# 🕵️‍♂️ OSINT Bible 2026

Compilation, procedures, tools and ethics for open source research

⚠️ Ethical Disclaimer

This repository is dedicated to the responsible and ethical practice of Open-Source Intelligence (OSINT). All information, tools, and methodologies provided herein are intended solely for educational, research, and lawful investigative purposes. Users are strongly encouraged to adhere to ethical guidelines, respect privacy rights, comply with applicable laws and regulations, and obtain necessary permissions before conducting any investigations. Misuse of this information for illegal activities, harassment, or violation of privacy is strictly prohibited and may result in legal consequences. By accessing this repository, you agree to use the content responsibly and ethically.

🧭 Quick Index with Buttons

Foundations

Investigation Techniques

Sources & Data

Frameworks & Automation

Specialized

[!TIP]

Apply this Bible in a private workspace: > If you want to turn these methodologies into structured intelligence without exposing case data to third parties, explore Abster Intelligence. It is a free, open-source, and local-first workspace for evidence organization, relationship mapping (Graph Engine), and AI-assisted investigation using your own keys.

1. Fundamentals

2. 4-Step Methodology

• Define question → What do I want to know?
• Identify sources → Table below |
• Collect → Manual + automations |
• Validate and document → Screenshots, hash, date, URL, archive.org |

3. Tools Mind Map

graph TD
    A[OSINT] --> B(Search)
    A --> C(Social Networks)
    A --> D(Geo)
    A --> E(Domain/IP)
    A --> F(DeepDark)
    A --> G(Automate)
    B --> B1(Google Dorks)
    B --> B2(Useful Dorks)
    C --> C1(Twint-fork)
    C --> C2(Maigret)
    C --> C3(Instaloader)
    D --> D1(Overpass-turbo)
    D --> D2(Satellites.pro)
    D --> D3(ExifTool)
    E --> E1(Amass)
    E --> E2(CRT.sh)
    E --> E3(DNSDumpster)
    F --> F1(Onionscan)
    F --> F2(Ahmia)
    G --> G1(Recon-ng)
    G --> G2(SpiderFoot)

