The Complete OSINT Investigation Framework & Methodology (2026 Guide)
Open Source Intelligence (OSINT) is the disciplined practice of collecting, processing, and analyzing publicly available data to produce actionable intelligence. Whether you are conducting corporate due diligence, verifying human rights reporting, investigating cyber fraud, or performing threat hunting, a structured methodology separates amateur browsing from professional intelligence tradecraft.
The 5 Phases of the Professional Intelligence Cycle
01
Direction & Planning
Define clear Priority Intelligence Requirements (PIRs). Establish scope, identify target indicators (selectors), and define legal and jurisdictional boundaries before executing queries.
02
Passive Collection
Harvest public records, social media handles, DNS history, and archived web pages without sending direct network packets to the subject’s infrastructure to avoid detection.
03
Processing & Normalization
Extract EXIF metadata, decode obfuscated strings in CyberChef, cross-reference usernames, geolocate IP allocations, and clean tabular CSV datasets into unified timelines.
04
Correlation & Analysis
Connect disparate entities through link analysis. Verify findings using at least two independent primary sources to eliminate disinformation or synthetic sock puppets.
05
Dissemination & Archival
Preserve evidentiary web snapshots via Wayback Machine or Archive.is, compile verified chronologies, and produce clear, verifiable intelligence briefings.
Essential OpSec (Operational Security) Rules for Investigators
- Isolate Research Workstations: Never investigate high-risk entities from your personal browser. Use containerized browsers (such as Kasm Web), disposable Virtual Machines, or separate hardened operating systems (such as Tails or Whonix).
- Maintain Clean Sock Puppets: When creating research accounts on social media, use synthetic persona generators (Fake Name Generator, This Person Does Not Exist) and burner phone numbers (OnlineSim, SMS To Me) to prevent attribution back to your real identity.
- Disable WebRTC and Leaks: Ensure your investigative browser blocks WebRTC IP leaks, disables automatic image loading if investigating hostile domains, and routes through reputable VPNs or Tor circuits.
- Timely Evidence Preservation: Suspects frequently delete posts, alter bios, or take down websites once alerted. Immediately preserve target pages using Archive.is and Wayback Machine with cryptographic hashes.
Top 10 High-Impact Google Search Operators (Dorks)
Mastering Google search operators is the bedrock of targeted intelligence gathering:
site:target.com filetype:pdf confidential— Finds sensitive indexed PDF documents.site:target.com inurl:admin | inurl:login— Discovers exposed administrative portals."target username" site:github.com | site:pastebin.com— Identifies leaked credentials or source code repositories.site:linkedin.com/in/ "Target Company" "Former"— Maps past employees who may hold operational insights.intitle:"index of" "parent directory" (passwd | credentials | dump)— Detects misconfigured open HTTP/FTP directories.
Frequently Asked Questions (FAQ)
What is the difference between Active and Passive Reconnaissance?
Passive Reconnaissance gathers information without directly interacting with the target's servers or infrastructure (e.g., querying cached Google records, WHOIS databases, or Shodan historical data). The target has no log record of your investigation. Active Reconnaissance sends packets directly to the target (e.g., port scanning with Nmap or crawling an active web server), which will generate logs and alert security systems.
How can I reverse search a username across hundreds of social networks?
Use automated tools like WhatsMyName, Sherlock, or Namechk. These tools test HTTP response codes across over 500 platforms to check if a specific username exists, allowing you to map an individual's digital footprint across niche forums, developer platforms, and mainstream networks.
What are the legal boundaries of OSINT research?
OSINT operates strictly within legal parameters by analyzing data that is intentionally published or made publicly accessible. Bypassing authentication, cracking passwords, exploiting vulnerabilities, or circumventing paywalls through unauthorized network access crosses the line into computer crimes (such as the CFAA in the United States or GDPR breaches in Europe).
Can I export this entire tool directory to my browser bookmarks?
Yes! Click the Export HTML button on the toolbar above. This generates a standardized Netscape Bookmark file organized by category that can be imported directly into Google Chrome, Brave, Mozilla Firefox, Microsoft Edge, and Safari in under 5 seconds.
