You need Python 3 with Pillow — the imaging library. Install it with
pip install Pillow (or sudo apt install python3-pil), then check
python3 -c "import PIL; print(PIL.__version__)". Everything runs on a photo
you create, so no real person’s data is involved. The output below was
captured by running the code.
💡 OSINT is open-source intelligence — building a picture from information that is already public. It is legal because it touches only what people and organisations published themselves; the skill, and the discomfort, is realising how much that is. Use it defensively here: to see what your own posts give away.
What Is OSINT
Open Source Intelligence (OSINT) is the practice of collecting and analyzing information from publicly available sources to produce actionable intelligence. In the context of ethical hacking and penetration testing, OSINT is the first phase of reconnaissance -- gathering as much information as possible about a target before any active interaction with their systems.
The term "open source" here does not refer to open-source software. It means the information is publicly accessible -- anyone can find it through legitimate channels without needing to bypass access controls, exploit vulnerabilities, or break any laws.
Attackers routinely use OSINT before launching targeted attacks. By performing OSINT on your own organization, you can discover what information is publicly exposed and take steps to reduce your attack surface before a malicious actor exploits it.
OSINT sources include but are not limited to:
- Search engines -- Google, Bing, DuckDuckGo, and specialized search engines
- Social media platforms -- LinkedIn, Twitter/X, Facebook, Instagram, GitHub
- Public records -- WHOIS databases, DNS records, certificate transparency logs
- Web archives -- The Wayback Machine and cached versions of websites
- Code repositories -- GitHub, GitLab, Bitbucket (public repositories)
- Job postings -- reveal internal technologies, software stacks, and security tools
- Government databases -- company registrations, court records, patent filings
Types of Open Source Intelligence
OSINT can be categorized by the type of information being collected and the source it comes from. Understanding these categories helps you structure your research and ensures thorough coverage during an engagement.
Technical OSINT
Technical OSINT focuses on the digital infrastructure of a target. This includes IP address ranges, domain names, subdomains, DNS records, mail server configurations, SSL/TLS certificates, web technologies in use, and exposed services. This type of intelligence directly feeds into the scanning and enumeration phases of a penetration test.
Organizational OSINT
Organizational OSINT involves gathering information about a company's structure, key personnel, business relationships, and internal processes. Employee names and roles (especially IT staff), organizational hierarchies, partner companies, and office locations can all be valuable for social engineering attacks or for understanding the scope of an engagement.
Personal OSINT
Personal OSINT targets individuals -- typically key employees identified during organizational research. Email addresses, social media profiles, public posts, conference presentations, and personal websites can reveal password patterns, security questions answers, or information useful for spear-phishing campaigns.
Even though OSINT uses publicly available information, collecting personal data about individuals requires careful ethical consideration. During authorized penetration tests, only collect personal information that is within the agreed scope. Never use OSINT techniques to stalk, harass, or dox individuals.
Search Engine Techniques
Search engines index vast amounts of publicly accessible data. Advanced search operators allow you to filter results with precision, revealing information that basic searches would miss. This technique is commonly known as "Google dorking" or "Google hacking," though it works across multiple search engines.
Essential Google Search Operators
# Find pages on a specific domain
site:example.com
# Search for specific file types
site:example.com filetype:pdf
# Find pages with specific words in the title
intitle:"index of" site:example.com
# Find pages with specific words in the URL
inurl:admin site:example.com
# Search for exact phrases
"employee handbook" site:example.com
# Exclude results from a specific site
password reset -site:example.com
# Find cached versions of a page
cache:example.comGoogle Dorking for Security Research
Google dorks can reveal misconfigurations, exposed sensitive files, and information that was not intended to be public. During an authorized assessment, these queries can quickly identify low-hanging fruit.
# Find exposed configuration files
site:example.com filetype:env OR filetype:cfg OR filetype:conf
# Find directory listings
intitle:"index of" site:example.com
# Find exposed log files
site:example.com filetype:log
# Find login pages
site:example.com inurl:login OR inurl:signin OR inurl:admin
# Find exposed database files
site:example.com filetype:sql OR filetype:db OR filetype:sqlite
# Find documents that may contain sensitive information
site:example.com filetype:xlsx OR filetype:docx confidentialThe Exploit Database maintains the Google Hacking Database at
exploit-db.com/google-hacking-database, which contains thousands
of proven search queries organized by category. It is a valuable reference
for discovering what types of sensitive information can be found through
search engines.
Social Media OSINT
Social media platforms are rich sources of intelligence. Employees often share information about their workplace, technologies they use, projects they work on, and even security practices -- sometimes without realizing the implications.
LinkedIn is arguably the most valuable social media platform for OSINT in a professional context. It reveals organizational structure, employee roles, technology stacks (from job postings and employee profiles), and business relationships.
