Introduction to Cybersecurity and OSINT
Objectives: By the end of this topic, you will be able to…
- Define cybersecurity and its importance in the current context
- Explain the three fundamental principles of the CIA triad
- Recognize the difference between offensive and defensive cybersecurity
- Understand the practical approach of this course
- Collect publicly available information useful for a security assessment
- Use OSINT tools included in Kali Linux
- Recognize the legal and ethical limits of using these tools
What is cybersecurity
Cybersecurity is the set of practices, technologies, and processes designed to protect computer systems, networks, programs, and data against attacks, unauthorized access, or damage.
In a digitized world where nearly all personal and professional activities depend on technology, cybersecurity becomes essential to guarantee three fundamental principles:
- Confidentiality — Only authorized parties can access the information
- Integrity — Data is not altered without authorization
- Availability — Information and services are accessible when needed
Current importance
Companies, governments, and individuals face daily attacks, from ransomware and phishing to large-scale data breaches and identity theft, and this demand for security skills keeps growing as every new connected device, cloud service, and application widens the attack surface.
What is OSINT
OSINT (Open Source Intelligence) refers to the process of collecting and analyzing publicly available information to obtain useful intelligence.
OSINT draws from accessible sources — search engines like Google, Bing, and Yandex; social media platforms such as LinkedIn, Facebook, and Twitter; public records including government databases and WHOIS registries; metadata embedded in documents and images; forums, blogs, and paste sites like Pastebin and Reddit; and exposed domains and web services. It does not require invasive techniques, and it is legal as long as it respects applicable privacy policies and terms of service. Security professionals use it in defensive contexts such as audits and threat hunting, while adversaries apply the same techniques for red teaming and criminal reconnaissance.
Importance of OSINT in cybersecurity
OSINT is the first phase of an attack chain (Kill Chain), specifically in the reconnaissance stage. The Kill Chain models an intrusion as a sequence of seven stages (reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives), each depending on what the previous one produced; the same phase-model idea resurfaces later in the course as the five-phase methodology class 09 builds around offensive engagements. Reconnaissance sits first because everything gathered here (technical infrastructure, employee names, exposed credentials) becomes the raw material every later stage relies on: an attacker cannot weaponize a payload for a vulnerability they don’t know exists, or craft a convincing phishing lure without knowing who to impersonate. This is why weak OSINT hygiene on an organization’s part, whether through oversharing on social media, un-scrubbed document metadata, or unmonitored subdomains, raises risk at every later stage, not just the first one.
Passive vs active reconnaissance
Passive reconnaissance collects information without directly interacting with the target, making it stealthier and harder to detect; active reconnaissance involves direct interaction with the target’s infrastructure or services, which carries a higher risk of triggering alerts. Passive techniques carry low detection risk while yielding a large volume of information — enough to build a detailed profile of a person or organization before any direct contact is made.
Attackers leverage OSINT to select vulnerable targets and craft convincing social engineering lures, while security teams use the same techniques to identify unintentional public exposures — shadow IT, data leaks, or poor staff practices that an adversary could exploit first.
OSINT tools in Kali Linux
| Tool | Description |
|---|---|
theHarvester | Collects email addresses, usernames, hosts, and subdomains |
Maltego CE | Visualizes relationships between entities such as people, domains, IPs |
whois | Displays domain owner information |
dig | Queries DNS records for a domain |
nslookup | Basic DNS lookup for a domain’s records |
dnsrecon | Automates DNS information gathering |
ExifTool | Extracts metadata from images and documents |
| Google Dorks | Advanced use of search engine operators to find sensitive data |
Although these tools automate processes, human analysis remains key for interpreting results.
Among these, Maltego CE works differently: instead of returning a single answer to a query, it builds a graph. Each entity (a domain, email, person, IP address) can be expanded via a transformation, an automated query that discovers related entities. The value is in the chain: pivoting from one entity to the next surfaces connections no single lookup would reveal, such as a shared IP between two apparently unrelated domains.
OSINT techniques by target type
Gathering on people
Goal: obtain data to identify, locate, or profile a person.
