So you want to start OSINT.
I guess you’re thinking: “the amount of tools, websites and things to learn is overwhelming!”
How to sift through the noise of the digital age without drowning in data?
That’s the big question every beginner ask, and we were all there.
I thought I should recommend some tools to beginners.
So I mapped a list of all essential OSINT tools that turn hidden information into geopolitical insights and precious data.
From Google’s hidden tricks to deep investigation tools, whether you’re tracking global trends or sharpening investigative skills, consider this your starter kit for navigating the messy crossroads of Open Source Intelligence.
I made this list as friendly as possible for people that don’t have any knowledge in programming/coding. So it should be all easy to use right from the start.
See it as the ‘ultimate’ beginner guide with everything you need to start properly if you’re beginner.
You will thank me later.
Table of contents
- Privacy Setup
- VPN
- Tor
- Obsidian (or equivalent)
- Intel Techniques Search Tool
- OSINT Framework
- OSINT Essentials
- Shodan
- Maltego
- Telegram
- Hunter.io
- OSINT Combine
- Hunchly
- Social Searcher
- Go analyze the world
Privacy Setup
The first step that all beginners forget. And it’s actually a BIG step, probably the most important.
Most of people who start OSINT, just rush into it and want to try all the most fancy tools right away.
It’s cool to be enthusiastic, but it’s even more cool to do things the right way by protecting yourself, before you go to some risky places in the deep web, especially if you’re a whistleblower, a journalist or a reporter in a dangerous area, or any situation that can be risky.
So before searching anything, please, think about your digital footprint!
Imagine a kid, who wants to steal (incognito) a cookie in his parents kitchen. But the kid just came out of the garden and his shoes are full of mud.
So when he steals the cookie, he leaves the kitchen full of mud footprints
That’s exactly what beginners are doing when they start.
They leave their digital footprints all over the internet and they’re not even aware about it (how cute).
In the OSINT world, that’s probably one of the worst things that can happen to you.
To get tracked by a person who detected your intrusion and discover your Instagram profile, your Facebook profile, your IP address or to put it more simply: your identity.
It was maybe cool what you got from your research...
but this guy who detects you, he got something much better, his jackpot, he finds you.
So please, don’t skip this step and actually do the work of deleting as much as possible all the information on the internet that could reveal your identity.
Clean all your private information from social media or any website that could possibly display anything about you.
To help you with that, here’s 3 tools to help you start:
In case you don’t want to do that, because you’re a public personality and your identity is all over the internet and you’re fine with it, then try to create at least a lure, by creating a fake identity. Create a new email, a new account, a new (fake) person on the web, to use only for your OSINT investigations.
You can even use a tool like This Person Doesn’t Exist to generate the face of your new alternate identity. It’s very easy to use — every time you refresh the page, a new unique face is created.
Don’t underestimate this step, it’s usually the longest one before diving into actual OSINT techniques. It can take days, weeks, or even months for some people, but thoroughly clean up your online presence before doing anything serious in terms of research.
VPN
Now that you’ve minimized as much as you can your digital footprint or at least created a lure, we go slowly start to dive into proper OSINT.
The first real ‘tool’ and the most basic one you’re going to need is probably a VPN.
And I stop you right there: a VPN is NOT useful for protecting your identity or privacy
That’s absolutely not the goal of a VPN, or at least it’s very secondary and can be easily bypassed if skilled people really want to.
No, a VPN is useful to access websites or files that are restricted in some areas.
You do it to access cool series on Netflix that are accessible only in some countries, it’s the same thing.
The only difference is that instead of entertainment, it can be a national website only accessible from one country, where you need to go to access some files for example.
As you may know, there’s hundreds of VPNs out there, but if I can recommend a few, here’s a good start:
Some are really useful, as it’s letting you create your own private VPN.
TOR
In addition to a VPN, you’ll probably realize at some point that the best “VPN” you can use is Tor.
Tor uses a very simple concept, but very effective.
It creates multiple layers of “VPN” to make it much harder for somebody to detect your IP address.
So instead of having one VPN, you get layers and layers of VPNs.
That’s why it uses the “onion” analogy, as it’s the same concept, of layers on top of layers that creates a thick protection.
Tor will probably be useful for 95% of cases. For the 5% left, well, you’re really digging some dangerous stuff at this point.
But in any case, do yourself a favor: download Tor.
Yep, we start with the basics.
Now that you are actually ready to properly start searching, you’re actually going to need to properly understand how to use Google at its full potential.
