> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/passive-reconnaissance-techniques/osint-framework.md).

# OSINT Framework

[Open-source intelligence (OSINT)](https://osintframework.com/) involves collecting and analyzing publicly available information from open sources to gather intelligence. It is used in cybersecurity, penetration testing, law enforcement, and corporate security investigations.

### **Sources of OSINT**

OSINT data can be gathered from various sources, including:

#### **Search Engines & Dorks**

* Google Dorking: Advanced search operators to find sensitive data.
* Bing, Yandex, DuckDuckGo: Alternative search engines for different results.
* Shodan & Censys: Discover internet-connected devices and exposed services.

#### **Social Media Intelligence (SOCMINT)**

* UserRecon & Sherlock: Find user profiles on social networks.
* Twitter API & Facebook Graph Search: Extract insights from social media.
* GHunt: Investigate Google accounts and services.

#### **Domain & Website Analysis**

* crt.sh: Fetch SSL/TLS certificates to find subdomains.
* Amass & Sublist3r: Subdomain enumeration.
* Wayback Machine: View historical website versions.
* Wappalyzer & BuiltWith: Detect website technologies.

#### **IP & Network Intelligence**

* Shodan & Censys: Identify internet-facing services & vulnerabilities.
* IPinfo.io & MaxMind: IP geolocation.
* ASN lookup: Identify an organization's network range.

#### **Dark Web & Paste Sites**

* OnionScan: Scans the dark web for hidden services.
* Hunchly: Helps investigate the dark web and social media.
* Pastebin & BreachCompilation: Look for leaked credentials.

#### **Metadata & File Analysis**

* ExifTool: Extract metadata from images and documents.
* VirusTotal & Hybrid Analysis: Analyze files and links for malware.
* FOCA: Find metadata in public documents.

### **Popular OSINT Tools**

| Tool                                                     | Purpose                                       |
| -------------------------------------------------------- | --------------------------------------------- |
| [Recon-ng](https://github.com/lanmaster53/recon-ng)      | OSINT automation framework                    |
| [theHarvester](https://github.com/laramies/theHarvester) | Collect emails, subdomains, and hosts         |
| [Maltego](https://www.maltego.com/)                      | Visual link analysis and intelligence mapping |
| [SpiderFoot](https://github.com/smicallef/spiderfoot)    | Automated OSINT reconnaissance                |