Information sought: social media profiles, email addresses, resumes, photographs with metadata, forum participation.
Documents and images carry metadata beyond their visible content. A photograph’s EXIF data can include the camera or phone model, the exact date and time it was taken, and the GPS coordinates recorded at capture. Office documents (DOCX, PDF) commonly embed the author’s name or corporate username, the software and version used to create or edit the file, and revision timestamps. None of this is visible when the file is simply opened, which is exactly what makes it valuable during an OSINT engagement. It is also what makes un-scrubbed files dangerous to publish: a press-kit PDF can leak an internal username, and a photo posted to social media can leak the physical location where it was taken.
Common techniques include advanced searches using Google Dorks (combining operators such as site: and filetype:, e.g. site:example.com filetype:pdf), queries on services like Hunter.io and HaveIBeenPwned to surface email addresses and leaked credentials, analysis of image metadata with tools like ExifTool, and reverse image searches on Google or Yandex to trace a photograph back to its origin.
Gathering on infrastructure
Goal: understand an organization’s digital infrastructure and its public exposure.
Typical data: WHOIS information, DNS and subdomains, IP addresses, public emails, exposed services.
For infrastructure, analysts run WHOIS and DNS queries with dig and dnsrecon, enumerate email addresses and subdomains with theHarvester, map relationships visually in Maltego, and search for exposed services and devices using Shodan or Censys. Both are search engines that continuously scan the public internet and index what they find: not web pages, but the banners, headers, and metadata that exposed services return, including open ports, server software and versions, TLS certificates, and even device types such as webcams or industrial control systems. Where theHarvester or dig return information about one target you specify, Shodan and Censys let you search across their whole index by service fingerprint, such as product:"nginx" country:CO, which surfaces every nginx server the engine has indexed in Colombia, useful both for profiling one organization’s footprint and for the broad exposure research an attacker does before selecting a target. In this class’s lab, Maltego’s transformations can route through Shodan to enrich domain and IP entities, so understanding what the tool returns changes how you read those results in Part 3.
Which DNS record type you query matters for what it tells you about a target’s security-relevant exposure. An NS record reveals who manages DNS for the domain, frequently a third-party provider whose own security posture becomes part of the target’s attack surface. An MX record matters directly for planning a phishing engagement, since it names the mail infrastructure receiving the domain’s email, and it also surfaces third-party email providers (Google Workspace, Microsoft 365) that widen the attack surface beyond the organization’s own infrastructure. An A record’s security relevance is more direct: it tells you exactly where a service is hosted, the starting point for the next stage of infrastructure profiling. When the lab has you run dig +short MX example.com, you’re identifying the mail infrastructure a red team would need to understand before targeting the organization with email-based attacks.
Ethical and legal considerations
Although OSINT is based on public sources, not everything accessible is legal to use. Posting something on social media does not imply consent for automated collection, and many platforms explicitly prohibit scraping in their terms of service. In professional audits, written authorization from the client must exist before gathering information about their environment. Throughout any investigation, the privacy and security of third parties must be respected — gathering information for harmful purposes crosses both legal and ethical lines.
In professional cybersecurity, ethics and legality are as important as technical knowledge.
Hands-on lab
Requirements: Kali Linux, internet access, Maltego CE
Part 1: Passive reconnaissance on a domain
Each pair will receive an assigned domain or identity.
- Use
whois,nslookup, anddigto profile the domain - Run
theHarvesterto search for emails, hosts, and social media:
theHarvester -d example.com -b google,bing- Optional: use
crt.sh,hunter.io,amass, or web OSINT tools
Question
What email addresses, subdomains, or hosts did
theHarvestersurface? Were any results unexpected or particularly sensitive? How could an attacker leverage this information against the target?
Part 2: Metadata analysis
Files (PDFs, images, DOCX) with embedded metadata will be provided.
- Analyze with
exiftooland online tools - Identify authorship, timestamps, software, location
- Extract coordinates and plot them on a map
Question
What does the metadata reveal about the document’s origin and history? Could any of these details — author name, software version, or GPS coordinates — be used to profile or target a specific individual?
