Offensive Osint

Offensive OSINT Methodology

Workflow

1. Define target scope (domain, org, person, crypto address, or geo subject)
2. Select applicable categories below based on scope
3. Work top-down within each category; pivot on discovered artifacts
4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
5. Log findings in JSONL with a run_id and tool versions for reproducibility
6. Suggest next steps based on what each tool returns

General OSINT

• Bookmarks — Comprehensive OSINT bookmarks
• OSINT Framework — Tool/resource directory
• IntelTechniques Tools — Suite of investigative tools
• Bellingcat Toolkit — Investigative journalism tools
• CyberSudo OSINT Toolkit — OSINT websites list
• Google Dorks — Efficient Google searching
• Distributed Denial of Secrets — Leaked data
• Country-Specific Resources — Country-targeted OSINT

Search Engines

Username & Email Investigation

Browser extensions: GetProspect, SignalHire

People Search

• TruePeopleSearch — Free U.S. people search
• WhitePages — Contact information
• Spokeo — People search engine
• Webmii — People search
• Pipl — Deep web people search (paid)
• Clearbit — Company/individual data enrichment
• FaceCheck / FaceSeek — Reverse face search

Phone Number OSINT

• TrueCaller — Caller ID and spam blocking
• ThatsThem — Reverse phone search
• Infobel — Phone search outside USA
• FreeCarrierLookup — Carrier/type lookup (US)
• NumlookupAPI [Freemium] — Programmatic carrier/line-type checks
• CallerIDTest — Phone search
• Advanced Background Checks — All people linked to a number

Social Media

Public Records & Company Information

• OpenCorporates — World's largest open company database
• SEC EDGAR — U.S. company filings
• OpenOwnership Register — Beneficial ownership datasets
• MuckRock — FOIA repository and request tracking
• EU Tenders (TED) — EU procurement notices
• World Bank Projects — Project and procurement records

RU/CN Registries

Russia: Rusprofile, Kontur.Focus (freemium), zakupki.gov.ru (procurement), EGRUL/EGRIP (official, captcha-gated)

China: GSXT (National Enterprise Credit), Qichacha/Tianyancha (freemium), MIIT ICP/Beian (ICP filings)

Sanctions & Compliance

• OFAC SDN List
• EU Sanctions Map
• OpenSanctions — Aggregated persons/entities datasets
• OCCRP Aleph — Investigative documents, leaks, company records

Breach & Leak Data

• Have I Been Pwned — Breach lookup; Pwned Passwords API (k-anonymity)
• Dehashed — Credential search
• IntelX — Data intelligence
• LeakCheck — Breach lookups
• Snusbase — Database breach lookups
• BreachDirectory — Recent breach credentials
• Scattered Secrets
• Cavalier (Hudson Rock) — Infostealer lookups
• Phonebook
• LeakPeek

Infrastructure & Attack-Surface OSINT

• Shodan — Internet-connected device/service search
• Censys — Host and certificate enumeration
• GreyNoise — Distinguish background noise from targeted scans
• SecurityTrails — Passive DNS and asset discovery
• SpiderFoot — Automated recon and correlation
• theHarvester — Subdomain, email, metadata harvesting
• Recon-ng — Web recon framework
• Amass / Subfinder — Passive subdomain discovery
• BuiltWith — Tech stack enumeration
• Netlas — Large-scale HTTP/DNS/certificate pivots
• BinaryEdge / FOFA / ZoomEye — Infra pivots complementing Shodan/Censys
• RiskIQ PassiveTotal — Passive DNS/cert/host pivots
• Spur — IP lookups and tracking
• Robtex — Passive DNS and infrastructure pivots

ASN/BGP & Internet Measurement

• Hurricane Electric BGP Toolkit — ASN, prefix, peers, IRR data
• RIPEstat — IP/ASN history, routing, geolocation, abuse contacts
• BGPView — ASN and prefix explorer
• bgp.tools — Clean ASN/IX views, routing details
• PeeringDB — Facility and peering info

Certificates & CT Monitoring

• crt.sh — Search Certificate Transparency logs
• Censys Certificates — CT and x509 attribute pivots
• CertStream — Real-time CT feed via WebSocket
• Rapid7 Open Data — Sonar DNS/HTTP/SSL datasets
• Cert Spotter [Freemium] — CT monitoring and alerts
• Favicon hash (mmh3): cluster infrastructure; pair with Shodan/Censys favicon search