The reality is that Google’s search engine swallows 85% of OSINT’s dirty work.
Basic web searches are just the appetizer that more than 99% of the population are using, and they’re satisfied with it.
If you’re here, it’s because you’re part of the 1% that is not satisfied and want to dive deeper to get the truth and not what mainstream media is giving you.
«Ninety percent of Intelligence comes from open sources. The other 10 percent, the clandestine work, is just the more dramatic. The real intelligence hero is Sherlock Holmes, not James Bond.»
Samuel V.Wilson, former director of the Defense Intelligence Agency
The first step I recommend for a beginner is to get familiar with Google’s Advanced Search tool.
By itself, it’s already a much better way to search specific information, than the basic Google search bar.
I advice you to not skip too quickly this step and actually take time to play around with the Advanced Search.
It’s a good ‘sandbox’ to get your hands comfortable with the OSINT ‘way of thinking’ that you’re going to use a lot in the next steps.
See it as a warm up.
That’s it? You’re good?
So the next step to mastering Google even more deeply is dorking.
Operators like "site:" and "filetype:pdf" crack open hidden server files and confidential documents, that sometimes even the owners thought you can never see.
Digital breadcrumbs taste better when you know where to dig.
But here’s the rub, every Dorking query risks crossing ethical tripwires.
Sure, it’s all "public" data until you’re scraping login portals or healthcare records.
So just a little warning to beginners that could think they’re hackers; lawyers call it trespassing.
Google’s index doesn’t care about your noble intentions, so be careful what you’re taking online and always do it with an ethical mindset.
Welcome to the OSINT world.
By the way, dorking also works with other Search Engines like Bing or Yahoo, just to name examples.
So to help you get familiar with Dorking, here’s some resources:
- OSINT Basics : Going Beyond Google with Bing and Yahoo Dorking
- How to Boost OSINT Investigations with Google Dorking Techniques
- Compass Security OSINT Cheat Sheet
- 7 Google Dorks OSINT for Analysts
Obsidian
As soon as you’re going to scrap and find a lot of information, files and documents here and there, you’re going to realize something very quickly: you need a database to save all these things you’re finding.
And even better, you need to organize all this information you’re collecting, so it’s not a mess and you can actually use it in an efficient way.
Here’s come the note-taking app, or the ‘second brain’, depending on the style of tool you prefer and how big you want it to be.
In general, Obsidian is an excellent starting point.
It’s the most raw but versatile, and you can work with it offline, and you can go very far in personalization.
But there are of course other alternatives like Capacities, Notion, and many others.
Frankly, there’s so much note-taking apps these days that I couldn’t put them all in this article.
To save time, you can check the complete list on Toolfinder.
By the way, if you choose Obsidian, here’s an excellent guide on how to use Obsidian for OSINT.
Intel Techniques Tools
Now that you’re ready to gather a lot of information with a solid note-taking app, we can go deeper into the searching tools.
Michael Bazzell, the well-known author of the two books OSINT Techniques and Extreme Privacy, shared a few years ago a very useful search tool for beginners.
It’s simply called the IntelTechniques Search Tool.
It saves a lot of time, by giving you ready-to-use fields for different types of information.
You can search specifically any type of info: could be documents, phone numbers, videos, images, email addresses, domains, and almost anything imaginable.
Take the time to test this tool.
It doesn’t look fancy, but once you understand its power, you’re going to spend hours searching (very efficiently) and successfully finding the things you need.
OSINT Framework
What a better first real tool, than a list of tools by itself, but organized in a way that… is recommending to you the right tool for the right need.
Think of OSINT Framework as the investigator’s library, a flowchart-style toolkit indexing free resources across social media and web domains.
Click through nested directories to find Instagram scrapers or leaked database search engines. Raw potential, zero hand-holding.
The beauty? It forces you to map your own path through OSINT’s chaos.
Cryptocurrency tracers sit beside Telegram scrapers, a buffet for geopolitical snoops.
But remember: free access means you’re the quality control.
Here’s the link: osintframework.com
OSINT Essentials
OSINT Essentials is exactly what I wish I had when I started, several years ago.
It’s kind of similar to OSINT framework in a way, but it’s better in many other ways.
As the name says, it gives the essential free tools, organized by clear categories.
Most beginners in OSINT are probably going to find 80% of the time what they want, using only OSINT Essentials.
It’s really simple but at the same time so efficient. Exactly what you need to start.
