| name | performing-open-source-intelligence-gathering |
| description | Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s |
| domain | cybersecurity |
| subdomain | red-teaming |
| tags | ["red-team","adversary-simulation","mitre-attack","exploitation","post-exploitation","osint","reconnaissance"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
| nist_csf | ["ID.RA-01","GV.OV-02","DE.AE-07"] |
Performing Open Source Intelligence Gathering
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OSINT directly shapes initial access strategies and reduces operational risk.
When to Use
- When conducting security assessments that involve performing open source intelligence gathering
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Most Often Missed & How to Confirm
- Breach/credential dumps: check HaveIBeenPwned, Dehashed, and public combolists for
@target.com creds — often the fastest path to initial access and the most-skipped source.
- Code & secret leakage: GitHub dorking (
org:target "password", filename:.env), gists/GitLab, and trufflehog/gitleaks over public repos surface live API keys and tokens.
- Attack surface: enumerate subdomains with
amass/subfinder plus certificate transparency (crt.sh), then resolve to find live hosts — never rely on a single source.
- People & email convention: LinkedIn +
hunter.io to derive the username/email format and org chart for spraying and phishing.
- Document metadata:
exiftool/FOCA on public PDFs/Office files leaks usernames, software versions, and internal paths.
- Confirm before reporting: validate that a leaked credential/asset is actually live (in-scope auth test, DNS resolves). Don't conclude "nothing found" until passive (CT logs, breach/paste sites) AND active (subdomain brute, GitHub dorks) sources are exhausted.
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
