Using Open Sources (OSINT) in Technology Investigations
Leveraging publicly available information
Using open sources, or OSINT, consists of collecting and analyzing publicly available information, such as social networks, domain records, forums, published leaks and public databases, to complement an investigation's internal evidence.
In practice, OSINT is especially valuable when the investigation involves external actors, since it makes it possible to build profiles of malicious infrastructure, verify claimed identities or find traces the attacker left outside the organization's controlled environment.
Tools such as WHOIS, specialized search engines and domain reputation platforms make it possible, for example, to link an IP address used in an attack with infrastructure previously reported in similar campaigns. The nuance every investigator must keep in mind is that open-source information must be verified and documented with the same rigor as internal evidence, because its public nature doesn't exempt it from errors, deliberate disinformation or manipulation by the actor under investigation.
OSINT tools
Domains and infrastructure
- WHOIS (DomainTools) - domain record lookup: owner, registration dates and associated DNS servers.
- Shodan - search engine for devices and infrastructure exposed on the internet (servers, cameras, IoT).
- Censys - search engine for hosts, certificates and services exposed on the internet.
- SecurityTrails - DNS history and infrastructure data for correlating domains and IPs.
- DNSDumpster - DNS reconnaissance and subdomain mapping for a target domain.
- ViewDNS.info - set of DNS utilities: historical IP, reverse domains, geolocation.
- BuiltWith - identification of the technologies and providers a website uses.
- Netcraft - website and hosting reports and phishing detection.
Reputation and threat analysis
- VirusTotal - analysis and reputation of files, domains, IPs and URLs through multiple antivirus engines.
- urlscan.io - scanning and behavioral analysis of suspicious websites.
- AbuseIPDB - community reports of IP addresses associated with abuse or attacks.
- Talos Intelligence - IP, domain and email reputation from Cisco Talos.
- AlienVault OTX - threat indicator (IOC) sharing platform.
- Hybrid Analysis - public sandbox for analyzing the behavior of malicious files.
Leaks and exposed databases
- Have I Been Pwned - check whether emails and domains were compromised in known data breaches.
- DeHashed - search of leaked credential databases.
- Intelligence X - search engine for leaks, documents and dark web content.
People and social networks
- Sherlock - search for a username across hundreds of platforms.
- Namechk - check the availability/use of the same username across multiple networks.
- Social Searcher - real-time monitoring and search of mentions on social networks.
- Pipl - people search based on emails, names or phone numbers.
Images and metadata
- TinEye - reverse image search to identify an image's origin or previous uses.
- Yandex Images - reverse image search, especially useful for facial recognition.
- ExifTool - extraction of metadata (geolocation, device, date) from files.
Archives and historical content
- Wayback Machine - historical archive of web pages, useful for reconstructing deleted infrastructure or content.
- archive.today - manual capture and preservation of specific web pages.
- Hunter.io - locating and verifying corporate emails associated with a domain.
- EmailRep.io - reputation and risk context of an email address.
Reconnaissance suites and frameworks
- Maltego - link analysis platform for correlating entities (domains, people, infrastructure).
- theHarvester - collection of emails, subdomains and hosts from public sources.
- Recon-ng - modular web reconnaissance framework with multiple integrated sources.
- SpiderFoot - automated OSINT reconnaissance combining dozens of sources.
- OSINT Framework - categorized directory of OSINT tools for different types of investigation.
Advanced search engines
- Google Dorks - advanced search engine techniques for discovering exposed information.
- Wigle.net - mapping of WiFi networks and their geolocation collected by the community.