What OSINT Is

Open-Source Intelligence

OSINT is the practice of collecting and analysing information that is publicly available. That means data anyone can access without breaking into a system: web pages, public records, social profiles, domain registrations, images, and leaked datasets that have already been made public.

In security work OSINT powers the reconnaissance phase of an engagement. Before touching a target, an authorized tester maps the attack surface: which domains, servers, employees, and technologies exist. In investigations it helps verify identities, trace assets, and confirm facts.

• Passive collection means you never interact directly with the target's systems.
• Active collection touches the target (scanning, probing) and needs explicit permission.
• Analysis turns scattered data points into a coherent picture.

Ethics and legality come first. Public availability does not remove privacy obligations. Collect only what your authorization covers, minimise personal data, respect local law and platform terms, and never use findings to harass or dox individuals.

⚖️ For authorized, legal testing only.

What's in OSINT — Open-Source Intelligence

• 1. What OSINT IsFree
• 2. Advanced Search & Dorking🔒 Techniques
• 3. People-Focused OSINT🔒 People
• 4. Domain & Infrastructure Recon🔒 Infrastructure
• 5. Social Media Gathering🔒 People
• 6. Images & Geolocation🔒 Media
• 7. Automation & Workflows🔒 Tooling
• 8. Protecting Your Footprint🔒 OPSEC
• 9. Writing the OSINT Report🔒 Reporting
• 10. Practical Exam — FHC-OSINT🔒 Certification

Continue in the interactive course reader →