OSINT — Open-Source Intelligence

OSINT, open-source intelligence, is information collected from publicly available sources and analysed to answer a specific question. Sources include web pages, archives, DNS and registration data, certificate transparency logs, public registers, social media and media metadata.

Passive collection only queries third parties such as search engines, archives and certificate logs, so the target sees nothing. Active collection interacts with the target, for example port scanning or contacting staff, is clearly visible and needs explicit permission. Semi-passive sits in between, like a normal DNS lookup or page visit.

Collecting genuinely public information is generally legal, but public availability does not cancel data protection law. Collect only what your purpose and authorisation cover, minimise personal data, respect platform terms, and never log into others' accounts, use leaked credentials or harass people.

The cycle used in this course has five phases: planning and direction, collection, processing, analysis and reporting. It starts with a clear question and ends with an answer that names its sources and limits, which often raises new questions.

A common method is the Admiralty code: source reliability is rated from A (reliable) to F (cannot be judged) and information credibility from 1 (confirmed) to 6 (cannot be judged). Findings confirmed by independent source families earn higher confidence.

Yes. CT logs record publicly trusted TLS certificates, and the Subject Alternative Name field lists the hostnames each certificate covers. Searching them is passive. Limits: wildcard certificates hide individual hosts, private-CA certificates never appear, and a logged name is history, not proof that a host is still live.