Index of Key Intelligence Directories
Explore verified resources across key disciplines:
SEARCH ENGINES (70 tools)
- IntelTechniques Search Engine: Michael Bazzell premier OSINT investigation methodology, training, and custom search engines.
- Google Advanced Search: Alternative, privacy-respecting, or regional search engine offering specialized indexing.
- Searx: Alternative, privacy-respecting, or regional search engine offering specialized indexing.
- Bing: Alternative, privacy-respecting, or regional search engine offering specialized indexing.
- Yandex: Alternative, privacy-respecting, or regional search engine offering specialized indexing.
PRODUCTIVITY (57 tools)
- unfurl: Investigative utility for data transformation, evidence transcription, and case documentation.
- Wolfram|Alpha: Computational knowledge engine for computing data, answering factual queries, and deep analysis.
- Cryptpad.fr: Investigative utility for data transformation, evidence transcription, and case documentation.
- Recontool.org: Investigative utility for data transformation, evidence transcription, and case documentation.
- MindMup 2: Investigative utility for data transformation, evidence transcription, and case documentation.
RESOURCES (54 tools)
- OH SHINT! Welcome Aboard: Authoritative OSINT cheatsheet, methodology guide, framework documentation, or bookmark index.
- The Ultimate OSINT Collection: Authoritative OSINT cheatsheet, methodology guide, framework documentation, or bookmark index.
- OSINT Resources in Canada: Authoritative OSINT cheatsheet, methodology guide, framework documentation, or bookmark index.
- Nixintel's OSINT Resource List: Authoritative OSINT cheatsheet, methodology guide, framework documentation, or bookmark index.
- FAROS OSINT Resources: Authoritative OSINT cheatsheet, methodology guide, framework documentation, or bookmark index.
DOMAIN / IP / DNS (53 tools)
- domainbigdata: DNS analyzer, reverse IP lookup, subnet scanner, and passive DNS database.
- Domain Codex: DNS analyzer, reverse IP lookup, subnet scanner, and passive DNS database.
- dnslytics: DNS analyzer, reverse IP lookup, subnet scanner, and passive DNS database.
- SecurityTrails: DNS analyzer, reverse IP lookup, subnet scanner, and passive DNS database.
- Shodan: Search engine for Internet-connected devices, industrial control systems, cameras, and open ports.
GOVERNMENT (48 tools)
- data.occrp.org: Official government portal, state registry, FOIA request tracker, and legislative repository.
- The Pegasus Project | OCCRP: Official government portal, state registry, FOIA request tracker, and legislative repository.
- COP26 registered attendees: Official government portal, state registry, FOIA request tracker, and legislative repository.
- MuckRock: Official government portal, state registry, FOIA request tracker, and legislative repository.
- GovSalaries: Official government portal, state registry, FOIA request tracker, and legislative repository.
MAPS (47 tools)
- Google Maps: Interactive satellite imagery, topographic maps, street view archives, and geospatial overlays.
- Bing Maps: Interactive satellite imagery, topographic maps, street view archives, and geospatial overlays.
- Yandex.Maps: Interactive satellite imagery, topographic maps, street view archives, and geospatial overlays.
- Generate a panorama: Interactive satellite imagery, topographic maps, street view archives, and geospatial overlays.
- Mapillary: Interactive satellite imagery, topographic maps, street view archives, and geospatial overlays.
PUBLIC RECORDS (46 tools)
- JudyRecords: Public records aggregator for vital statistics, court filings, property deeds, and bankruptcies.
- CourtListener: Public records aggregator for vital statistics, court filings, property deeds, and bankruptcies.
- Public Access to Court Electronic Records: Public records aggregator for vital statistics, court filings, property deeds, and bankruptcies.
- Parallelsearch case law: Public records aggregator for vital statistics, court filings, property deeds, and bankruptcies.
- Canadian Legal Information Institute: Public records aggregator for vital statistics, court filings, property deeds, and bankruptcies.
POLICE / LE / FED (43 tools)
- Openoversight: Law enforcement intelligence tool, criminal history search, inmate locator, and police blotters.
