Our last meeting covered the basics of Open Source Intelligence, the practice of collecting and analyzing information from publicly available sources, with the aim of producing actionable intelligence. This is a largely multimodal concept, spanning the range of search engine techniques, public repository scanning, social media, geographic intelligence, file metadata extraction, and steganography. Members were then given a reconnaissance challenge to practice these techniques on.

The Intelligence Lifecycle

The primary workflow for open source intelligence is the Intelligence Lifecycle. The cycle starts with planning what to find, so as to keep your research organized, before going out and collecting the information. With the newfound information you can then process it so it's easier to parse, and analyze it to find what you need. Lastly, you can integrate your new findings into your research and start the cycle again for the next piece of information.

Google Dorking

The first OSINT technique we presented is Google Dorking. Search engines like Google have a multitude of built-in techniques originally purposed to help refine your search; for example, putting "quotes" around a keyword will only return sites containing that exact string, and adding filetype: before a phrase limits results to only files of that type. Mastering these advanced filters can allow you to uncover hidden information, automate reconnaissance, locate vulnerable systems, and exploit URL patterns.

Social Media Intelligence (SOCMINT)

While the majority of OSINT reconnaissance is done via the net, sometimes searching within a platform is helpful. Accounts on social media may provide a lot of information about a person or organization. You may be able to find their face, age, workplace, and other connections via platforms like Facebook, Twitter, Instagram, TikTok, and especially LinkedIn. Additionally, while looking at someone's social media, you can read information from videos and photos they've posted, or from posts they've made.

Geographic Intelligence (GEOINT)

Closely related to SOCMINT is geographic intelligence (GEOINT) - the process of determining where a photo or video was taken based on the visual clues (similar to the game GeoGuessr). This task can be streamlined by looking for landmarks, road signs, license plates, terrain and weather, and if all else fails, temporal clues like the direction shadows are facing.

Image Intelligence and Metadata

Images and videos online may contain metadata in the form of EXIF, IPTC, or XMP formats which can give you clues about who owns the image or which device it was taken with. SOCMINT is closely related to image intelligence since these metadata traces are often left in publicly shared media.

The Future of OSINT

Lastly, we conversed about the future of Open Source Intelligence techniques, especially the potential beneficial, detrimental, and impeditive impacts that AI can have on data collection and security.