Top 5 OSINT Techniques Cybersecurity Professionals Must Know

Open-source intelligence (OSINT) refers to all information available publicly and legally about an individual or organization. In practice, OSINT information includes both online and offline (e.g., paper newspapers and magazines, other media types such as radio and TV broadcasts) public resources. However, with the proliferation of the internet and the widespread use of social media platforms among the public, most OSINT resources are now gathered from the internet.

In today’s information age, OSINT becomes incorporated into many IT security fields. For example, corporations use it to predict threats coming from cyberspace, white hat hackers, and friendly penetration testers utilize its techniques to discover vulnerabilities in IT systems. Black hat hackers and other malicious actors use it to gather intelligence about their targets before launching attacks efficiently.

OSINT is not just about tools; one cannot become an OSINT expert by just utilizing search tools. The essence of OSINT is knowing where information can be found online—after identifying the data sources, combining knowledge of advanced search techniques in with utilizing the correct tools will give you the desired search results.

In this article, we will cover the most five required OSINT techniques that any OSINT gather should master:

First: Use Google Dorks professionally

Google is the most popular search engine on the planet. Most internet users utilize Google daily to find information online about any subject, and OSINT gatherers are no exception. OSINT professionals should know how to leverage Google’s power by using specialized search operators to precisely look up information. Let’s cover some examples of using advanced Google operators:

1. Use quotes to search for an exact phrase. For example: “threat hunting.”

2. Search a specific website for keywords. For example covid19 site:cnn.com

3. To search for a specific file type, use the filetype operator. For example, to search for the keyword “covid19” that is only included within PDF files in domain name cnn.com, use the following search query: site:cnn.com covid19 filetype:PDF

To search for other file types, within domain names ending with .gov (government websites), we can use this search query: filetype:"xls | xlsx | doc | docx | ppt | pptx | pdf" site:gov "covid19"

4. To find files containing the word password on a specific domain name, use this query:

5. We can find a target website’s sub-domains using the following Google search query:

Offensive Security maintains the Google Hacking Database (GHDB), which contains hundreds of Google dorks exploiting vulnerabilities in websites and discovering other hidden information online.

Second: Using OSINT resources repositories

Collecting information from various resources online is a time-consuming task. Fortunately, many online directories document tools and online services for the processing and analysis of OSINT sources. Following is a list of a few major OSINT tools portals:

__OSINT.LINK __ (www.OSINT.link)

This website lists hundreds of online services and tools that help OSINT gatherers collect and analyze information.

__OSINT Framework __ (www.osintframework.com)

This is another website that lists a huge collection of OSINT tools and links to free resources to harvest information from public sources.

Third: Know how to use Linux

Although it is not mandatory to use Linux OS when conducting OSINT searches, some Linux distributions come equipped with OSINT tools that only work on Linux-based systems. Kali Linux, famous security and penetration testing distribution, comes equipped with a plethora of OSINT gathering tools.

To see a list of the latest information-gathering tools which come preinstalled with the latest Kali Linux edition, go to Kali Linux Tools Listing at https://tools.kali.org/tools-listing and check the “Information Gathering” section.

If you are a newcomer to Linux OS, there are plenty of resources for teaching you how to get started using Linux quickly. The following are great for teaching Linux:

1. Linux Fundamentals
2. CompTIA Linux+
3. Fundamental Linux Administration

Fourth: Learn Python Programming Language

Knowing how to program in Python is not essential for your OSINT gathering works. However, there are many OSINT gathering tools which are built using this famous and easy to learn programming language. To use these tools easily, it is preferred to understand the basic syntax of the Python programming language. The following lists some online resources to learn Python:

1. Intro to Python
2. Python Skills Assessment
3. Beginning Python

Fifth: Become anonymous

As you do your research for OSINT, you will leave digital traces behind that can be used to track you. Becoming anonymous is a key prerequisite for any successful OSINT gathering task, as revealing the searcher’s identity can have dangerous consequences on the searcher and the organization or entity. They requested the investigation, especially when collecting intelligence about criminal organizations.

Becoming anonymous online is not the only prerequisite. It’s just as important to know how to exchange data secretly across hostile environments, like the Internet, and how to secure your data at rest to prevent outside actors from exposing your investigation information. OSINT professionals should also understand how to check their digital footprint and discover what kind of digital traces they are leaving behind.

To remain anonymous online, OSINT gatherers have two options:

1. Using a virtual private network(VPN).
2. Learn How To Use TOR(BSWJ), as it is considered the most secure solution for conducting online investigations privately and anonymously.

Summary

There are many out of the box solutions for conducting OSINT gathering, but tools alone cannot do everything. OSINT gatherers should master several other supportive techniques to get the best results when conducting online investigations.