4. Internet Search

4.1 Google Dorks – 20 essentials

4.2 Alternative Search Engines

• DuckDuckGo "bangs" → !archive
• Yandex → best results CIS
• Baidu → Asia
• Startpage → no logs
• Shodan → IoT, ICS, SCADA
• Censys → cert + banner
• FOFA → China, free API
• BinaryEdge → global scanning
• Hunter.io → corporate emails
• PublicWWW → search in source code
• SearchCode → search in 75B lines of code
• SimilarSites → similar sites
• Netlas → internet intelligence
• CriminalIP → search in connected internet
• NerdyData → website technologies
• GreyNoise → internet noise
• Intezer Analyze → malware analysis
• Kaspersky OpenTIP → threat scanning
• VirusTotal → file/URL analysis
• AlienVault OTX → threat exchange
• ExploitDB → exploit database
• MalwareBazaar → malware samples
• Malware Domain List → malicious domains
• PhishTank → phishing URLs
• URLhaus → malware URLs
• ThreatMiner → threat intelligence
• YARAify → YARA rules
• PulseDive → IOC search
• ThreatFox → malware IOCs
• Breach Directory → breach searches
• Have I Been Pwned → breach verification
• DNSViz → DNSSEC visualization
• DNSdumpster → DNS enumeration
• SpyOnWeb → related sites
• Yark → archive YouTube
• CovertAction → investigative journalism
• Trellix Research → threat research
• CP Research → Checkpoint research
• Wikistrat → collaborative analysis
• PolySwarm → threat scanning
• HackerOne Hacktivity → public vulnerabilities
• WikiLeaks → leaked documents
• Talos Reports → vulnerability reports
• MalAPI → malware APIs
• UserSearch → user search
• SecureList → Kaspersky blog
• SPLC Hate Map → hate map
• ICSR → radicalization studies
• Militant Wire → militancy analysis
• START Publications → terrorism publications
• SPLC Resources → SPLC resources
• Tracking Terrorism → terrorism tracking
• Mapping Militants → mapping militants
• Naval Institute → naval news
• Institute of International Relations → international relations
• Janes → defense intelligence
• TASS News → Russian news
• Sputnik News → Sputnik news
• PIPS → Pakistan peace studies
• PICSS → Pakistan conflict studies
• Reuters → news agency
• RT → Russia Today
• InternetActivism → humanitarian tools
• IISS → international studies institute
• CFR → council on foreign relations
• SciHub → access to scientific papers
• ResearchHub → research discussion
• IDCrawl → people search
• Osint Industries → email/phone search
• ESPY → phone search
• SUNDERS → surveillance cameras
• Deepinfo → internet intelligence
• Session → private messaging
• Consortium News → independent journalism
• Tutanota → encrypted email
• Committee to Protect Journalists → journalist protection
• SecurityWeek → security news
• NCRI → network contagion research
• Geopolitical Economy Report → geopolitical reports
• The Grayzone → independent journalism
• FlightAware → flight tracking
• FlightRadar24 → flight radar
• MarineTraffic → maritime traffic
• VesselFinder → ship search
• NewspaperArchive → newspaper archives
• The Indian Express → Indian news
• Daily Excelsior → Jammu Kashmir news
• DNA India → Indian news
• Greater Kashmir → Kashmir news
• Nagaland Post → Nagaland news
• RFE/RL → Radio Free Europe
• Akto → API security
• Generated Photos → AI photos
• HDRobots → AI tools directory
• Channel 4 News → British news
• ThreatMon Reports → threat reports
• Israel Datasets → Israeli datasets
• AI Dubbing → AI dubbing
• Budget Key → Israel budget
• Ship Spotting → ship photos
• Broadcastify → police audio
• OpenCelliD → cell tower database
• AviationStack → aviation API
• DocumentCloud → document management
• IDRW → Indian defense
• XFE → X-Force exchange
• Scumware → malware research
• Ukraine Live Cams → Ukraine cameras
• TWN → webcam network
• Opentopia → public webcams
• Transparency → anti-corruption
• Maigret → user search
• OCCRP → organized crime
• Qdorks → dork generator
• Radio Garden → world radios
• LolArchiver OSINT → OSINT search
• BreachBase → breach base
• WorldCam → world webcams
• Webcam Galore → webcams
• WiFi Map → WiFi hotspots
• OpenTrafficCamMap → traffic cameras
• Skyline Webcams → skyline webcams
• Pictimo → world webcams
• Instances.social → Mastodon recommender
• CamHacker → public webcams
• Labs TIB Geoestimation → geographic estimation
• Picarta → photo location prediction
• Tiny Scan → URL scanning
• ZeroDay → zero-day vulnerabilities
• Predicta Search → digital search
• Ventusky → weather maps
• OSV → open source vulnerabilities
• Coalition ESS → exploit scoring
• Validin → attack surface mapping
• CIRCL PDNS → passive DNS
• InTheWild → exploits in wild
• 360 Quake → cyberspace mapping
• Cloudflare Radar → internet trends
• Crisis24 → security risk management
• arXiv → scientific papers

4.3 Archives and snapshots

• Wayback Machine
• CachedView (Google + Archive.is)
• URLScan → capture + DOM + requests
• Ubikron → AI-powered evidence collection & entity extraction
• Screenshot Guru → screen test
• Stored Website → cached pages
• ThreatMiner → IOC context
• YARAify → YARA rules
• PulseDive → IOC search
• ThreatFox → malware IOCs
• Breach Directory → breaches
• Have I Been Pwned → breach verification
• DNSViz → DNSSEC
• DNSdumpster → DNS enumeration
• SpyOnWeb → related sites
• Yark → archive YouTube