Threat Intel & IOCs

• Vendor/CERT advisories: CISA/NSA/CSA joint advisories, CERT-EU, NCSC-UK, JPCERT/CC, CERT-UA
• MISP Project and public MISP feeds
• OpenCTI — CTI knowledge graph
• Malpedia — Malware families, YARA, references
• ThreatFox / URLHaus / SSLBL
• MalwareBazaar — Hash-based sample sharing
• PhishTank / OpenPhish

Malware Analysis & Sandboxes

• Static analysis: pefile, FLOSS, capa
• Similarity: SSDEEP, TLSH
• Sandboxes: ANY.RUN, Hybrid Analysis, CAPE, Tria.ge
• Intelligence: Intezer (code reuse), VirusTotal (caution: uploads become public)
• TLS fingerprints: JA3, JA4

Cryptocurrency OSINT

Blockchain Explorers

L2 Explorers: Arbiscan, Optimistic Etherscan, BaseScan, zkSync Era, L2Beat (risk/TVL comparison)

Transaction Tracking & Analytics

• Arkham — Multichain explorer, entity labels, graphs, alerts
• TRM — Address/transaction graphs
• MetaSleuth — Visual crypto flow analysis
• Breadcrumbs [Freemium] — Visual graphing and labeling
• Bubblemaps — Holder concentration visualization
• Whale Alert — Large transaction monitoring
• Chainalysis / Crystal Blockchain — Professional analytics
• GraphSense — Cryptocurrency analytics platform
• Nansen — Smart Money labels (paid)
• Dune — Custom blockchain data queries
• Token Sniffer — Honeypot and scam token detection

NFT & Exchange Intelligence

• OpenSea / NFTScan — NFT marketplace/explorer
• DappRadar — NFT sales and marketplace activity
• CoinGecko / CoinMarketCap — Market data
• Glassnode — On-chain market intelligence

Bridge Monitoring

• Socketscan — EVM bridge explorer
• L2Beat Bridges — Bridge risk analysis
• Pulsy — Bridge explorer aggregator

Media Intelligence

Reverse Image & Facial Search

• Google Images — General reverse image search
• TinEye — Reverse image search
• Yandex Images — Effective for Russian/Eastern European content
• PimEyes — Face-based image search
• FaceCheck — Find people by photo

Image Forensics

• Forensically — Digital image forensics toolkit
• ExifTool — Read/write/edit metadata
• Jimpl — Online EXIF viewer
• Jeffrey's EXIF viewer — Online metadata viewer
• FOCA — Metadata in documents
• Metagoofil — Extract metadata from public documents
• C2PA Verify — Verify content credentials and AI provenance

Video Analysis

• YouTube Data Viewer — Extract YouTube metadata
• InVID & WeVerify — Video verification browser extension
• YouTube Geo Tag — Video geolocation via geo tags
• MediaInfo — Technical/tag info for video/audio
• Snap Map (public stories) — Area/event context

Browser Extensions for Media

• Fake News Debunker by InVID & WeVerify
• RevEye Reverse Image Search
• EXIF Viewer Pro
• Wayback Machine Extension
• Search by Image

Geospatial Intelligence

Satellite Imagery & Mapping

• Google Maps / Bing Maps — General mapping
• Sentinel Hub EO Browser — Sentinel/Landsat satellite imagery
• NASA Worldview — NASA satellite imagery
• Zoom Earth — Live satellite images and weather
• Wayback Imagery — Historical satellite images
• NASA FIRMS — Fire/hotspot data
• Open Infrastructure Map — Global infrastructure networks
• Windy — Live weather map

Geolocation Tools

• Mapillary — Crowdsourced street-level imagery
• KartaView — Open-source street-level imagery
• Overpass Turbo — Advanced OpenStreetMap queries
• SunCalc — Sun position for chronolocation
• GeoNames — Geographical database
• PeakVisor — Identify mountain peaks
• GeoGuesser tips — Geolocation methodology

Street View: Google Street View, Apple Maps, Yandex Maps, Baidu Maps

Flight OSINT

• FlightRadar24 / FlightAware / RadarBox
• ADSBExchange — Unfiltered community ADS-B feed
• Planespotters — Fleet/airframe history by tail number
• AirFrames / JetPhotos — Visual confirmation

Maritime OSINT

• MarineTraffic — Live AIS vessel tracking
• VesselFinder — Global ship movements and port calls
• FleetMon — Historical AIS data and analytics
• Global Fishing Watch — Fishing vessel behavior and AIS gap analysis

AI-Assisted OSINT

Warning: Never paste PII, sensitive IOCs, or unique pivots into cloud LLMs. They log inputs and may use them for training. Use local models (Ollama, LM Studio) for sensitive analysis.

