Awesome-Mirrors
/
cyber-security-resources
mirror of https://github.com/The-Art-of-Hacking/h4cker.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
cyber-security-resources/osint
History
Omar Santos 4275edcc75
Update README.md 		2024-02-02 15:53:27 -05:00
..
quick_recon Update pasting.py 2021-02-14 22:18:21 -05:00
README.md Update README.md 2024-02-02 15:53:27 -05:00
dns-zone-transfer.md Create dns-zone-transfer.md 2021-03-03 12:40:58 -05:00

README.md

Open-source Intelligence (OSINT)

Open Source Intelligence (OSINT) from an ethical hacking perspective involves the collection and analysis of information that is publicly available to identify vulnerabilities, gather data about targets, or understand the security posture of an organization. This process is a key initial phase in ethical hacking, also known as penetration testing or security auditing, where the goal is to enhance the security of the system or network being tested.

OSINT techniques are ethical and legal, involving the use of publicly accessible sources such as:

  • Public websites and forums: Information from company websites, forums, and bulletin boards can provide insights into the technologies used, internal structure, and potential security weaknesses.
  • Social media platforms: Public profiles and posts can reveal personal information about employees, organizational structure, and internal events that could be leveraged in social engineering attacks.
  • Government and public records: Databases and records available from government agencies can provide information on domain registrations, patents, and more that are useful for mapping out an organization's online presence.
  • Search engines: Advanced search engine techniques and dedicated tools can uncover hidden information and files related to a target that are available on the internet.
  • Open databases: Databases like Shodan and Censys allow researchers to search for internet-connected devices, including potentially vulnerable systems exposed online.

The ethical use of OSINT means respecting privacy and legality, focusing on information that is publicly available without bypassing any access controls or engaging in activities that would be considered intrusive or illegal. Ethical hackers use OSINT to:

  1. Pre-assessment: To understand the target's environment and identify potential points of entry before performing any active scanning or testing.
  2. Footprinting: To gather as much information as possible about the target's digital and physical footprint.
  3. Vulnerability identification: To find possible vulnerabilities in publicly accessible systems or applications that could be exploited.
  4. Social engineering preparation: To collect data that could be used in crafting phishing campaigns or other social engineering tactics as part of a security assessment.

Ethical hackers document their findings and provide insights to organizations on how to mitigate any discovered vulnerabilities or security gaps, enhancing the overall security posture of the organization.

Passive Recon Tools:

Open Source Threat Intelligence

  • Awesome Threat Intelligence - A curated list of awesome Threat Intelligence resources. This is a great resource and I try to contribute to it.

OSINT Source Highlights

Website Description
shodan.io Server
google.com Dorks
wigle.net WiFi Networks
grep.app Codes Search
app.binaryedge Threat Intelligence
onyphe.io Server
viz.greynoise.io Threat Intelligence
censys.io Server
hunter.io Email Addresses
fofa.info Threat Intelligence
zoomeye.org Threat Intelligence
leakix.net Threat Intelligence
intelx.io OSINT
app.netlas.io Attack Surface
searchcode.com Codes Search
urlscan.io Threat Intelligence
publicwww.com Codes Search
fullhunt.io Attack Surface
socradar.io Threat Intelligence
binaryedge.io Attack Surface
ivre.rocks Server
crt.sh Certificate Search
vulners.com Vulnerabilities
pulsedive.com Threat Intelligence

Website Exploration and "Google Hacking"

Data Breach Query Tools

IP address and DNS Lookup Tools

Social Media

Acquisitions and

  • OCCRP Aleph - The global archive of research material for investigative reporting.

Whois

WHOIS information is based upon a tree hierarchy. ICANN (IANA) is the authoritative registry for all of the TLDs and is a great starting point for all manual WHOIS queries.

BGP looking glasses

DNS

The OSINT Framework

Dark Web OSINT Tools

Dark Web Search Engine Tools

Tools to Obtain Information of .onion Links

Tools to scan onion links

Tools to Crawl Dark Web Data

Other Great Intelligence Gathering Sources and Tools

Active Recon