5. Social Networks

5.1 Facebook

• Facebook Recover Lookup - Link: Facebook Recover Lookup - Description: Used to check if a given email or phone number is associated with any Facebook account or not.
• Social Searcher - Link: Social Searcher - Description: Allows you to monitor all public social mentions in social networks and the web.
• Lookup-id.com - Link: Lookup-id.com - Description: Helps you find the Facebook ID of anyone's profile or a Group.
• Who posted this - Link: Who posted this - Description: Facebook keyword search for people who work in the public interest. It allows you to search keywords on specific dates.
• Facebook Search - Link: Facebook Search - Description: Allows you to search on Facebook for posts, people, photos, etc., using some filters.
• Facebook Graph Searcher - Link: Facebook Graph Searcher - Description: To search someone on Facebook.
• Facebook People Search - Link: Facebook People Search - Description: Search on Facebook by victim's name.
• DumpItBlue - Link: DumpItBlue+ - Description: helps to dump Facebook stuff for analysis or reporting purposes.
• Export Comments - Link: Export Comments - Description: Easily exports all comments from your social media posts to Excel file.
• Facebook Applications - Link: Facebook Applications - Description: A collection of online tools that automate and facilitate Facebook.
• Social Analyzer - Link: SocialAnalyzer - Social Sentiment & Analysis - Description: a free tool of social media monitoring and analysis.
• AnalyzeID - Link: AnalyzeID - Description: Just looking for sites that supposedly may have the same owner. Including a FaceBook App ID match.
• SOWsearch - Link: sowsearch - Description: a simple interface to show how the current Facebook search function works.
• Facebook Matrix - Link: FacebookMatrix - Description: Formulas for Searching Facebook.
• Who posted what - Link: Who Posted What - Description: A non public Facebook keyword search for people who work in the public interest. It allows you to search keywords on specific dates.
• StalkFace - Link: StalkFace - Description: Toolkit to stalk someone on Facebook.
• Search is Back - Link: Search is Back - Description: ind people and events on Facebook Search by location, relationships, and more!.
• FB-Search - Link: FB-Search - Description: busca por teléfono o correo.
• FB-Posts-scraper - Link: FB-Posts-scraper - Description: (Python).
• FB-Video-downloader - Link: FB-Video-downloader - Description: .

5.2 Instagram

• IFTTT Integrations - Link: IFTTT Instagram integrations - Description: Popular Instagram workflows & automations.
• IMGinn.io - Link: IMGinn.io - Description: view and download all the content on the social network Instagram all at one place.
• Instaloader - Link: Instaloader - Description: Download pictures (or videos) along with their captions and other metadata from Instagram.
• SolG - Link: SolG - Description: The Instagram OSINT Tool gets a range of information from an Instagram account that you normally wouldn't be able to get from just looking at their profile.
• Osintgram - Link: Osintgram - Description: Osintgram is an OSINT tool on Instagram to collect, analyze, and run reconnaissance.
• Toutatis - Link: toutatis - Description: It is a tool written to retrieve private information such as Phone Number, Mail Address, ID on Instagram accounts via API.
• instalooter - Link: instalooter - Description: InstaLooter is a program that can download any picture or video associated from an Instagram profile, without any API access.
• Exportgram - Link: Exportgram - Description: A web application made for people who want to export instagram comments into excel, csv and json formats.
• Profile Analyzer - Link: Profile Analyzer - Description: Analyze any public profile on Instagram – the tool is free, unlimited, and secure. Enter a username to take advantage of precise statistics.
• Find Instagram User Id - Link: Find Instagram User Id - Description: This tool called "Find Instagram User ID" provides an easy way for developers and designers to get Instagram account numeric ID by username.
• Instahunt - Link: Instahunt - Description: Easily find social media posts surrounding a location.
• Musicaldown - Link: Musicaldown - Description: web.

5.3 LinkedIn

• RecruitEm - Link: RecruitEm - Description: Allows you to search social media profiles. It helps recruiters to create a Google boolean string that searches all public profiles.
• RocketReach - Link: RocketReach - Description: Allows you to programmatically search and lookup contact info over 700 million professionals and 35 million companies.
• Phantom Buster - Link: Phantom Buster - Description: Automation tool suite that includes data extraction capabilities.
• linkedprospect - Link: LinkedIn Boolean Search - Description: Build a targeted list of LinkedIn people using boolean search.
• ReverseContact - Link: Reverse Email Lookup - Description: Find Linked Profiles associated with any email.
• LinkedIn Search Engine - Link: Programmable Search Engine - Description: Programmable Search Engine for LinkedIn profiles.
• Free People Search Tool - Link: Free People Search Tool - Description: Find people easily online.
• IntelligenceX Linkedin - Link: IntelligenceX Linkedin - Description: A webbased tool for searching someone on Linkedin.
• Linkedin Search Tool - Link: Linkedin Search Tool - Description: Provides you a interface with various tools for Linkedin Osint.
• LinkedInt - Link: LinkedInt - Description: Providing you with Linkedin Intelligence.
• InSpy - Link: InSpy - Description: InSpy is a python based LinkedIn enumeration tool.
• CrossLinked - Link: CrossLinked - Description: CrossLinked is a LinkedIn enumeration tool that uses search engine scraping to collect valid employee names from an organization.
• Hunter.io - Link: Hunter.io - Description: Find and verify corporate email patterns. 25 free searches per month.

