📖 What is Open Source Intelligence (OSINT)?
Open Source Intelligence (OSINT) is the process of collecting and analyzing information from publicly available sources to gather intelligence on a target. This includes social media, public records, domain registration data, and search engine results to identify potential attack vectors during the reconnaissance phase.
"Remember that OSINT is passive reconnaissance; you are gathering data without interacting directly with the target's systems, which keeps your activity undetected by their security logs."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Open Source Intelligence (OSINT)?
- ▸ Passive Reconnaissance: OSINT is a passive technique, meaning the tester gathers data without interacting directly with the target's infrastructure, avoiding detection by security logs.
- ▸ Search Engine Dorking: Using advanced operators like site:, filetype:, and intitle: to find leaked documents, exposed configuration files, or hidden administrative panels on the public web.
- ▸ WHOIS and DNS Enumeration: Analyzing public registration records and DNS entries to identify domain ownership, registered IP ranges, and mail server configurations for the target.
- ▸ Social Media Intelligence: Leveraging platforms like LinkedIn and X to identify employee roles, organizational hierarchies, and technical stacks mentioned in job postings or profiles.
- ▸ IoT Search Engines: Utilizing specialized tools like Shodan or Censys to find internet-facing devices, open ports, and outdated service banners without scanning the target directly.
🎯 How does Open Source Intelligence (OSINT) appear on the PT0-002 Exam?
You may be asked to identify the most stealthy method for gathering information about a target's external attack surface without triggering an Intrusion Detection System (IDS) alert.
A scenario might describe a tester using advanced Google search queries to find sensitive PDF documents on a corporate site; you will need to identify this as OSINT.
Expect questions where you must distinguish between active and passive reconnaissance, specifically identifying which tools, such as WHOIS or Shodan, are categorized as OSINT techniques.
❓ Frequently Asked Questions
What is the primary difference between OSINT and active reconnaissance?
OSINT is passive; you interact with third-party sources like search engines or public registries. Active reconnaissance involves direct interaction with the target's systems, such as port scanning, which is detectable by the target's security monitoring tools.
How does OSINT support the social engineering phase of a penetration test?
OSINT allows testers to build detailed profiles of employees. By analyzing social media, testers can find names, job titles, and professional interests, which are used to craft highly convincing and targeted phishing emails.