- Criminal Cop Database Lookup: Law enforcement intelligence tool, criminal history search, inmate locator, and police blotters.
- The Philadelphia Police Misconduct Database: Law enforcement intelligence tool, criminal history search, inmate locator, and police blotters.
- NYPD Misconduct Complaint Database: Law enforcement intelligence tool, criminal history search, inmate locator, and police blotters.
- NYPD Officer Profile: Law enforcement intelligence tool, criminal history search, inmate locator, and police blotters.
IMAGE / VIDEO / AUDIO / MEDIA (41 tools)
- Facecheck.id: Forensic media tool for EXIF metadata extraction, reverse image search, or face matching.
- Google Images: Forensic media tool for EXIF metadata extraction, reverse image search, or face matching.
- Yandex Images: Forensic media tool for EXIF metadata extraction, reverse image search, or face matching.
- Bing Images: Forensic media tool for EXIF metadata extraction, reverse image search, or face matching.
- See it, search it: Search the web using an image instead of text. Reverse image search engine. Search by image: Take a picture or upload one to find similar images and products. Identify landmarks, animals, even cele...
TWITTER (40 tools)
- IntelTechniques Twitter: Michael Bazzell premier OSINT investigation methodology, training, and custom search engines.
- Nitter.hu: X (Twitter) investigative tool for scraping tweets, follower graphs, and bot activity analysis.
- Nitter.it: X (Twitter) investigative tool for scraping tweets, follower graphs, and bot activity analysis.
- BirdHunt: X (Twitter) investigative tool for scraping tweets, follower graphs, and bot activity analysis.
- Nitter Instances: X (Twitter) investigative tool for scraping tweets, follower graphs, and bot activity analysis.
TOOLSET (37 tools)
- CyberChef: The Cyber Swiss Army Knife for encryption, decoding, hex analysis, data format conversion, and hashing.
- mitaka: Comprehensive reconnaissance suite, multi-tool aggregator, or specialized investigative script.
- Frack: Frack is my attempt at creating an end-to-end solution to store, manage and query your breach data. The tool has got a very basic workflow making it easy to use.
- pywhat: Comprehensive reconnaissance suite, multi-tool aggregator, or specialized investigative script.
- theHarvester: theHarvester is a very simple, yet effective tool designed to be used in the early stages of a penetration test. Use it for open source intelligence gathering and helping to determine a company's external threat landscape on the internet
REDDIT (34 tools)
- teddit: Reddit privacy frontend
- Reddit Search: Search reddit using the pushshift.io API. For more advanced searches you can directly query the API fairly easily.
- Karma Decay: Reddit investigative tool for analyzing user comment histories and tracking deleted posts.
- redditsfinder: A command line program to easily download reddit users' post histories.
- SocialGrep: Social media statistics for Reddit - popular communities, trending topics, and more
ID GENERATOR (33 tools)
- Username Generator: Synthetic persona generator for realistic dummy profiles and non-attributable sock puppets.
- Fake Name Generator: Generates comprehensive fictitious identities with address, SSN, credit card, and employment.
- Resume Generator: Synthetic persona generator for realistic dummy profiles and non-attributable sock puppets.
- International Name Generator: Synthetic persona generator for realistic dummy profiles and non-attributable sock puppets.
- Windows Phone IMEI Generator: Synthetic persona generator for realistic dummy profiles and non-attributable sock puppets.
LICENSE PLATE / VIN / VEHICLE (30 tools)
- Plate Recognizer: Vehicle intelligence registry for looking up VIN numbers, license plates, and title records.
- License Plates of the World: Vehicle intelligence registry for looking up VIN numbers, license plates, and title records.
- VIN decoder: Vehicle intelligence registry for looking up VIN numbers, license plates, and title records.
- Poctra.com: Vehicle intelligence registry for looking up VIN numbers, license plates, and title records.
- FAXVIN: Vehicle intelligence registry for looking up VIN numbers, license plates, and title records.
IoT (30 tools)
- Webcam Search Engine: Investigative utility and OSINT resource for iot.
- Insecam: Investigative utility and OSINT resource for iot.
- Camhacker.com: Investigative utility and OSINT resource for iot.
