Lesson 4 — OSINT Techniques
OSINT (Open Source Intelligence) is the art of collecting publicly available information. Done correctly, it is completely legal and extremely useful for research, investigations, and security assessments.
What Counts as OSINT
OSINT covers any information that is publicly accessible: social media profiles, public records, company websites, domain registration data, news articles, and metadata embedded in public files. If it required no special access or hacking to obtain, it is generally considered OSINT.
Username Enumeration
Many people reuse the same username across multiple platforms. Checking whether a given username exists on various sites can help build a picture of someone's public online presence, without needing to log in or bypass any security.
Domain and WHOIS Intelligence
WHOIS records can reveal who registered a domain, when it was created, and which name servers it uses. This is public registry data that anyone can query.
DNS and Infrastructure Mapping
Looking up a domain's DNS records (A, MX, NS, TXT) shows how its infrastructure is organized: which mail provider it uses, which servers respond to requests, and how subdomains are structured.
Social Media Footprint Analysis
Public posts, profile information, and metadata on photos can reveal far more than people realize. Understanding this helps both investigators and everyday users protect their own privacy.
Staying Within Legal Boundaries
OSINT should only use information that is already public. Do not attempt to access private accounts, bypass authentication, or use social engineering to trick someone into revealing information. Always respect local laws and platform terms of service.