OSINT (Open Source Intelligence) is the discipline of gathering and analysing information from publicly available sources — websites, social media, leaked databases, public records, news, search engines, code repositories — for security or intelligence purposes. Used legitimately by penetration testers (reconnaissance phase), threat intelligence analysts, journalists, law enforcement, and corporate due diligence teams. Used adversarially by attackers preparing targeted attacks (spear phishing, social engineering). OSINT is legal when sources are publicly accessible and obtained without unauthorised access; ethical use is the difference between research and surveillance.

Eight common tools: (1) **Maltego** — graph-based link analysis, visualises relationships between entities (people, domains, IPs, social profiles), (2) **Shodan** — search engine for internet-connected devices; reveals exposed services, IoT, ICS, (3) **theHarvester** — email/subdomain/host enumeration from public sources, (4) **SpiderFoot** — automated OSINT scanner; 200+ integrated modules, (5) **Censys** — internet-wide scanning data, certificate transparency monitoring, (6) **Have I Been Pwned** — breach data search, (7) **OSINT Framework** (osintframework.com) — directory of hundreds of OSINT tools by category, (8) **SOCMINT tools** (Twint for X/Twitter, etc.) — social media intelligence. Specialised: GHunt (Google account info), Sherlock (username search across 400+ sites), Recon-ng (modular framework), FOCA (metadata extraction).

Eight categories of intelligence: (1) **Network footprint** — domains, subdomains, IP ranges, ASNs, exposed services, (2) **Technology stack** — what software, frameworks, cloud providers an organisation uses (Wappalyzer, BuiltWith, Shodan), (3) **Email addresses and patterns** — `firstname.lastname@company.com` schema reveals employees, (4) **Employee information** — LinkedIn, social media, conference talks, job postings (revealing internal tools), (5) **Document metadata** — author names, software versions, usernames in PDFs/Office files (FOCA), (6) **Code and credentials** — leaked tokens on GitHub/GitLab, public S3 buckets, (7) **Physical security** — Google Maps, Street View, drone footage, building photos, (8) **Personal information** — combining public records, social media, breach data to build target profiles for spear phishing or extortion.

OSINT typically forms the **Reconnaissance** phase (MITRE ATT&CK Tactic) of targeted attacks: (1) **Identify targets** — find executives, finance staff, IT admins via LinkedIn, company website, (2) **Build profiles** — gather information for spear phishing personalisation (recent meetings, projects, hobbies), (3) **Map infrastructure** — discover public-facing systems, cloud accounts, dev/staging environments, (4) **Find exposures** — leaked credentials, exposed databases, misconfigured S3 buckets, GitHub secrets, (5) **Pre-text development** — gather enough information to make pretexting calls (vishing) believable, (6) **Vendor and supply chain mapping** — identify weak third-party links. The 2020 Twitter Bitcoin scam and many 2023-2025 BEC attacks started with OSINT reconnaissance. AI-assisted OSINT (LLMs analysing scraped data at scale) has accelerated targeting.

Six defensive applications: (1) **Attack surface management** — scan your own external footprint as attackers would; products: Mandiant Attack Surface Management, Microsoft Defender External ASM, RandoriRecon, Censys ASM, (2) **Threat intelligence** — track threat actor TTPs from public reports, dark web monitoring, (3) **Brand monitoring** — detect typosquatted domains, fake social profiles, leaked credentials (Have I Been Pwned API for employee monitoring), (4) **Insider threat indicators** — public posts revealing dissatisfaction, financial stress, (5) **Pre-engagement** — pentest scoping uses OSINT to define realistic adversary view, (6) **Executive protection** — monitor for doxxing, threats, deepfakes targeting leadership. Mature programmes have continuous OSINT monitoring (CTI team) and quarterly external posture assessments.

Eight controls: (1) **Document metadata stripping** — sanitise PDFs/Office files before publishing (remove author, internal paths), (2) **GitHub/GitLab secret scanning** — automated detection (GitGuardian, TruffleHog) prevents credential leaks, (3) **Subdomain enumeration audit** — periodically scan your own domains for forgotten dev/staging/admin subdomains, (4) **Cloud bucket monitoring** — scan for public S3/Azure Blob/GCS, (5) **Social media policy** — train employees not to post sensitive details (project names, internal tools, executive schedules), (6) **Job posting hygiene** — avoid revealing internal tech stack in detail, (7) **DNS hygiene** — restrict zone transfers, monitor DNS records, (8) **Privacy on executive profiles** — limit personal information exposure for high-value targets. Also: monitor for typosquatted domains and brand abuse.

OSINT itself is generally legal — gathering information from publicly available sources doesn't violate laws. But edge cases exist: (1) **Cross-border data** — GDPR applies to processing EU resident data even from public sources; collecting at scale may require legal basis, (2) **Database aggregation** — combining public sources into a database may have stricter rules in some jurisdictions, (3) **CFAA / Computer Misuse Act** — if 'public' sources require authentication or terms of service violation, use may be illegal (US Hi-Q vs LinkedIn case ongoing), (4) **Stalking laws** — sustained personal targeting may cross legal lines, (5) **Industry regulations** — financial KYC, healthcare due diligence have specific requirements. For corporate OSINT (penetration testing, threat intelligence): document your scope and authorisation, comply with privacy regulations, avoid actions that could be construed as unauthorised access.