5.4 Twitter/X

• TweetDeck - Link: TweetDeck - Description: Offers a more convenient Twitter experience by allowing you to view multiple timelines in one easy interface.
• FollowerWonk - Link: FollowerWonk - Description: Helps you find Twitter accounts using bio and provides many other useful features.
• Twitter Advanced Search - Link: Twitter Advanced Search - Description: Allows you to search on Twitter using filters for better search results.
• memory.lol - Link: memory.lol - Description: a tiny web service that provides historical information about twitter users.
• SocialData API - Link: SocialData API - Description: an unofficial Twitter API alternative that allows scraping historical tweets, user profiles, lists and Twitter spaces without using Twitter's API.
• Social Bearing - Link: Social Bearing - Description: Insights & analytics for tweets & timelines.
• Tinfoleak - Link: Tinfoleak - Description: Search for Twitter users leaks.
• Network Tool - Link: Network Tool - Description: Explore how information spreads across Twitter with an interactive network using OSoMe data.
• Foller - Link: Foller - Description: Looking for someone in the United States? Our free people search engine finds social media profiles, public records, and more!
• SimpleScraper OSINT - Link: SimpleScraper OSINT - Description: This Airtable automatically scrapes OSINT-related twitter accounts ever 3 minutes and saves tweets that contain coordinates.
• Deleted Tweet Finder - Link: Deleted Tweet Finder - Description: Search for deleted tweets across multiple archival services.
• Twitter Search Tool - Link: Twitter search tool - Description: On this page you can create advanced search queries within Twitter.
• Twitter Video Downloader - Link: Twitter Video Downloader - Description: Download Twitter videos & GIFs from tweets.
• Download Twitter Data - Link: Download Twitter Data - Description: Download Twitter data in csv format by entering any Twitter handle, keyword, hashtag, List ID or Space ID.
• Twitonomy - Link: Twitonomy - Description: Twitter #analytics and much more.
• tweeterid - Link: tweeterid - Description: Type in any Twitter ID or @handle below, and it will be converted into the respective ID or username.
• BirdHunt - Link: BirdHunt - Description: Easily find social media posts surrounding a location.
• Twint-docker - Link: Twint-docker - Description: Download all tweets from a user without API access.
• Sentiment140 - Link: Sentiment140 - Description: Bulk sentiment analysis for tweets via CSV.
• Xquik - Link: Xquik - Description: 122 API endpoints for search, user, post and monitor. API key, USD 0.00015/read.

5.5 Pinterest

• DownAlbum - Link: DownAlbum - Description: Google Chrome extension for downloading albums of photos from various websites, including Pinterest.
• Experts PHP: Pinterest Photo Downloader - Link: Pinterest Photo Downloader - Description: Website providing a tool to download photos from Pinterest.
• Pingroupie - Link: Pingroupie - Description: A Meta Search Engine for Pinterest that lets you discover Collaborative Boards, Influencers, Pins, and new Keywords.
• Tailwind - Link: Tailwind - Description: Social media scheduling and management tool that supports Pinterest.
• Pinterest Guest - Link: Pinterest Guest - Description: Mozilla Firefox add-on for browsing Pinterest without logging in or creating an account.