Shodan
Once you’ve mastered all the first tools above, you’re pretty quickly going to reach a point where you’re going to hear about 2 big mainstream OSINT tools that pretty much everybody tried at some point.
These 2 big tools are Shodan and Maltego.
Let’s start with Shodan.
Shodan is the clickbait king of the Internet of Things (IoT), exposing unsecured traffic lights and hospital ventilators like carnival attractions.
That attack on the Ukrainian power grid? It probably started here.
The OSINT guide by TechMindXperts calls it “Google for hackers,” but honestly, even script kiddies (novice hackers) find blueprints of Iranian nuclear facilities there between TikTok breaks. Its potential is enormous if you know how to use it.
Maltego
Maltego is a tool that almost anyone serious about practicing OSINT will use at some point.
The Free version is pretty limited but good for starting and getting familiar with it. Paid plans remove the handcuffs and are usually used by companies, big groups or even the police in many countries.
I won’t go into detail about Maltego in this article — it would make it too long — and the best beginner’s guide already exists. It was written by Wondersmith_Rae and covers all the basics of Maltego.
So if you want to try how to link emails to domain registrations faster than conspiracy theorists, start from there.
Telegram
Yes, you can’t do OSINT without having Telegram.
These days, Telegram is so huge in the world, that it’s honestly unavoidable.
Telegram is almost a world by itself, there’s literally everything in it, see it almost as second Google.
It’s the main source of information regarding the conflict in Ukraine, as both sides are using it intensely.
So again, I’m not going to dive in Telegram here, it would be too long.
I invite you to check these 2 articles to get the basics of OSINT in Telegram.
- OSINT on Telegram: Find Phone Numbers, Emails and User Details
- Telegram OSINT A to Z: An Overview by Molfar
Hunter
You’re still here?
Wow, you’re pretty interested in OSINT, congrats.
So let’s move on to the next tool: Hunter.io.
Hunter.io sniffs out corporate email patterns like a bloodhound tracking moles.
Sales teams weaponize its algorithms to reverse-engineer company hierarchies from Gmail to Outlook, all from a domain name.
There are of course alternatives to Hunter.io, such as Snov.io, for example.
These tools are useful when you want to get the email of a person that owns a website or is a part of the group or company behind it, in case the emails are not displayed directly on it.
It’s a good first tool to quickly check for email addresses.
OSINT Combine
OSINT Combine is another tool widely used by many organizations and companies.
However, for an individual who simply wants to conduct a few investigations, it’s a bit too advanced.
However, they share a very valuable list of free OSINT tools for beginners.
This list gives bookmark stacks, tools to find usernames on websites, geo-searching on social media and much more. You will probably find useful things in there.
Hunchly
Hunchly is another tool that has been becoming increasingly popular lately.
It’s similar in some ways to Maltego and Obsidian combined but is really designed for investigations.
It’s a paid tool but you can try it for free for 30 days.
It’s a very complete tool that, as they say “Capture, organize, and preserve information from online research, safely, quickly, and easily.”
Pretty straightforward.
Social Searcher
Social Searcher is an excellent tool when you want to investigate topics on social media.
There’s not much more to say, the tool gives you 3 possibilities:
- Search mentions
- Search users
- Search trends
More than enough for most of researches.
Go analyze the world
Choosing OSINT tools demands tactical alignment, journalists and investigators need quick verification dashboards while intelligence teams require dark web crawlers and more serious big tools.
If you’re a writer, a journalist, an analyst or something of that sort, and you want to analyze events, trends, conflicts and news, OSINT is a precious skill that will get you ahead of almost everybody, because you will detect the trends and get the info before everyone else.
Free tools like Google Dorks suffice for basic recon, but tracking Belarusian dissident networks? That’s another level of OSINT.
The purpose of my article was really to give you the basic keys so you can begin your journey in OSINT without going through the overcomplicating stuff that most of blogs and youtubers are doing.
So I hope you will take these tools and adapt them to your specific needs.
From Google's brute-force simplicity to Maltego's shadow-tracing webs, these tools democratize intelligence gathering—but wield them like scalpels, not hammers.
The most important is to remember: every digital breadcrumb you collect walks the tightrope between public insight and personal intrusion.
Now that you have the arsenal to get started, whether you’re an analyst, a journalist, any other professional, or simply a responsible citizen, go make your voice heard in the invisible wars shaping our world, before someone else writes the story for you. And don’t forget...
0 Comments