Local/privacy-preserving: Ollama (Llama 3, Mistral), LM Studio, GPT4All

Commercial AI OSINT Platforms

• Cylect — AI entity extraction and link-analysis
• Fivecast Matrix — Generative-AI triage for social-media datasets
• Recorded Future — AI-driven threat intelligence
• DarkOwl Vision — AI-powered darknet data analysis

Deepfake & Synthetic Media Detection

• Sensity AI — Deepfake detection
• Reality Defender — AI-generated content detection
• Adobe Content Credentials Verify — C2PA verifier
• CarNet — AI car model identification (useful for geolocation)

Archiving & Evidence Preservation

• archive.today — One-page content archiver with screenshot
• URLScan.io — On-demand webpage scan with resource map
• ArchiveBox — Self-hosted archiving (HTML, PDF, screenshots, media)
• Hunchly — Evidence capture for investigators (paid)
• Wayback SavePageNow API v3 — On-demand archiving with job IDs
• SingleFileZ — Browser extension for offline HTML archives
• Kasm Workspaces — Containerized OSINT workspace/browser isolation

Evidence handling:

• Capture: URL + timestamp + PNG screenshot + WARC/SingleFileZ archive
• Hash all downloaded files (SHA-256) and record in case notes
• Separate work profiles/containers per case; store evidence read-only
• Use JSONL (NDJSON) logs with run_id and tool versions for reproducibility

Automation & Workflows

• n8n — Self-hosted workflow automation (e.g., RSS → scrape → alert pipelines)
• Huginn — Agent-based monitoring, scraping, alerting
• Playwright — Headless browser automation with stealth plugins
• Browsertrix Crawler — Archival crawling with WARC export
• Prefect / Apache Airflow — Workflow orchestration for data pipelines

Regional Search Engines

• Russia/CIS: Yandex, Mail.ru Search
• China: Baidu, Sogou, 360 Search
• Russia social: VK, OK.ru
• China social: Weibo, Bilibili, Zhihu, Douyin

Telegram & Messaging Intelligence

• TGStat — Channel analytics and search
• Telemetr — Channel growth, overlaps, forwards
• Combot — Group analytics (partially paid)
• TelegramDB Search Bot — Basic Telegram OSINT
• Discord ID — Basic Discord account information
• Sogou Weixin search — WeChat Official Accounts content search
• View public Telegram channels: https://t.me/s/<channel>

Structured Methodology Addendum

Treat collection as a reproducible campaign, not a tool checklist. Start with a target charter: scope, permitted sources, collection window, expected deliverable, and an identity/asset seed list. For every pivot, record the source URL or API query, UTC retrieval time, account or browser persona, raw artifact hash, and the observation separately from the inference it supports. Mark each link low, medium, or high confidence and retain plausible alternatives.

Persona and evidence hygiene

• Isolate each case and research persona in a separate browser profile or container; do not mix personal logins with collection accounts. Audit extensions before use, preserve recovery material offline, and keep a minimal chain of custody for screenshots, exports, and downloaded files.
• Archive volatile pages early as URL, timestamped screenshot, and WARC or SingleFileZ capture. Normalize observations into JSONL/NDJSON with a run_id, tool version, source, pivot, and confidence so another operator can replay the path.
• Favor durable pivots such as certificate serials, registrar accounts, code-signing material, account IDs, and build-path idioms over transient IP resolution. Require multiple independent signals before making an attribution claim.

Cross-chain and media pivots

• For rollups, anchor a hypothesis in L1 deposit or withdrawal events, then trace the destination chain with its native explorer. Treat bridge mint/burn, pool swaps, relayers, finality delays, and privacy systems as breaks in a presumed one-to-one flow; validate labels and relationships with more than one data source.
• For images and video, preserve the original before analysis. Extract metadata, key frames, visible text, shadow direction, landmarks, terrain, weather, and sound separately; test candidate locations against maps, street imagery, satellite history, and UTC time calculations. Record rejected candidates as well as the selected hypothesis.
• For social, Telegram, WeChat, Bluesky, and Fediverse material, preserve stable IDs (message ID, CID, DID, actor URL, or handle history) with the content. Platform search results and account names are leads, not identity proof.