- EarthCam: Investigative utility and OSINT resource for iot.
- Airport Webcams: Investigative utility and OSINT resource for iot.
PHONE (27 tools)
- IntelTechniques Telephone: Michael Bazzell premier OSINT investigation methodology, training, and custom search engines.
- PhoneInfoga: Carrier lookup, HLR lookup, caller ID resolver, and reverse phone number directory.
- Reverse Phone Lookup: Carrier lookup, HLR lookup, caller ID resolver, and reverse phone number directory.
- ignorant: Carrier lookup, HLR lookup, caller ID resolver, and reverse phone number directory.
- PhoneInfoga: Carrier lookup, HLR lookup, caller ID resolver, and reverse phone number directory.
BUSINESS (27 tools)
- Companies & Orgs Search Engine: Company registry, trademark lookup, corporate officers index, and business license verification.
- WhaleSlide: Company registry, trademark lookup, corporate officers index, and business license verification.
- AllPeople: Company registry, trademark lookup, corporate officers index, and business license verification.
- Corporation Wiki: Company registry, trademark lookup, corporate officers index, and business license verification.
- PA PPP Database: Company registry, trademark lookup, corporate officers index, and business license verification.
PEOPLE (26 tools)
- IDCrawl: Public records directory, address history aggregator, and contact intelligence tool for individuals.
- WebMii: Public records directory, address history aggregator, and contact intelligence tool for individuals.
- Tools: Public records directory, address history aggregator, and contact intelligence tool for individuals.
- TruePeopleSearch: Public records directory, address history aggregator, and contact intelligence tool for individuals.
- Free People Search: Public records directory, address history aggregator, and contact intelligence tool for individuals.
EMAIL (26 tools)
- Identificator.space: Email permutation checker, MX validator, and breach footprint engine for verifying target emails.
- Epieos Email Lookup: Reverse email and phone OSINT tool revealing associated Google, Skype, and social profiles.
- Intelligence X: Email permutation checker, MX validator, and breach footprint engine for verifying target emails.
- holehe: Email permutation checker, MX validator, and breach footprint engine for verifying target emails.
- Infoga: Infoga - Email OSINT. Contribute to m4ll0k/Infoga development by creating an account on GitHub.
EXTREMIST / FAR-RIGHT (24 tools)
- Unicorn Riot: Discord Leaks: Specialized monitoring tool, hate group tracker, or archive documenting radical movements.
- Data | DDoSecrets Search: Specialized monitoring tool, hate group tracker, or archive documenting radical movements.
- Parler Archive Search: Specialized monitoring tool, hate group tracker, or archive documenting radical movements.
- Parler Capitol Videos: Specialized monitoring tool, hate group tracker, or archive documenting radical movements.
- Project Whispers: Specialized monitoring tool, hate group tracker, or archive documenting radical movements.
NEWS (23 tools)
- News Search Engine: Real-time global news aggregator, wire service monitor, or localized incident reporting portal.
- Mailing List Archives Search Engine: Real-time global news aggregator, wire service monitor, or localized incident reporting portal.
- Google News: Real-time global news aggregator, wire service monitor, or localized incident reporting portal.
- News Search: Real-time global news aggregator, wire service monitor, or localized incident reporting portal.
- Newslookup.com: Real-time global news aggregator, wire service monitor, or localized incident reporting portal.
OPEN DIRECTORY (23 tools)
- FilePhish: Search tool for indexing and discovering open HTTP/FTP directories and cloud storage buckets.
- Open Directory Finder: Search tool for indexing and discovering open HTTP/FTP directories and cloud storage buckets.
- Filetype search tool: Search tool for indexing and discovering open HTTP/FTP directories and cloud storage buckets.
- Opendirsearch.abifog.com: Search tool for indexing and discovering open HTTP/FTP directories and cloud storage buckets.
- Archive-it.org: Search tool for indexing and discovering open HTTP/FTP directories and cloud storage buckets.
[CAN] GOVERNMENT (23 tools)
- Advanced Registry Search: Canadian federal, provincial, and municipal government information and open data registry.
- Statistics Canada: Canadian federal, provincial, and municipal government information and open data registry.
