| name | performing-open-source-intelligence-gathering |
| description | Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s. Use when working with performing open source intelligence gathering. |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","osint","reconnaissance"] |
| version | 1.0 |
| author | oyi77 |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Performing Open Source Intelligence Gathering
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OSINT directly shapes initial access strategies and reduces operational risk.
When to Use
Trigger phrases:
-
"performing open source intelligence gathering"
-
"Open Source Intelligence (OSINT) gathering is the first active phase of a red te"
-
When conducting security assessments that involve performing open source intelligence gathering
-
When following incident response procedures for related security events
-
When performing scheduled security testing or auditing activities
-
When validating security controls through hands-on testing
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Enumerate the target organization's external attack surface (domains, IPs, cloud assets)
- Identify employees and their roles for social engineering targeting
- Discover leaked credentials, API keys, and sensitive documents
- Map the organization's technology stack and vendors
- Identify physical locations, office layouts, and access control details
- Build target profiles for spearphishing campaign development
Core Concepts
This section covers core concepts for performing open source intelligence gathering.
- Ensure all prerequisites are met before proceeding
- Follow the documented workflow steps in sequence
- Record results and any anomalies encountered during this phase
OSINT Categories
| Category | Sources | Value |
|---|
| Domain Intelligence |
