# OSINT BIBLE
Image / Meme Fact CheckUploaded Image
Transcribed Text
AI Image Detection
This is a digitally designed reference/infographic ('OSINT BIBLE') composed of structured tables and text. The text is fully legible, coherent, and technically accurate, which is inconsistent with AI image-generation models that typically produce garbled text. It appears to be an authentically created document (likely made in a design or document tool), not AI-generated imagery.
- All text is crisp, legible, and semantically coherent throughout the document
- Consistent table structures, alignment, and typography typical of a designed infographic or reference sheet
- URLs, tool names, and technical commands (e.g., 'docker run -it --rm twint') are accurate and meaningful
- No image-domain artifacts such as warped edges, blending anomalies, or texture inconsistencies
- Layout is a clean digital document/screenshot rather than a photographic scene
Largely Reliable (Educational Reference)
Confidence: Medium-High
StandardExecutive Summary
The image is an OSINT quick-reference cheat-sheet ('OSINT Bible') covering fundamentals, methodology, search engines, dorks, archives, social-media tooling and geolocation resources. It is a definitional/instructional artefact rather than assertive news claims, so most content is verifiable against tool documentation and standard tradecraft. High-priority checks confirm the core framework definitions (intelligence cycle) and the existence/function of headline tools (HIBP, Shodan, Censys, Maigret, Instaloader, Amass, URLhaus, GreyNoise, PublicWWW, Hunter). Two categories reduce the score: (1) minor imprecisions and possibly outdated operational details (the intelligence cycle is more commonly described as five or six stages depending on model; tools such as Twint have stalled after Twitter/X API changes; dork syntax and 'star tool' assignments are opinionated, not canonical), and (2) promotion of techniques (accessing exposed IP cameras/index-of password files, ToS-breaching scraping) that carry legal/ethical risk with insufficient caveats. No claim was marked False; unverifiable or opinion-based items are flagged Unverified. Trustworthy as educational orientation, not authoritative on legal boundaries or the current live status of individual tools.
Factual Verification
Verified Claims
- Have I Been Pwned (HIBP) is a data-breach search and notification service that lets users check whether an email/domain/password appears in known breaches.
- Shodan is a search engine that indexes internet-connected devices, including IoT and ICS/SCADA systems.
- The intelligence cycle is a structured, circular process spanning (planning/)direction, collection, processing, analysis (& production) and dissemination; the sheet's five-step listing is a valid common representation.
- Maigret is an open-source OSINT tool that searches a username across thousands of public sites and produces reports.
- Instaloader is a mature open-source utility for downloading Instagram photos/videos with captions and metadata.
- Amass (OWASP) is an open-source tool for subdomain enumeration, DNS reconnaissance and asset/infrastructure mapping.
- URLhaus is an abuse.ch project that collects and shares URLs used for malware distribution.
- GreyNoise characterises internet background 'noise', distinguishing benign mass scanners from targeted reconnaissance.
- PublicWWW is a source-code search engine indexing HTML/JS/CSS across a very large number of websites.
- Hunter.io's free tier provides a limited number of searches per month (commonly cited as ~25).
- Censys provides certificate and banner-based internet scanning intelligence.
Unverified Claims
- Twint's example command and its ongoing effectiveness: the GitHub project exists, but Twitter/X API and access changes have widely degraded such non-API scrapers; current reliability Unverified.
- SearchCode indexing exactly '75B lines of code': the tool exists, but the precise 75-billion figure was not confirmed from a primary source and may be outdated.
- Specific 'Star Tool' assignments (Infobel/phone, Snoop/username, BlockCypher/wallet) are curatorial opinion, not independently adjudicated as best-in-class.
- Exact Google Dork syntax/results (IP-camera and index-of-passwords strings): dorking is real, but specific strings' current effectiveness varies and was not verified live.
- Instagram/LinkedIn scraper Risk/Legal ratings (Low/Medium; 'Scrape = ToS') are simplifications; legality depends on jurisdiction and use.
- OSINT definition phrasing 'without violating logical or physical access' is a reasonable paraphrase but not a universally standardised definition.
- Yandex 'best results CIS' and Baidu 'Asia' are heuristic generalisations, plausible but not objectively established.
- Availability of niche listed services (FOFA free API, StoriesIG, Picuki 'world map', SOLG, Yark, CachedView) not individually verified.
Disputed / False Claims
- No claim met the evidentiary bar to be labelled False under the guardrails; none identified.
Bias & Presentation
Detected Biases:
- Selection/curation bias: 'Star Tool' picks present opinionated preferences as if canonical.
- Tooling-centric framing: emphasises tools over method, legal analysis and verification rigour.
- Optimism/omission bias on legality: 'Risk: Low' labels and terse 'Scrape = ToS' understate legal/ethical exposure.
- Recency bias risk: static cheat-sheet cannot reflect fast-changing tool/platform status (e.g., X API changes affecting Twint).
- Offensive-leaning framing: dorks for exposed cameras and 'index of passwords' foreground intrusive uses with minimal caveats.
Language Patterns
Emotional manipulation: 0.06
Quality Assurance
Limitations: Live functional testing of tools/dorks was not performed; some niche services unverified; the image provided no source URLs to audit provenance.
Confidence
Level: Medium-High
High confidence on core, checkable facts: headline tools exist and function as described, and the intelligence-cycle definition matches doctrinal sources. Confidence is tempered to Medium-High because a cheat-sheet's value hinges on currency and legal nuance: several operational details (Twint viability, SearchCode's line count, exact dork behaviour, free-tier limits) are time-sensitive and were not live-tested, and legal/ethical caveats are under-stated. No item warranted a False label under the guardrails, so uncertainty is expressed via Unverified flags rather than deductions for disproven claims.