5.6 Reddit

• F5BOT - Link: F5BOT - Description: Receive notifications for new Reddit posts matching specific keywords.
• Mostly Harmless - Link: Mostly Harmless - Description: A suite of tools for Reddit, including user analysis, subreddit comparison, and more.
• OSINT Combine: Reddit Post Analyzer - Link: OSINT Combine: Reddit Post Analyzer - Description: Analyze and gather information from Reddit posts for OSINT purposes.
• Phantom Buster - Link: Phantom Buster - Description: Automation tool suite that includes Reddit data extraction capabilities.
• rdddeck - Link: rdddeck - Description: Real-time dashboard for monitoring multiple Reddit communities.
• Readr for Reddit - Link: Readr for Reddit - Description: Google Chrome extension for an improved reading experience on Reddit.
• Reddit Archive - Link: Reddit Archive - Description: Archive of Reddit posts and comments for historical reference.
• Reddit Comment Search - Link: Reddit Comment Search - Description: Search for specific comments and conversations on Reddit.
• Redditery - Link: Redditery - Description: Explore Reddit posts and comments based on various criteria.
• Reddit Hacks - Link: Reddit Hacks - Description: Collection of Reddit hacks and tricks for advanced users.
• Reddit List - Link: Reddit List - Description: Directory of popular subreddits organized by various categories.
• reddtip - Link: reddtip - Description: Show appreciation to Reddit users by sending them tips in cryptocurrencies.
• Reddit Search - Link: Reddit Search (realsrikar) - Description: Various tools and websites for searching and discovering content on Reddit.
• Reddit Shell - Link: Reddit Shell - Description: Command-line interface for browsing and interacting with Reddit.
• Reddit Stream - Link: Reddit Stream - Description: Live-streaming of Reddit comments for real-time discussions.
• Reddit Suite - Link: Reddit Enhancement Suite (Chrome Extension) - Description: Browser extension that enhances the Reddit browsing experience with additional features.
• Reddit User Analyser - Link: Reddit User Analyser - Description: Analyze and visualize the activity and behavior of Reddit users.
• redditvids - Link: redditvids - Description: Watch Reddit videos and browse popular video subreddits.
• Reditr - Link: Reditr - Description: Desktop Reddit client with a clean and intuitive interface.
• Reeddit - Link: Reeddit - Description: Simplified and clean Reddit web interface for a distraction-free browsing experience.
• smat - Link: smat - Description: Social media analytics tool that includes Reddit for tracking trends and engagement.
• socidextractor - Link: socidextractor - Description: Extract user information from Reddit and other social media platforms.
• Suggest me a subreddit - Link: Suggest me a subreddit - Description: Get recommendations for new subreddits to explore based on your preferences.
• Subreddits - Link: Subreddits - Description: Directory of active subreddits organized by various categories.
• uforio - Link: uforio - Description: Generate word clouds from Reddit comment threads.
• Universal Reddit Scraper (URS) - Link: Universal Reddit Scraper (URS) - Description: Python-based tool for scraping Reddit data for analysis.
• Vizit - Link: Vizit - Description: Visualize and analyze relationships between Reddit users and subreddits.
• Wisdom of Reddit - Link: Wisdom of Reddit - Description: Curated collection of insightful quotes and comments from Reddit.

5.7 Github

• Awesome Lists - Link: Awesome Lists - Description: A curated list of awesome lists for various programming languages, frameworks, and tools.
• CoderStats - Link: CoderStats - Description: A platform for developers to track and showcase their coding activity and statistics from GitHub.
• Digital Privacy - Link: Digital Privacy - Description: A collection of resources and tools for enhancing digital privacy and security.
• Find Github User ID - Link: Find Github User ID - Description: A web tool for finding the unique identifier (ID) of a GitHub user.
• GH Archive - Link: GH Archive - Description: A project that provides a public dataset of GitHub activity, including events and metadata.
• GitGot - Link: GitGot - Description: A semi-automated, feedback-driven tool for auditing Git repositories.
• gitGraber - Link: gitGraber - Description: A tool for searching and cloning sensitive information in GitHub repositories.
• git-hound - Link: git-hound - Description: A tool for finding sensitive information exposed in GitHub repositories.
• Github Dorks - Link: Github Dorks - Description: A collection of GitHub dorks, which are search queries to find sensitive information in repositories.
• Github Stars - Link: Github Stars - Description: A website that showcases GitHub repositories with the most stars and popularity.
• Github Trending RSS - Link: Github Trending RSS - Description: An RSS feed generator for trending repositories on GitHub.
• Github Username Search Engine - Link: Github Username Search Engine - Description: A search engine to find GitHub usernames based on various filters and criteria.
• Github Username Search Engine - Link: Github Username Search Engine - Description: Another search engine to find GitHub usernames with advanced filtering options.
• GitHut - Link: GitHut - Description: A website that provides statistics and visualizations of programming languages on GitHub.

5.8 Snapchat

• addmeContacts - Link: addmeContacts - Description: A platform to find and connect with new contacts on various social media platforms.
• AddMeSnaps - Link: AddMeSnaps - Description: A website for discovering and adding new Snapchat friends.
• ChatToday - Link: ChatToday - Description: An online chat platform for connecting and chatting with people from around the world.
• Gebruikersnamen: Snapchat - Link: Gebruikersnamen: Snapchat - Description: A website for finding Snapchat usernames.
• OSINT Combine: Snapchat MultiViewer - Link: OSINT Combine: Snapchat MultiViewer - Description: A tool for viewing multiple Snapchat accounts simultaneously.
• Snapchat-mapscraper - Link: Snapchat-mapscraper - Description: A tool for scraping public Snapchat Stories from the Snap Map.
• Snap Political Ads Library - Link: Snap Political Ads Library - Description: Snapchat's library of political ads displayed on the platform.
• Social Finder - Link: Social Finder - Description: A platform to search and discover social media profiles on various platforms.
• SnapIntel - Link: SnapIntel - Description: a python tool providing you information about Snapchat users.
• AddMeS - Link: AddMeS - Description: The 'Add Me' directory of Snapchat users on web.

