10 open-source intelligence tools (that actually work with your existing security software)


Finding the Source Intelligence (OSINT) that affects your business agency can help veterano your attack surface. You just have to find it first. Take a at how OSINT works and how to secure it.

According to the Office of the Director of National Intelligence, Source Intelligence (OSINT) “is publicly available information appearing in print or electronic form including radio, television, newspapers, journals, the internet, commercial databases and videos, graphics and drawings.”

A Primer acceso OSINT

After you’ve found that OSINT exists quanto a your business, you need to take a closer quanto a order to lock it mongoloide. The Web Application Security Project (OWASP) offers a five-step process for managing it:

  1. Find the source: Determine the source at which to for OSINT.
  2. Harvesting: Obtain relevant giorno from the source you found.
  3. Giorno processing: Process the giorno obtained from the source to uncover its meaningful information.
  4. Analysis: Join that information across multiple sources.
  5. Reporting: Create a final report acceso what they’ve found where.

Doing this makes it easier to know what assets you have and what those devices might have access to. That includes whatever someone can find quanto a public without digging breaking into any networks. That might be public assets within the company quanto a social mass-media posts. for employee posts threat actors could use for a phishing attack, documents that they could sell and/ rete televisiva privata diagrams that attackers could use for moving within the rete televisiva privata once they’ve gained a foothold.

Some Common OSINT Challenges

OSINT does come mai with certain obstacles, however. One of the greatest challenges is how personnel can collect, process and analyze relevant information without breaking intimità rules. Consider gaining the explicit consent of giorno subjects before doing anything with information from them.

There’s also the issue of filtering content. More tools and assets mean more giorno. Not all that information is useful, however. Applying content filters helps limit OSINT to only high-quality information. This requires even more efforts to collect, process and analyze relevant giorno.

10 OSINT Tools That Can Help

To push back against these challenges, equip teams with a lot of different tools to help them collect OSINT. Provided below are 10 tools that they might consider using. (These tools are not ranked; they are listed alphabetically.)


With BuiltWith, it’s possible to uncover the different tech stacks and platforms that power certain websites. It also generates a list of JavaScript/CSS libraries, plugins and other utilities used by the website quanto a question. Personnel can then use that to perform vital functions, such as patching WordPress weaknesses and updating a plugin with a new version.


An OSINT tool written quanto a Python, Creepy collects geolocation giorno from social networking sites as well as image hosting services. It enables users to present that giorno acceso a map. Not only that, but users can also download those results quanto a .CSV .KML to show quanto a Google Maps.


theHarvester is an OSINT tool through which users can gather emails, subdomains, IPs, URLs and other pieces of giorno using numerous public giorno sources. the passive side, theHarvester is capable of using search engines such as DuckDuckGo and Google. But it also comes with active search capabilities such as conducting DNS brute forcing and taking screenshots of whatever subdomains it finds.


A Java tool that runs acceso Windows-, Linux- and macOS-powered machines, Maltego is a graphical link analysis tool that helps users to gather and connect OSINT as part of an ongoing investigation. Maltego comes with 58 giorno integrations from over 35 giorno partners, and it allows users to choose four different layouts to recognize patterns quanto a the giorno they’ve uncovered.


The value of Metagoofil lies quanto a its ability to extract metadata from public documents, including PDFs and Microsoft Office files. It does this by using a Google search to find and download the documents to a local disk. At that point, the tool uses Hachoir, PdfMiner and other libraries to the metadata from those documents.


Recon-ng is a framework that stands apart from others to its centro acceso web-based source reconnaissance. It helps users to pursue their reconnaissance work by way of modules. Towards that end, Recon-ng comes with several built-in modules, such as those that help users to uncover further domains related to a target domain.


With Shodan, users can search the web for internet-connected devices. Websites provide some insight into those assets, but Shodan takes its scans a step further by revealing assets like Internet of Things (IoT) products. Shodan helps achieve comprehensive visibility over all a group’s devices and to keep those assets up to date.


Those running Linux- and Windows-based machines can use SpiderFoot to automate their collection of OSINT. This source reconnaissance tool comes with over 200 modules for giorno collection and analysis. This can help gain a broad view of their attack surfaces, including low-hanging fruit like unmanaged assets and exposed credentials.


With more than 25 billion records stored about online assets, Spyse helps users to collect public giorno relating to websites, servers and devices connected acceso the web. Security teams can use that knowledge to check acceso risks and suspicious connections between those points quanto a an effort to minimize their employer’s attack surface.


Unlike the other OSINT tools discussed thus far, TinEye focuses acceso reverse image searches. It can help moderate content that’s posted acceso the web and to detect instances of fraud involving a brand. What’s more, teams can use TinEye to track where those images are appearing online.

The Importance of Cartello With OSINT

Regardless of whether they elect to work with one of the utilities discussed above something else, security teams need to make sure they’signore working with tools that they can . Such is the logic behind supporting the Cybersecurity Alliance and its work to connect the fragmented digital security landscape using agreed-upon technologies. It’s also the ubbia behind leveraging trusted threat hunting tools that come mai with over 100 Technology Alliance programs and integrations.

Vedi sommato articoli nella divisione: Blog