- Employee enumeration -- identify IT staff, security team members, and executives
- Technology identification -- skills listed on profiles reveal internal tools and platforms
- Job postings -- open positions describe the exact technologies, certifications, and tools the company uses
- Email pattern discovery -- once you know employee names, you can guess the email format (e.g., first.last@company.com)
GitHub and Code Repositories
Developers frequently push code to public repositories that contains sensitive information. Searching an organization's GitHub presence can reveal API keys, internal IP addresses, database credentials, infrastructure details, and proprietary code.
# Search GitHub for potential secrets in an organization's repos
# (use the GitHub search interface or GitHub API)
org:example-company password
org:example-company api_key
org:example-company secret
org:example-company internalTwitter/X, Reddit, and Forums
Technical staff often discuss work-related problems on public forums. Stack Overflow questions, Reddit posts, and tweets can reveal internal architecture details, software versions, and security misconfigurations. Searching for a company's domain name or product names across these platforms can surface useful leads.
WHOIS and DNS Lookups
Domain registration records and DNS configurations are fundamental OSINT sources for technical reconnaissance. They reveal infrastructure details, hosting providers, email configurations, and sometimes administrative contact information.
WHOIS Lookups
WHOIS queries reveal who registered a domain, when it was registered, when it expires, the registrar used, and sometimes the registrant's name, email, phone number, and physical address. Many domains now use privacy protection services, but older registrations or domains in certain TLDs may still expose this data.
# Command-line WHOIS lookup
whois example.com
# Example output (abbreviated)
Domain Name: EXAMPLE.COM
Registrar: Example Registrar, Inc.
Creation Date: 1995-08-14T04:00:00Z
Registrar Expiration Date: 2025-08-13T04:00:00Z
Name Server: NS1.EXAMPLE.COM
Name Server: NS2.EXAMPLE.COMDNS Record Enumeration
DNS records map domain names to IP addresses and services. Different record types reveal different information about the target's infrastructure.
# Query all DNS record types
dig example.com ANY
# Query specific record types
dig example.com A # IPv4 addresses
dig example.com AAAA # IPv6 addresses
dig example.com MX # Mail servers
dig example.com NS # Name servers
dig example.com TXT # Text records (SPF, DKIM, verification tokens)
dig example.com CNAME # Canonical name aliases
dig example.com SOA # Start of authority
# Attempt a zone transfer (often blocked, but worth trying)
dig axfr example.com @ns1.example.comMX records identify mail servers and their hosting providers. TXT records often contain SPF records listing authorized sending IPs, DKIM keys, and third-party verification tokens (Google Workspace, Microsoft 365, etc.) that reveal what services the organization uses. NS records identify the DNS hosting provider.
OSINT Tools Overview
While manual research is essential, specialized OSINT tools automate the collection and correlation of information. Here are some of the most widely used tools in the OSINT community.
theHarvester
theHarvester is a command-line tool that gathers email addresses, subdomains, hosts, employee names, open ports, and banners from different public sources including search engines, PGP key servers, and the Shodan database.
# Install theHarvester
sudo apt install theharvester
# Search for emails and subdomains associated with a domain
theHarvester -d example.com -b google,bing,linkedin -l 200
# Use all available data sources
theHarvester -d example.com -b allMaltego
Maltego is a graphical link analysis tool that maps relationships between pieces of information. It uses "transforms" to automatically query data sources and visualize connections between domains, IP addresses, email addresses, people, and organizations. The Community Edition is free, while the commercial version offers more transforms and features.
Recon-ng
Recon-ng is a modular web reconnaissance framework written in Python. It provides a command-line interface similar to Metasploit and supports modules for DNS enumeration, contact harvesting, credential discovery, and more.
# Install Recon-ng
sudo apt install recon-ng
# Launch the framework
recon-ng
# Create a workspace for your project
workspaces create example-project
# Add a target domain
db insert domains example.com
# Search for available modules
marketplace search domains
# Install and run a module
marketplace install recon/domains-hosts/hackertarget
modules load recon/domains-hosts/hackertarget
runOther Notable Tools
- Shodan -- a search engine for internet-connected devices; reveals open ports, services, and banners across the internet
- Censys -- similar to Shodan, with a focus on TLS certificates and web server data
- SpiderFoot -- automated OSINT collection with over 200 data source modules
- FOCA -- extracts metadata from documents (PDF, DOCX, XLSX) found on a target's website
- Amass -- comprehensive subdomain enumeration using multiple techniques and data sources
OSINT Methodology
Effective OSINT follows a structured methodology rather than random searching. A disciplined approach ensures thorough coverage and produces organized, actionable results.