5.9 WhatsApp

• checkwa - Link: checkwa - Description: An online tool to check the status and availability of WhatsApp numbers.
• WhatsApp Fake Chat - Link: WhatsApp Fake Chat - Description: An online tool to generate fake WhatsApp conversations for fun or pranks.
• whatsfoto - Link: whatsfoto - Description: A Python script to download profile pictures from WhatsApp contacts.

5.10 Skype

• addmeContacts - Link: addmeContacts - Description: A platform to find and connect with new contacts on various social media platforms.
• ChatToday - Link: ChatToday - Description: An online chat platform for connecting and chatting with people from around the world.
• Skypli - Link: Skypli - Description: A website for discovering and connecting with new Skype contacts.

5.11 Telegram

• ChatBottle: Telegram - Link: ChatBottle: Telegram - Description: A directory of Telegram bots for various purposes.
• ChatToday - Link: ChatToday - Description: An online chat platform for connecting and chatting with people from around the world.
• informer - Link: informer - Description: A Python library for retrieving information about Telegram channels, groups, and users.
• IntelligenceX: Telegram - Link: _IntelligenceX: Telegram - Description: IntelligenceX's Telegram tool for searching and analyzing Telegram data.
• Lyzem.com - Link: Lyzem.com - Description: A website to search and find Telegram groups and channels.
• Telegram Channels - Link: Telegram Channels - Description: A directory of Telegram channels covering various topics.
• Telegram Channels - Link: Telegram Channels - Description: A platform to discover and browse Telegram channels.
• Telegram Channels Search - Link: Telegram Channels Search - Description: A search engine to find Telegram channels by keywords.
• Telegram Directory - Link: Telegram Directory - Description: A comprehensive directory of Telegram channels, groups, and bots.
• Telegram Group - Link: Telegram Group - Description: A website to search and join Telegram groups.
• telegram-history-dump - Link: telegram-history-dump - Description: A Python script to dump the history of a Telegram chat into a SQLite database.
• Telegram-osint-lib - Link: Telegram-osint-lib - Description: A Python library for performing open-source intelligence (OSINT) on Telegram.
• Telegram Scraper - Link: Telegram Scraper - Description: A powerful Telegram scraping tool for extracting user information and media.
• Tgram.io - Link: Tgram.io - Description: A platform to explore and search for Telegram channels, groups, and bots.
• Tgstat.com - Link: Tgstat.com - Description: A comprehensive platform for analyzing and tracking Telegram channels and groups.
• Tgstat RU - Link: Tgstat RU - Description: A Russian platform for analyzing and monitoring Telegram channels and groups.

exiftool -a -u foto.jpg | grep -i "gps\|date\|camera"
strip before publishing
exiftool -all= foto_sanitizada.jpg

7.1 Google Dorks – Domains

site:*.target.com filetype:pdf
site:*.target.com intitle:"dashboard"
site:*.target.com intext:"confidential"

8. Deep & Dark Web

OPSEC for .onion

• TailsOS → USB → bridge-Tor → NO extra proxies
• Disable scripts Noscript → max
• Never maximize window (fingerprint)
• Never use VPN + Tor (traffic correlation)
• Use bridges if Tor is blocked
• NoScript to max
• No window resizing
• No downloading to persistent disk

9. Automation (Python)

9.1 Minimum Stack

python -m venv osint-env
source osint-env/bin/activate
pip install twint-fork recon-ng selenium requests beautifulsoup4 shodan