Search Journal
Query: Have I Been Pwned breach notification service Troy Hunt
Query: Shodan search engine internet-connected devices ICS SCADA
Query: intelligence cycle stages direction collection processing analysis dissemination
Query: Maigret OSINT username search tool
Query: Twint Twitter scraping tool archived deprecated Twitter API
Query: Instaloader Instagram download tool
Query: Amass OWASP subdomain enumeration DNS tool
Query: URLhaus abuse.ch malware distribution URLs
Query: GreyNoise internet background noise scanner benign
Query: PublicWWW search source code website
Query: Hunter.io free searches per month plan
Query: Censys internet scanning certificates banners
Article Content
# OSINT BIBLE
## 1. Fundamentals
| Concept | Quick Definition | |---------|------------------| | OSINT | Intelligence obtained from public sources without violating logical or physical access | | OPSEC | Minimize footprint: VPN → VM → alias + metadata strip | | Intelligence Cycle | Direction → Collection → Processing → Analysis → Dissemination | | PII | Information that identifies: email, phone, RFC, CURP, IP, IMEI, MAC | | Primary Source | Original publication (tweet, official PDF, photo EXIF) | | Secondary Source | Article citing the primary (validate) |
## 2. 4-Step Methodology
1. **Define question** → What do I want to know? 2. **Identify sources** → Table below | 3. **Collect** → Manual + automations | 4. **Validate and document** → Screenshots, hash, date, URL, archive.org |
| Data Type | Usual Location | Star Tool | |-----------|---------------|-----------| | Name | LinkedIn, Facebook | Maigret | | Email | Data breaches, newsletters | HIBP | | Phone | WhatsApp Business, TrueCaller | Infobel | | Username | Forums, gaming, GitHub | Snoop | | Photo | Geolocation, EXIF | Exiftool | | Domain | WHOIS, certificates | Amass | | IP | Scanning, Shodan | Shodan | | Crypto wallet | Blockchain explorers | BlockCypher |
## 4. Internet Search
### 4.1 Google Dorks – 20 essentials
| Objective | Dork | Example | |-----------|------|---------| | Government PDFs | `site:gov filetype:pdf "contract"` | Mexico | | Exposure | `intitle:"index of" passwords.txt` | — | | IP Cameras | `inurl:viewer/live/index.html` | — | | Emails | `site:linkedin.com "@company.com"` | — | | Subdomains | `site:*.target.com -www` | — |
## 4.2 Alternative Search Engines
- DuckDuckGo "bangs" → `!archive` - Yandex → best results CIS - Baidu → Asia - Startpage → no logs - Shodan → IoT, ICS, SCADA - Censys → cert + banner - FOFA → China, free API - ZoomEye → similar to Shodan - BinaryEdge → global scanning - Hunter.io → corporate emails - PublicWWW → search in source code - SearchCode → search in 75B lines of code - SimilarSites → similar sites - Netlas → internet intelligence - CriminalIP → search in connected internet - NerdyData → website technologies - GreyNoise → internet noise - Intezer Analyze → malware analysis - Kaspersky OpenTIP → threat scanning - VirusTotal → file/URL analysis - AlienVault OTX → threat exchange - ExploitDB → exploit database - MalwareBazaar → malware samples - Malware Domain List → malicious domains - PhishTank → phishing URLs - URLhaus → malware URLs - ThreatMiner → threat intelligence - YARAify → YARA rules - PulseDive → IOC search - ThreatFox → malware IOCs - Breach Directory → breach searches - Have I Been Pwned → breach verification - DNSViz → DNSSEC visualization - DNS Twister → similar domains - DNSdumpster → DNS enumeration - SpyOnWeb → related sites - Yark → archive YouTube - CovertAction → investigative journalism - Trellix Research → threat research
## 4.3 Archives and snapshots
- Wayback Machine - CachedView (Google + Archive.is) - URLScan → capture + DOM + requests - Screenshot Guru → screen test - Stored Website → cached pages - ThreatMiner → IOC context - YARAify → YARA rules - PulseDive → IOC search - ThreatFox → malware IOCs - Breach Directory → breaches - Have I Been Pwned → breach verification - DNSViz → DNSSEC - DNS Twister → similar domains - DNSdumpster → DNS enumeration - SpyOnWeb → related sites - Yark → archive YouTube
## 5. Social Networks
### 5.1 Twitter/X
| Task | Tool | Notes | |------|------|-------| | Download all tweets | Twint-docker | `docker run -it --rm twint -u user --since 2024-01-01` | | Network analysis | Network Tool | RT graph | | Deleted tweets | Deleted Tweet Finder | Aggregated API | | Sentiment | Sentiment140 | CSV bulk |
### 5.2 Instagram
| Task | Tool | Risk | |------|------|------| | Photos + metadata | Instaloader | Low | | Anonymous stories | StoriesIG | Low | | Profile analysis | SOLG | Medium | | World map | Picuki | Low |
### 5.3 LinkedIn
| Task | Tool | Legal Note | |------|------|------------| | Employees | CrossLinked | Scrape = ToS | | Email pattern | Hunter | 25 free/month | | Photo URL | LinkedIn-sniper | Public only |
## 6.2 Geolocate
- Google Earth Pro → temporal displacement - Suncalc → shadow = time - Geolocation-verification - Overpass-turbo → POI within radius - FlightAware → flight tracking - FlightRadar24 → flight radar - MarineTraffic → maritime traffic - Ves