Part 5 of the "Hacking from Zero" series

OSINT: How Hackers Find Information About You

Published June 9, 2026 · By 0xiMAK

"The most dangerous hacker isn't the one who breaks your code — it's the one who already knows everything about you before they start."

Open-Source Intelligence (OSINT) involves collecting information about targets using only publicly available sources — no system access required. It represents the first phase of most real-world attacks and proves remarkably effective.

This final blog in the "Hacking from Zero" series covers OSINT fundamentals, professional techniques, essential tools, and legal practice opportunities on TryHackMe.

🔍 What Is OSINT?

OSINT stands for "open-source intelligence" — intelligence gathered exclusively from public sources:

• Websites and social media
• DNS records and WHOIS data
• Public databases and government records
• Search engines
• Job postings and company websites
• Data breach dumps
• Images and metadata

No systems are touched. No laws are broken. Yet a skilled investigator can build a detailed picture of a target — individual or organisation — before launching any attack.

In penetration testing, OSINT is used to:

• Map an organisation's attack surface
• Find employee names, emails, and roles for phishing
• Discover subdomains and IP ranges
• Identify technologies in use
• Find leaked credentials from old breaches

🧩 The OSINT Framework

Think of OSINT as five interconnected information categories:

1. Target Profiling (People)

Building profiles of individuals — names, roles, email formats, social media presence, physical locations.

2. Infrastructure Mapping (Organisations)

Domains, subdomains, IP ranges, ASN numbers, hosting providers, technologies used.

3. Credential Discovery

Leaked emails and passwords from historical data breaches.

4. Digital Footprint

What the target has published online — posts, comments, metadata in documents and images.

5. Physical Intelligence

Office locations, employee patterns, public records.

🛠️ Core OSINT Techniques & Tools

Google Dorking — Search Engine Hacking

Google indexes far more than most people realise. Special search operators called Google Dorks let you find sensitive files, exposed admin panels, and misconfigured servers using only Google.

Key operators:

Powerful combinations:

site:example.com filetype:pdf          # PDFs on a domain
site:example.com filetype:xls          # Spreadsheets (often contain data)
intitle:"index of" "parent directory"  # Open directory listings
inurl:wp-admin site:example.com        # WordPress admin panels
site:linkedin.com "example.com"        # Employees on LinkedIn

The Google Hacking Database (exploit-db.com/google-hacking-database) maintains thousands of ready-made dorks for finding vulnerabilities.

WHOIS & DNS Enumeration

WHOIS lookups reveal who registered a domain, when, and sometimes contact information.

whois example.com

DNS enumeration goes deeper — mapping all subdomains and records for a target domain.

# Basic DNS lookup
dig example.com
dig example.com MX          # Mail servers
dig example.com TXT         # SPF, DKIM, verification records

# Zone transfer attempt (finds all subdomains if misconfigured)
dig axfr @ns1.example.com example.com

# Subdomain brute-force
gobuster dns -d example.com -w /usr/share/wordlists/SecLists/Discovery/DNS/subdomains-top1million-5000.txt

# DNSDumpster — passive subdomain enumeration
# Visit: dnsdumpster.com

Why it matters: Subdomains reveal forgotten staging servers, old applications, and internal-facing services accidentally exposed to the internet.

Shodan — The Search Engine for Devices

Shodan scans the entire internet and indexes everything it finds — web servers, cameras, databases, and industrial control systems. It's the most powerful OSINT tool for infrastructure reconnaissance.

Useful Shodan searches:

hostname:example.com                  # All devices for a domain
org:"Example Company"                 # Devices belonging to an org
port:3389 country:US                  # RDP servers in the US
product:Apache version:2.4.49         # Specific vulnerable software versions
"default password" port:23            # Telnet devices with default creds
city:"London" port:22                 # SSH servers in London

Shodan from the command line:

# Install
pip install shodan

# Search
shodan search "apache 2.4.49"

# Get info on an IP
shodan host TARGET_IP

A single Shodan query on a company's IP range often reveals forgotten test servers, unpatched software versions, and exposed databases.

theHarvester — Email & Subdomain Harvesting

theHarvester is pre-installed on Kali and is purpose-built for gathering emails, subdomains, hosts, and employee names from public sources.

theHarvester -d example.com -l 500 -b all

Flags: -d target domain, -l 500 limit to 500 results, -b all use all available sources (Google, Bing, LinkedIn, etc.)