Step 1: Define Objectives
Before starting any collection, clearly define what you are looking for and why. In a penetration test, your scope document dictates what is in bounds. Common objectives include mapping the target's external infrastructure, identifying employee email addresses for phishing simulations, or discovering exposed credentials.
Step 2: Identify Sources
Based on your objectives, determine which data sources are most likely to yield relevant results. Technical objectives call for DNS, WHOIS, and Shodan. People-focused objectives call for LinkedIn, social media, and public records.
Step 3: Collect Data
Systematically query each source and record your findings. Use both automated tools and manual searching -- tools are fast but can miss context that a human researcher would catch. Save raw data, screenshots, and timestamps for everything you find.
Step 4: Analyze and Correlate
Cross-reference findings from different sources. An email address found on a breached credentials database combined with a LinkedIn profile showing the same person is an IT administrator creates a high-risk finding. Individual data points become intelligence when correlated.
Step 5: Document and Report
Organize your findings into a structured report. For each finding, document the source, the date collected, the potential security impact, and recommended mitigations. Clear documentation ensures your work is reproducible and actionable for the client.
Keep a running log of every query you execute and every source you check, even if it yields no results. This prevents duplicated effort, proves thoroughness to your client, and helps you refine your approach over time.
Legal and Ethical Considerations
OSINT operates in a legal gray area that varies by jurisdiction. While the information itself is publicly available, how you collect it, store it, and use it may be subject to laws and regulations.
Legal Framework
- Terms of Service -- scraping social media platforms or search engines may violate their terms of service, even if the data is public
- GDPR and privacy laws -- in the EU, collecting personal data (names, emails, photos) requires a legal basis even if the data is publicly available
- Computer access laws -- accessing data through unintended means (even if no password is required) may violate laws like the CFAA in the US
- Data retention -- storing collected personal data creates obligations under data protection regulations
Ethical Guidelines
- Stay within scope -- only collect information relevant to your authorized engagement
- Minimize personal data collection -- do not harvest personal information beyond what is necessary
- Secure your findings -- OSINT reports contain sensitive information; encrypt them and limit access
- Responsible disclosure -- if you discover exposed credentials or sensitive data during research, follow responsible disclosure practices
- No deception -- do not create fake profiles or impersonate others to extract information (this crosses from passive OSINT into social engineering, which requires separate authorization)
Before conducting OSINT against any organization, ensure you have a signed agreement that explicitly authorizes information gathering. Even passive reconnaissance can raise legal concerns if conducted without permission. For practice, use intentionally vulnerable targets, CTF challenges, or your own infrastructure.
Now Do It Yourself: Pull Secrets From a Photo in Five Steps
People share photos constantly, unaware that the image file often carries a hidden record of the camera, the exact moment, and the precise spot on Earth where it was taken. You will embed that hidden data into a photo the way a phone does, extract the device and timestamp, pull GPS coordinates you can drop onto a map, then strip it all back out — the one habit that protects you. Every block of output below was produced by running the code.
Go: a terminal in a writable folder.
Do: save this as make.py and run it. It writes a small image
with the same EXIF fields a smartphone stamps into every photo: make, model, software,
timestamp, and GPS.
from PIL import Image
img = Image.new("RGB", (64, 64), (120, 140, 160))
exif = Image.Exif()
exif[0x010F] = "Apple" # Make
exif[0x0110] = "iPhone 13 Pro" # Model
exif[0x0131] = "16.5.1" # Software
exif[0x9003] = "2026:07:14 18:42:11" # DateTimeOriginal
exif[0x8825] = {1:"N", 2:(51.0,30.0,26.0), 3:"W", 4:(0.0,7.0,39.0)} # GPS
img.save("photo.jpg", exif=exif.tobytes())
print("wrote photo.jpg")You should see: wrote photo.jpg, and a new
photo.jpg in the folder. To the eye it is a plain grey square; the interesting
part is what is stitched invisibly into the file.
If not: No module named 'PIL' means Pillow is not installed
— see Before you start. A bad operand error on the GPS line means
the coordinates were written as tuples of pairs; keep them as the plain floats shown.
Go: the same folder.
Do: save this as read.py and run it. This is what every OSINT
tool does to a photo — walk the EXIF tags and print them by name.
from PIL import Image
from PIL.ExifTags import TAGS
ex = Image.open("photo.jpg").getexif()
for tid, val in ex.items():
name = TAGS.get(tid, hex(tid))
if name != "GPSInfo":
print(" %-18s %s" % (name, val))You should see: the photo confess what took it and when:
DateTimeOriginal 2026:07:14 18:42:11
Make Apple
Model iPhone 13 Pro
Software 16.5.1Already this is a lot: the device model, the OS version (useful for targeting), and the exact second the shutter fired. A “casual” photo just placed someone with a specific phone at a specific instant.