Part 3: Visualization in Maltego CE
- Create entities and use basic transformations
- Identify non-obvious connections
Question
What relationships did Maltego surface that you would not have found through manual searching? What security risk do these connections represent for the organization?
- Export the graph image for inclusion in the report
Submission
Report per pair (max. 3 pages plus images):
- Techniques and tools used
- Main findings per section
- Maltego visualization
- Critical analysis of risks, ethics, and privacy
- Brief personal reflection (one per student)
OSINT Cheatsheet
Quick reference for commands and tools used in open source intelligence gathering.
1. Domain information
| Tool | Command | Description |
|---|---|---|
whois | whois example.com | Shows registrant, dates, and name servers |
nslookup | nslookup example.com | Basic DNS query |
dig | dig example.com ANY | Detailed DNS query |
dig | dig +short MX example.com | Query MX records |
2. Emails, hosts, and social media
| Tool | Command | Description |
|---|---|---|
theHarvester | theHarvester -d example.com -b google,bing | Searches for emails, subdomains, hosts |
amass | amass enum -d example.com | Subdomain enumeration |
crt.sh | https://crt.sh/?q=example.com | SSL certificates associated with the domain |
hunter.io (web) | — | Public emails associated with domains |
3. File metadata
| Tool | Command | Description |
|---|---|---|
exiftool | exiftool file.jpg | Extracts metadata from images, PDFs, etc. |
| Web | https://www.metadata2go.com/ | Quick analysis without a terminal |
strings | strings document.docx | Extracts hidden text or plain metadata |
4. Visualization with Maltego CE
| Action | Description |
|---|---|
| Create entity | Domain, email, IP, etc. |
| Transformations | Use free ones (e.g., Shodan or DNS) |
| Export graph | Right-click → Export → as image |
5. Useful online tools
| Site | Use |
|---|---|
| shodan.io | Exposed IPs, open ports, IoT devices; filter by service, e.g. product:"nginx" country:CO |
| search.censys.io | Internet-wide scan search engine similar to Shodan; search by host, certificate, or exposed service |
| hunter.io | Emails by domain |
| haveibeenpwned.com | Check whether an email address appears in a known public data breach |
| builtwith.com | Technology used by a website |
| Google Dorks | Advanced Google search techniques |
6. Ethics and legality
| Guideline | Reason |
|---|---|
| Do not interact with real targets without permission | May be considered illegal or invasive |
| Do not perform fuzzing or active attacks | This class covers passive reconnaissance only |
| Always indicate source and limitations | To avoid incorrect conclusions |
Report Template
Recommended structure for the OSINT lab report.
Cover page
- Title: OSINT Lab — Public Information Gathering and Analysis
- Pair names
- Assigned target (domain/person)
- Date
1. Techniques and tools used
Brief list with an explanation of what each tool was used for.
2. Findings by section
- Part 1: domain/person
- Part 2: metadata
- Part 3: Maltego graph
3. Visualization
Insert Maltego graph image.
4. Critical analysis
What risks were detected, potential impact, possible countermeasures. Also state the authorization basis for this exercise: it was conducted against an assigned target under instructor authorization for educational purposes. Contrast this with a professional engagement, where the equivalent authorization must come from a signed agreement with the client before any information gathering begins.
5. Personal reflection
Each team member writes a brief paragraph about what they learned and the importance of ethics in OSINT.
Key concepts
| Term | Definition |
|---|---|
| Confidentiality | Property that information is only accessible to authorized entities |
| Integrity | Property that information has not been modified without authorization |
| Availability | Property that systems are accessible when required |
| Malware | Malicious software designed to damage or compromise systems |
| Pentesting | Authorized security assessment that simulates real attacks |
| OSINT | Process of collecting and analyzing publicly available information |
| theHarvester | OSINT tool that collects emails, subdomains, and hosts |
| Google Dorks | Advanced search techniques for finding exposed information |
| Kill Chain | Model describing the phases of a cyberattack, starting with reconnaissance |