What it finds:

• Employee email addresses (invaluable for phishing simulations)
• Subdomains not found via DNS
• IP addresses and hosts
• LinkedIn profiles

Have I Been Pwned & Credential Hunting

Have I Been Pwned (haveibeenpwned.com) tells you if an email address appeared in a known data breach. In a pentest, you'd check whether target employees have leaked credentials from old breaches — and whether they reused those passwords.

# From the command line with the API
curl -s https://haveibeenpwned.com/api/v3/breachedaccount/target@example.com

Related tools:

• Dehashed (dehashed.com) — Search leaked databases by email, username, IP, or password hash
• IntelX (intelx.io) — Search data breach archives, darkweb data, and leaked files

Maltego — Visual OSINT Mapping

Maltego is a graphical intelligence platform that visualises the relationships between entities — domains, IPs, emails, people, and organisations. It automates many OSINT tasks and presents them as an interactive graph.

It's the tool you see in hacking movies that looks cool — and actually works.

Download: maltego.com (free community edition available)

A typical Maltego investigation starts with a domain and automatically expands to show DNS records, associated IPs, emails, linked social profiles, and more.

Reverse Image Search & Image Metadata

Reverse image search — uploading an image to find where else it appears online — can identify people from profile photos, locate physical buildings from images, and verify if a social media profile is fake.

Tools: Google Images (images.google.com, drag and drop), TinEye (tineye.com), Yandex Images (most powerful for faces)

EXIF metadata embedded in images can reveal the GPS coordinates where a photo was taken, the camera model, software used, and even the exact timestamp.

# Extract EXIF data from an image
exiftool image.jpg

One of the most famous OSINT cases: a hacker posted a photo online and didn't realise the GPS coordinates were embedded in the image metadata.

Social Media OSINT

Social media is a goldmine for intelligence:

• LinkedIn — job titles, technologies companies use (from job postings), org structure, employee names
• Twitter/X — real-time posts, locations, event check-ins
• Facebook — personal details, family connections, location history
• Instagram — location check-ins, daily routines, photos with metadata

Tools:

# Sherlock — find a username across 300+ platforms
python3 sherlock username

# SpiderFoot — automated OSINT framework
spiderfoot -s example.com -m all

Job posting OSINT: Companies reveal their entire tech stack through job postings. An ad for "Senior AWS Engineer with Terraform and Jenkins experience" tells an attacker exactly what infrastructure the company uses.

🎯 Practice on TryHackMe

Start with OhSINT — it's a perfect beginner room that teaches you to extract information from a single image using multiple OSINT techniques.

🔐 Protecting Yourself from OSINT

Understanding OSINT as a defender is just as important:

For individuals:

• Audit your social media privacy settings
• Don't post location data in real time
• Use a password manager — unique passwords per site reduces breach impact
• Check haveibeenpwned.com for your email addresses
• Reverse-image search your profile photos

For organisations:

• Redact sensitive info from public job postings
• Use privacy-protected WHOIS registration
• Regularly audit your external attack surface
• Monitor for leaked credentials on breach databases
• Remove metadata from documents before publishing

🧰 OSINT Tools Quick Reference

🚀 Series Complete!

You've made it through the full "Hacking from Zero" series. Here's what you've covered:

1. ✅ TryHackMe Learning Path — Where to start and how to progress
2. ✅ Nmap Deep Dive — Reconnaissance and port scanning
3. ✅ Networking Fundamentals — OSI, TCP/IP, DNS, ARP
4. ✅ RootMe Walkthrough — Web exploitation and privilege escalation
5. ✅ OSINT — Intelligence gathering from public sources

Your next steps:

• Complete the TryHackMe Jr Penetration Tester path
• Try HackTheBox (harder, less guided — a great next challenge)
• Study for the eJPT certification — the perfect first cert
• Keep a write-up blog for every room you complete — it cements learning and builds a portfolio

The hacker mindset is built one room, one exploit, one blog post at a time. Keep going.

Tags: #OSINT #CyberSecurity #TryHackMe #EthicalHacking #Reconnaissance #Pentesting #InfoSec #GoogleDorking #Shodan #OpenSourceIntelligence

← Back to Blog