If not: if nothing prints, the file has no EXIF — some apps strip it
(which is the good outcome of step 4). Re-run make.py to get a photo that
still carries it.
Go: the same read.py, extended.
Do: read the GPS sub-block and convert its degrees/minutes/seconds into the decimal coordinates a map understands.
gps = ex.get_ifd(0x8825)
def dms(v): return float(v[0]) + float(v[1])/60 + float(v[2])/3600
lat = dms(gps[2]) * (-1 if gps[1] == "S" else 1)
lon = dms(gps[4]) * (-1 if gps[3] == "W" else 1)
print(" GPS %.5f, %.5f" % (lat, lon))You should see: a coordinate pair you can paste straight into any map:
GPS 51.50722, -0.12750Drop that into a map and it lands on a specific street. This is why a holiday photo can reveal a home address, and why geotagged posts have exposed military bases and safe houses. The photo never said where it was — the file did.
If not: a KeyError or empty gps means the photo
has no location tags — most do not, which is good for privacy. Your generated
photo.jpg does, so the demo works.
Go: the same folder.
Do: save this as strip.py and run it. It copies the pixels
into a fresh image with no metadata attached, then proves the metadata is gone.
from PIL import Image
img = Image.open("photo.jpg")
clean = Image.new(img.mode, img.size)
clean.putdata(list(img.getdata()))
clean.save("photo_clean.jpg") # no exif= -> no metadata
print("original :", len(Image.open("photo.jpg").getexif()), "EXIF tags")
print("cleaned :", len(Image.open("photo_clean.jpg").getexif()), "EXIF tags")You should see: the metadata vanish entirely:
original : 6 EXIF tags
cleaned : 0 EXIF tagsThe cleaned image looks identical but carries nothing. Most social networks strip EXIF on upload — but not all, and not when you send the original file directly (email, chat, cloud links), so stripping it yourself before sharing is the reliable habit.
If not: if the cleaned file still shows tags, you passed exif=
to save by mistake — omit it entirely, as shown.
Go: think beyond one photo. Metadata is one thread; OSINT is pulling many.
Do: line up the common passive techniques against what each reveals, all from public sources.
photo EXIF -> device, time, GPS (this tutorial)
reverse image -> where else a photo appears
username search -> the same handle across sites (e.g. the 'sherlock' tool)
email harvest -> addresses tied to a domain (e.g. 'theHarvester')
search operators -> exposed files and pages (the Google Dorking tutorial)
cert transparency -> a target's subdomains (the Passive Recon tutorial)You should see: that no single source is the whole picture; investigators and attackers alike combine them. The defensive takeaway is symmetrical: assume anything you make public will be collected and cross-referenced, so decide what is public on purpose — strip metadata, separate identities, and do not post what maps you to a place and time.
If not: these tools reach out to the internet, so run them only against yourself or with authorisation — OSINT is legal precisely because it reads public data, and it stops being harmless the moment you act on it against someone without consent.
Without scrolling up: a friend posts a photo taken “somewhere on holiday” and insists it gives nothing away because they never said where. Using only the file, name three things you could still learn, and the one action that would have prevented it. Answer: the EXIF can reveal the exact GPS location, the precise date and time, and the phone model and OS version — none of which they typed. Stripping the metadata before posting (step 4), or trusting a platform that strips it, would have removed all three. The photo, not the caption, is the leak.
Now do it without the page: take a real photo from your own phone that you
have not posted anywhere, copy it to your computer, and run your read.py on it.
See for yourself whether your phone geotags by default — then find the setting that
turns location off for the camera, and confirm a new photo comes out clean.
Summary
In this tutorial, you learned the fundamentals of Open Source Intelligence:
- OSINT definition -- collecting and analyzing publicly available information to produce actionable intelligence
- Types of OSINT -- technical, organizational, and personal intelligence each serve different objectives
- Search engine techniques -- Google dorking with advanced operators like
site:,filetype:,intitle:, andinurl: - Social media research -- LinkedIn, GitHub, and forums reveal technology stacks, employee details, and internal infrastructure
- WHOIS and DNS -- domain registration and DNS records map infrastructure and identify hosting providers
- OSINT tools -- theHarvester, Maltego, Recon-ng, Shodan, and others automate collection at scale
- Structured methodology -- define objectives, identify sources, collect, analyze, and document
- Legal and ethical boundaries -- always operate within scope, respect privacy laws, and secure your findings
You now understand the foundations of OSINT and how it fits into the reconnaissance phase of ethical hacking. Mastering OSINT will make you a more effective security professional by helping you see your targets the way an attacker would -- through publicly available information.