OSINT Framework 101.

OSINT means finding useful facts in sources anyone can reach. Examples are company websites, domain records, news, code repositories and social media posts. Nothing is hacked and no login is bypassed.

Investigators, journalists and security teams use it. So do attackers, which is why defenders should know what the public can learn about their company. Our glossary entry on open-source intelligence gives the short definition.

It helps to think of OSINT as a way to answer a question, not as a list of tools. A question like “what can a stranger learn about our finance team?” leads you to the right sources much faster than starting with a tool and seeing what it shows. The framework helps once you have the question.

The OSINT Framework is a website that lays out OSINT resources as a tree. You start from a category, open a branch and reach a list of tools for that task. Its own description says it focuses on gathering information from free tools or resources and aims to help people find them.

It is a directory, not a tool. It does not run searches for you. It points to other sites and programs, and those are maintained by other people.

It is also not a methodology. Do not confuse it with a step-by-step investigation method. It tells you where tools are, not how to run a case.

Each entry carries a small mark that tells you what to expect before you click.

• T: a tool you install and run on your own machine.
• D: a Google dork, which is a search technique built on search operators.
• R: the site asks you to register.
• M: the link needs manual editing, because you must put your own search term into the address.

Check these marks first. A tool you install needs a safe place to run, and a site that needs registration means you share an account with a third party.

There is no single best list of OSINT tools. The best tool is the one that answers your question. Start from the question, then look for a tool.

• Write the question first, for example “which subdomains of ours are visible?”
• Prefer tools whose source and owner you can check.
• Test on your own assets before anything else.
• Keep a note of what you ran, when and what it returned.
• Treat results as leads. Confirm them before you act.

For examples of how individual tools work, see our posts on Recon-ng, gOSINT and OSINT tools for the dark web.

A short, repeatable routine beats a large one-off project. Pick one question per session and keep the scope to your own organization.

Step 1: Name what you own

Write down your main domain, known subdomains, brand names and the names of the executives and teams that are public. This is your list of search terms.

Step 2: Search with those terms

Run each term through the tool types the framework lists: domain and DNS lookups, search engines, code hosting sites, social networks and leak databases. Note anything that surprises you.

Step 3: Sort and assign

For each finding, decide who owns it, how serious it is and what the fix is. A forgotten test server is an infrastructure task. A leaked password is an identity task. A fake profile is a brand task.

Step 4: Repeat

Run it again on a schedule. New assets appear, staff post new things and old data resurfaces.

Most OSINT problems come from habit, not from missing tools.

• Collecting everything and reading nothing. Decide what you need before you start.
• Trusting one source. Cross-check an important finding with a second one.
• Running unknown tools on a work laptop. Use an isolated machine for tools you have not vetted.
• Forgetting to record the date. A finding without a date is hard to compare with the next run.
• Stopping at discovery. A finding only helps once someone owns the fix.

The most useful defensive habit is to look at your company the way an outsider would. This is reconnaissance turned around.

• List the domains, subdomains and services that answer from the internet.
• Look for staff details, documents and code that reveal more than intended.
• Check whether company names, domains or accounts appear in leaked data.
• Find lookalike domains and fake profiles that copy your brand.

One related technique is the Google dork. Our guide on Google dorking for defenders shows how to use it on your own exposure.

Public does not always mean free to use. Collecting personal data can be restricted by law, and rules differ by country. Ask your legal team before you build a routine that collects data about people.

Manual OSINT also does not scale. Assets change daily, and a one-off check goes out of date fast. Many teams move from manual checks to continuous monitoring of their attack surface. Brandefense External Attack Surface Management does this for the internet-facing side. Our EASM 101 guide explains the idea.

• OSINT Framework: the directory, its legend and its own description.
• MITRE ATT&CK: the common vocabulary for attacker methods, including reconnaissance.
• CISA: public guidance for defenders on reducing exposure.