OSINT for Beginners: Reconnaissance from Public Sources

Open-source intelligence (OSINT) is information gathered from public sources. In a penetration test it is the reconnaissance phase: learning about the target organization before touching its systems. Done well, it finds forgotten servers and exposed data that scanners never see. Done carelessly, it becomes an invasion of privacy. This guide covers both sides.

The Limits Come First

• Gather information only for an authorized engagement, and only about the organization in scope
• Collect what the test needs, and no more, especially about individuals
• Do not log in with found credentials or access anything that requires authentication without permission
• Store what you collect securely and delete it as the contract requires
• Respect India's Digital Personal Data Protection Act when handling personal data

Domains and Subdomains

Start with the organization's main domains. Public DNS records, WHOIS data and certificate transparency logs (searchable through services such as crt.sh) reveal subdomains, because every public TLS certificate is logged. Forgotten subdomains, such as old test or staging sites, are a classic source of findings.

Exposed Services

Search engines that index internet-facing devices, such as Shodan and Censys, show which ports and services an organization exposes and what software they run, without you scanning anything. Results must still be checked against the agreed scope before any active testing.

Search Engine Techniques

Advanced search operators ("site:", "filetype:", "inurl:") can surface documents, login pages and error messages an organization did not mean to publish. Look, note and report; do not download sensitive files beyond what proves the issue.

Code and Leaks

Public code repositories sometimes contain an organization's internal hostnames, configuration or, worst of all, keys and passwords. Breach-notification services can show whether company email addresses appeared in known breaches. Report exposed secrets immediately so they can be revoked.

People and the Organization

Company websites, job listings and professional networks show technologies in use, email address formats and roles. This feeds phishing simulations when they are in scope. Limit it to work information; personal lives, families and home addresses are off limits.

Organize What You Find

Keep a structured list: domains, subdomains, IP ranges, technologies, exposed services, and people relevant to the scope, each with its source and date. Tools such as theHarvester and recon frameworks help collect, but the analysis is yours. This list becomes the input to scanning; see penetration testing phases explained.

Learning Reconnaissance

OSINT is an early module of our network and Active Directory course, right after lab setup and scoping, and before Nmap and Nessus. Read is ethical hacking legal in India for the legal background.