- Canada Gazette: Canadian federal, provincial, and municipal government information and open data registry.
- Completed Access to Information Requests: Canadian federal, provincial, and municipal government information and open data registry.
- Canadian Importers Database: Canadian federal, provincial, and municipal government information and open data registry.
PRIVACY / SECURITY (22 tools)
- Privacy Services by Michael Bazzell: This is the third step of a three-step process to request, freeze, and remove your personal information from within data broker and credit reporting services.
- Privacy Guides: Operations security (OpSec) tool for hardening browsing sessions and blocking telemetry.
- Surveillance Self-Defense: Operations security (OpSec) tool for hardening browsing sessions and blocking telemetry.
- gofoss.net: Operations security (OpSec) tool for hardening browsing sessions and blocking telemetry.
- Consumer Reports Security Planner: Operations security (OpSec) tool for hardening browsing sessions and blocking telemetry.
SOURCE CODES (21 tools)
- Pastes Search Engine: Code search engine querying GitHub, GitLab, and source repos for exposed keys and commits.
- Pastes Search Engine 2: Code search engine querying GitHub, GitLab, and source repos for exposed keys and commits.
- GitHub Search Engine: Code search engine querying GitHub, GitLab, and source repos for exposed keys and commits.
- Source Code Search Engine: Code search engine querying GitHub, GitLab, and source repos for exposed keys and commits.
- Google to search profiles on GitHub: Code search engine querying GitHub, GitLab, and source repos for exposed keys and commits.
[CAN] CORPORATION (21 tools)
- RJSC Connect: Canadian corporate registry search for business ownership and corporate directors.
- Search for a Federal Corporation: Canadian corporate registry search for business ownership and corporate directors.
- FederalCorporation: Canadian corporate registry search for business ownership and corporate directors.
- Corporate Affairs Registry Database: Canadian corporate registry search for business ownership and corporate directors.
- MRAS Business Registry Search: Canadian corporate registry search for business ownership and corporate directors.
SECURE COMMUNICATION (20 tools)
- Signal: End-to-end encrypted messaging or zero-metadata channel for confidential communication.
- Element: End-to-end encrypted messaging or zero-metadata channel for confidential communication.
- Briar: End-to-end encrypted messaging or zero-metadata channel for confidential communication.
- Jami.net: End-to-end encrypted messaging or zero-metadata channel for confidential communication.
- Jitsi Meet: End-to-end encrypted messaging or zero-metadata channel for confidential communication.
USERNAME (19 tools)
- WhatsMyName Web: Enumerates usernames across 500+ websites to discover digital footprints across platforms.
- Username Checker: Username enumeration scanner searching hundreds of social networks and platforms for matching handles.
- Username Search: Username enumeration scanner searching hundreds of social networks and platforms for matching handles.
- Tools: Username enumeration scanner searching hundreds of social networks and platforms for matching handles.
- maigret: Username enumeration scanner searching hundreds of social networks and platforms for matching handles.
INSTAGRAM (19 tools)
- Bibliogram.art: Instagram profile analyzer, story archiver, and hashtag mapping utility for visual intelligence.
- Bibliogram: Instagram profile analyzer, story archiver, and hashtag mapping utility for visual intelligence.
- InstaHunt: Instagram profile analyzer, story archiver, and hashtag mapping utility for visual intelligence.
- Instagram Deep Photo Search Engine: Instagram profile analyzer, story archiver, and hashtag mapping utility for visual intelligence.
- Instagram analyzer and viewer: Instagram profile analyzer, story archiver, and hashtag mapping utility for visual intelligence.
GOOGLE CSE (19 tools)
- Homepage Search Engine: Custom Search Engine curated by security researchers targeting specific archives and documents.
- Amazon Cloud Search Engine: Custom Search Engine curated by security researchers targeting specific archives and documents.
- Google CSE instances Search Engine: Custom Search Engine curated by security researchers targeting specific archives and documents.
- Robots.txt Search Engine: Custom Search Engine curated by security researchers targeting specific archives and documents.
- Short URL Search Engine: Custom Search Engine curated by security researchers targeting specific archives and documents.