Open-Source Intelligence (OSINT) is the practice of gathering information from publicly available sources. Attackers use it to map a target before they ever send a phishing email or probe a firewall — and that is exactly why you should use the same tools to see what they see.
Every organization leaves a public footprint: exposed servers, staff email formats, leaked documents, forgotten subdomains, breached passwords. OSINT tools surface all of it, legally, from open sources. Below are the best-known tools grouped by what they actually do — because the real skill isn't memorizing 25 tools, it's understanding the phases of reconnaissance they map to.
Use these ethically and legally. Run them against your own organization, or against systems you have explicit written authorization to assess. OSINT is passive by nature, but active scanning of systems you don't own can be illegal. When in doubt, get permission in writing first.
1. People & Identity
The first thing an attacker profiles is people — usernames, email addresses, and whether their credentials have already leaked. This is the raw material for phishing and account takeover.
| Tool | What it does | How to use it defensively |
|---|
| Have I Been Pwned | Checks whether an email or password has appeared in a known data breach. | Monitor your corporate domains for exposed credentials and force resets on hits. |
| CheckUserNames | Looks up a single username across 100+ social and web platforms. | See how discoverable your staff and brand handles are across the web. |
| Sherlock | Open-source CLI that hunts a username across 400+ sites — the modern successor to older username checkers. | Run it against your executives' and brand handles to map their public presence. |
| BeenVerified | Commercial people-search aggregator pulling public records and contact data. | Understand what data brokers expose about your leadership (a spear-phishing goldmine). |
2. Internet-Asset Search Engines
These are “Google for devices.” Instead of indexing web pages, they continuously scan the entire internet and index the machines — open ports, running services, certificates, and misconfigured devices.
| Tool | What it does | How to use it defensively |
|---|
| Shodan | The original search engine for internet-connected devices — servers, webcams, databases, industrial control systems. | Search your own IP ranges to find exposed devices and services before attackers do. |
| Censys | Continuously scans the internet with especially rich host and TLS-certificate data. | Build a live inventory of your external attack surface and monitor certificates. |
| ZoomEye | A cyberspace search engine similar to Shodan with a large global dataset. | Cross-check your organization's exposure from a second independent scanner. |
| Netlas | Modern internet-wide asset search covering hosts, domains, and certificates. | Discover shadow IT and forgotten assets tied to your domains. |
| BuiltWith | Profiles the full technology stack a website runs — CMS, frameworks, analytics, plugins. | See what your public stack reveals and spot outdated, vulnerable components. |
3. All-in-One Reconnaissance Frameworks
Rather than one narrow function, these tie many sources together and automate the correlation — turning scattered data points into a single picture of a target.
| Tool | What it does | How to use it defensively |
|---|
| OSINT Framework | A curated web directory that organizes hundreds of OSINT resources by category — a map, not a scanner. | Use it as a structured checklist when assessing your own footprint. |
| Maltego | Graphical link-analysis that connects people, domains, emails, and infrastructure into a visual graph via “transforms.” | Visualize the exposed relationships between your staff, domains, and systems. |
| Recon-ng | A modular, Metasploit-style recon framework with automated modules and reporting. | Run repeatable, documented footprinting passes against your own domains. |
| SpiderFoot | Automates OSINT across 200+ data sources, correlating emails, IPs, domains, and breach data. | Schedule automated self-assessment scans and monitor for new exposure. |
| IVRE | An open-source framework for building your own Shodan-like reconnaissance database from scan data. | Stand up a self-hosted, private view of your attack surface. |
4. Domain, DNS & Email Reconnaissance
Before an attack, adversaries enumerate your domains, subdomains, and email addresses. Forgotten subdomains and predictable email formats are two of the most common ways in.
| Tool | What it does | How to use it defensively |
|---|
| theHarvester | Gathers emails, subdomains, hosts, and employee names from public sources and search engines. | See which staff emails and subdomains are trivially harvestable and reduce them. |
| Fierce | DNS reconnaissance — enumerates subdomains and locates non-contiguous IP space. | Find abandoned or dev subdomains that still resolve and quietly expose you. |
| Hunter.io | Finds and verifies email addresses tied to a domain, and reveals the naming pattern. | Learn how guessable your email format is — a direct predictor of phishing risk. |
| Google Dorks | Advanced search operators (site:, filetype:, intitle:) that surface exposed files, logins, and misconfigurations. | “Dork” your own domain to find leaked documents and credentials Google has already indexed. |
5. Network Scanning & Vulnerability Assessment
Once targets are identified, the next phase is active probing — mapping open ports, fingerprinting services, and testing for known weaknesses. Only run these against systems you own or are authorized to test.
| Tool | What it does | How to use it defensively |
|---|
| Nmap | The industry-standard network and port scanner, with service/OS fingerprinting and the NSE scripting engine. | Inventory and baseline your own perimeter — see our guide to Nmap in cybersecurity. |
| Unicornscan | A high-speed, asynchronous scanner built for sweeping large IP ranges quickly. | Rapidly sweep big address spaces to spot unexpected open services. |
| Nikto | A web-server scanner that flags known vulnerabilities, dangerous files, outdated software, and misconfigurations. | Run quick hygiene checks against your public web servers. |
| OpenVAS | A full open-source vulnerability scanner (part of Greenbone) with a large, continuously updated feed. | Schedule recurring vulnerability assessments across your environment. |
6. Metadata & Document Analysis
The files you publish carry hidden metadata — author names, software versions, internal server paths, even GPS coordinates. Attackers mine it to map your internal systems without touching them.
| Tool | What it does | How to use it defensively |
|---|
| FOCA | Extracts metadata from public documents to reveal usernames, software, and internal infrastructure. | Run it on your own published files, then strip metadata before publishing. |
| Metagoofil | Harvests public documents from a domain and extracts their embedded metadata in bulk. | Audit what your public PDFs and Office files quietly leak about your network. |
| ExifTool | Reads and writes metadata (including EXIF and GPS) in images and a huge range of file types. | Scrub GPS and EXIF data from images before they go on your website or socials. |
What This Means for Your Business
You don't need to become a penetration tester to benefit from OSINT. The point is simple: your public footprint is an asset attackers inventory first. A single afternoon spent looking at your own organization through these tools routinely surfaces forgotten subdomains, leaked credentials, over-shared documents, and exposed services — each one a foothold you can close before anyone else finds it.
At IT Master Services, external footprint reviews are part of how we harden the businesses we protect. If you'd like us to see what an attacker sees — and fix it — explore our Managed IT Services, and read our related guides on open-source cybersecurity tools, why MFA matters, and Conditional Access.
References