Open-source intelligence tools, OSINT tools for short, are designed to gather public information from various parts of the internet.
They are used to collect data—anything from text to images and audio files—for analysis purposes or to find a specific piece of information with more ease compared to traditional search engines.
Anyone looking for data can use OSINT tools, from IT security specialists to ethical and unethical hackers and national security experts.
There are various OSINT tools, each specialises in searching for a specific type of data depending on the user’s end goal.
The Flexibility of OSINT Tools
Open-source intelligence tools come in all shapes and sizes depending on your technical skills and how deep the data you’re after is buried.
As they continue to evolve, they can become exceptionally useful for curious individuals, knowledge seekers, data analysts, and cybersecurity professionals.
Below is a selection of the best OSINT tools for accessing both network and server data, as well as data collection and sourcing information.
Network and Server Data
Shodan
Shodan is a search engine that collects data of devices connected to a specific network, whether an internal network or a section of the open internet.
While this makes it an excellent tool for hackers to find vulnerable endpoints, it provides security experts with data on open ports and vulnerabilities to patch up.
They can also search for private data that might be publicly accessible through indirect paths and hide it.
Nmap
Nmap is a network mapping and auditing OSINT tool that collects and analyses data about hosts, servers, and operating systems on a computer network.
It allows administrators to monitor which devices are connected to their network by scanning their IP addresses and collecting information about each device.
FOCA
Fingerprinting Organizations with Collected Archives, or FOCA, is a tool that scans, analyses, and collects information and metadata from remote web servers.
FOCA can extract data efficiently from various sources such as Microsoft Office, Open Office, and PDF files and organise them to some degree for easier access.
WebShag
WebShag is one of the best system auditing tools out there. It scans HTTP and HTTPS protocols for security and collects relevant data by performing port, URL, and web crawlers scans.
WebShag also uses an IDS evasion system when testing HTTP protocols to avoid being banned by the server and ending its search prematurely.
Data Collection
Metagoofil
This tool allows you to extract metadata from public-access files by running a deep search on various search engines. Once it detects a specific file format—Docx, pdf, Xls, etc.—it downloads its contents and filters out jargon, leaving only the useful parts.
It also offers multiple ways to organize and filter data for better analysis. While the data collected by Metagoofil can be useful to unethical hackers, security teams can analyse it to identify their weaknesses and patch them up.
Babel X
Babel X is a cloud-based OSINT tool that conducts text-based searches in multiple languages.
It targets news articles, blog posts, social media posts, and message boards on the surface and deep web, looking for search-relevant information.
In addition to working in over 200 languages, it geo-tags the data it collects, making it easier to organize and analyse.
SpiderFoot
Often used as a monitoring tool, Spiderfoot collects data about a specific search query, such as an IP address, domain name, email, or username.
In addition to its use in cybersecurity, it allows security experts to find leaks to their information. Spiderfoot offers data visualisation for easier comprehension.
Censys
Censys is an in-depth search engine that collects publicly-available, accurate, and up-to-date data and information about any device, server, or domain connected to the internet.
It also allows you to collect technical information about the devices in question, such as their running servers, HTTP protocols, and general information, by reaching out to the WHOIS.
Recorded Future
Recorded Future is an AI-based combination of an OSINT tool and a big data analysis tool. It collects all data concerning a specific subject from public resources and uses AI algorithms to analyse it to predict future trends.
TinEye
TinEye is a reverse image search engine that uses image identification, machine learning, and pattern recognition technology in its search instead of keywords or metadata.
While TinEye mainly searches for images, it also collects all the data related to the image, such as metadata, hosting server, and upload date. It also offers image tracking to detect copyright infringement and fraud.
Source Information
Jigsaw
Jigsaw is an employee information and background-check open-source search engine. By typing a domain name as your search query, it searches their records for information about their employees and departments that are publicly available.
Jigsaw’s search is limited only to what corporations offer publicly and doesn’t consult with other data sources.
Creepy
Creepy is a geo-location tool mainly used by information security professionals and market researchers. It tracks and collects data—categorised by location—that users upload to their public social media profiles.
Creepy then allows you to extract and download the data in CVS or KML formats.
SearchCode
Unlike other OSINT tools that target data and media, SearchCode looks for specific lines of code, as they can reveal information about websites and servers like their functionality and security flaws.
SearchCode allows you to filter search results to a specific source or coding language and search for both simple and complex strings of code.
Fierce
Fierce is a DNS and IP address recon tool that can locate and identify IP addresses linked to a domain name. Security professionals often use it to test their networks and domains, as it only takes a few minutes to deliver results after starting a scan against their websites, looking for misconfigured networks or potential data leaks.
Built With
Built With collects data of a target website’s technology. The information includes a detailed report of its CMS, its primary coding language, and CS libraries.
Depending on the target, you could also get information on its hosting server type, hosting provider, and SSL certificate provider.
In addition to understanding the overall composition of a website before using, Built With’s data allows you to find the most popular technology among website owners.
We hope this information proved helpful in your journey to acquiring a new OSINT platform for your business, if you are an IT security specialist looking to improve your observability then you can find more tools resources and information at Logit.io where we publish buyers guides and helpful tutorials for Hosted ELK and Elasticsearch.