9.2 Mini-OSINT Script – unifies 5 sources

#!/usr/bin/env python3
mini_osint.py
import shodan, requests, json, sys
from bs4 import BeautifulSoup
APIKEY = 'YOURSHODAN_API' s = shodan.Shodan(API_KEY) domain = sys.argv[1]
1. Subdomains via CRT.sh
crt = requests.get(f'https://crt.sh/?q=%25.{domain}&output=json').json()
subs = sorted(set([r['name_value'] for r in crt]))
print('[+] Found subdomains:', len(subs))
2. IPs from resolution
ips = set()
for sub in subs[:20]:  # demo limit
    try:
        ips.add(socket.gethostbyname(sub))
    except:
        pass
3. Shodan quick look
for ip in ips:
    try:
        info = s.host(ip)
        print(ip, info['org'], info.get('vulns', 'N/A'))
    except:
        pass

9.3 Recon-ng – fast workflow

recon-ng
> marketplace install all
> workspaces add target
> use domains-domains/brute_force
> set SOURCE target.com
> run
> use hosts-hosts/resolve
> run
> use reporting/csv
> run

10. Report Templates

---
investigator: your-alias
date: 2025-12-16
objective: "Target Name"
scope: domain + RRSS
status: draft # draft | reviewed | delivered

Executive Summary
(5 lines)
Primary Sources
URL | date | capture hash

Chronology
2024-10-01: Domain registration
2025-01-15: First leak

Annexes
Screenshots folder /annexes/
CSV extracts

11. Legal Considerations

Ethical checklist ☐ Is the source 100% public? ☐ Is the data sensitive PII? → minimize ☐ Is there verifiable public interest? ☐ Can it be de-identified?

12. Extra Resources

Free Books

• Open Source Intelligence Techniques — Michael Bazzell — Official site with book updates, podcast & tools (current edition available on Amazon)
• Bellingcat Resources — Free guides, case studies & methodology articles
• Bellingcat Online Investigation Toolkit — Live, searchable toolkit maintained by Bellingcat
• SANS Reading Room — OSINT — Peer-reviewed whitepapers (free with registration)
• SANS Reading Room — Forensics — DFIR whitepapers, free
• SANS SEC497 OSINT Course — Course outline, free sample content
• NIST SP 800-150 — Guide to Cyber Threat Information Sharing — Official US gov PDF, free
• ENISA Threat Landscape 2024 — Full EU report, free PDF
• UK NCSC Threat Reports — UK government cyber threat reports
• INTERPOL Cybercrime Reports — Official INTERPOL publications hub
• Citizen Lab Publications — Academic research on digital threats, free PDFs
• RAND Open Source Intelligence Research — Peer-reviewed RAND papers
• CSIS Strategic Technologies Program — Think-tank reports on tech & security
• arXiv Cryptography & Security — Academic preprints, fully free
• FIRST.org Best Practices Guides — CSIRT best-practice guides
• MITRE ATT&CK Resources — Framework docs, FAQs, training
• Trace Labs Resources — Missing persons OSINT CTF methodology
• OSINT Dojo — Free daily challenges & training paths
• OSINT Framework — Live searchable tree of OSINT tools
• Awesome OSINT (jivoi) — Curated mega-list, GitHub
• OSINT Collection (Ph055a) — Curated free & actionable resources
• INCIBE-CERT Blog — Spanish cybersecurity articles (free)
• The DFIR Report — Real-world intrusion case studies, free
• Krebs on Security — Investigative cybersecurity journalism
• Cisco Talos Blog — Daily threat intel blog
• EFF Surveillance Self-Defense — Free multilingual guides on privacy & OPSEC
• Pwn.college — Free ASU-hosted security course platform

Courses / Certifications

• SEINT (SANS 487)
• OSINT-Do-jo – daily challenges

Communities

• Telegram: OSINT Latam
• Discord: OSINT Español
• Reddit: r/OSINT

13. AI Intelligence

| Tool | Function | URL | Note | |---|---|---|---| | anonchatgpt | Anonymous ChatGPT client | https://anonchatgpt.com | No account needed | | ai-toolkit | Essential AI toolkit for journalists | https://huggingface.co/spaces/JournalistsonHF/ai-toolkit | Free and open-source | | ChatPDF | Ask questions to PDFs | https://www.chatpdf.com/ | Simple and free | | Monica | ChatGPT copilot in Chrome | https://monica.im/ | Summarize, translate | | BabelX | Multilingual OSINT platform | https://www.babelstreet.com | 200+ languages | | Fivecast | Predictive analysis with ML | https://www.fivecast.com | Real-time threat detection | | HyperVerge | Deepfake detection | https://hyperverge.co | AI biometric verification | | ShadowDragon | Social Darkint with AI | https://shadowdragon.io | Behavior analysis