZMap](https://github.com/zmap/zmap) Zmap is a network tool used for Internet-wide network surveys. ## Is OSINT Legal? The US Code defines the legal use of open source intelligence as *"... intelligence that is produced from ****publicly available information**** and is collected, exploited, and disseminated in a timely manner to an ****appropriate audience**** for the purpose of ****addressing a specific intelligence requirement****."* OSINT analysts use specialized recon tools to harvest relevant data. These tools and techniques are legal as they aid in data collection, analysis, and processing from publicly available information.  It's important to note that while OSINT deals with information that anyone on the Internet can find, it often uncovers information that most people do not know is public.  This lack of knowledge is where the 'grey area' exists for OSINT. The legality and ethics of OSINT come down to how vulnerabilities are managed. For example, an organization has accidentally leaked employee credentials on [Amazon S3](https://www.upguard.com/blog/check-your-amazon-s3-permissions-someone-will), a [public storage bucket](https://www.upguard.com/blog/check-your-amazon-s3-permissions-someone-will). The leak is discovered using a code search engine.  A threat actor could discover this leak and exploit it for [social engineering](https://www.upguard.com/blog/social-engineering) or other [cyber attacks](https://www.upguard.com/blog/cyber-attack).  An OSINT analyst could alert the organization accordingly to ensure fast remediation. Given the prevalence of scenarios such as the above, organizations must develop clear frameworks for OSINT to ensure analysts are following correct procedures. Strict [regulatory and compliance requirements](https://www.upguard.com/category/compliance-and-regulations), such as [GDPR](https://www.upguard.com/blog/how-to-be-gdpr-compliant), further highlight the need for concrete ethical guidelines. ## The Dangers of OSINT The accessibility of OSINT appeals to both resourceful security teams looking to [improve their cybersecurity](https://www.upguard.com/blog/reduce-cybersecurity-risk) and cyber attackers with malicious intent. For example, OSINT analysts often leverage OSINT tools to perform network scanning during a [network security assessment](https://www.upguard.com/blog/network-security-assessment). Threat actors can use these same tools to identify network vulnerabilities and exploit them.  They can also gather intelligence to carry out other cyber attacks, such as: * Social engineering, e.g., [phishing](https://www.upguard.com/blog/phishing) and [email spoofing](https://www.upguard.com/blog/email-spoofing) * [Creating botnets](https://www.upguard.com/blog/what-is-a-botnet) to launch [Distributed Denial of Service (DDoS) attacks](https://www.upguard.com/blog/what-is-a-ddos-attack) * [Brute force attacks](https://www.upguard.com/blog/brute-force-attack) * [Doxing](https://www.upguard.com/blog/what-is-doxing) * [Malware injections](https://www.upguard.com/blog/malware), e.g., [spyware](https://www.upguard.com/blog/spyware), [ransomware](https://www.upguard.com/blog/ransomware), and other [types of malware](https://www.upguard.com/blog/types-of-malware) Security teams should have effective [information risk management](https://www.upguard.com/blog/information-risk-management) practices in place to account for abuses of OSINT.  eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 Cybersecurity #### [Top 10 Security Events of 2025](/blog/top-security-events-of-2025) Recap the ten most impactful events that reshaped the cybersecurity industry this year and the critical lessons each had to teach us. Read more here. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Cybersecurity #### [Risk Automations: The Shift From Catch-Up to Command](/blog/risk-automations-shift-catch-up-to-command) Connect intelligence to system execution with Risk Automations, your new resolution layer for risk. Reduce remediation from hours to seconds - read more. [](/team/revashni-moodley) [Revashni Moodley](#) December 1, 2025 Cybersecurity #### [Shai-Hulud's True Lesson for CISOs: A Crisis of Communication](/blog/shai-hulud-lesson-for-cisos) Shai-Hulud was driven by a communication crisis between security and engineering. Get a CISO's perspective on how to finally bridge this gap. [](/team/phil-ross) [Phil Ross](#) September 3, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)