Translated from 日本語 • View original 
**What is OSINT (Open Source Intelligence)? **
OSINT (Open Source Intelligence) refers to a method of collecting and analyzing publicly available information (open source) and making it available for attack or defense.
Primary Sources
- Website (company website, recruitment page, blog)
- Social media (X, LinkedIn, Facebook, etc.)
- WHOIS information, DNS information, SSL certificate
- Professional services like Pastebin, GitHub, and Shodan
- Public documents (IR materials, business manuals, government-issued documents, etc.)
This information can be viewed by anyone, so it can be collected without any special hacking skills.
The Role of OSINT in Cyberattacks
OSINT is used in the early stages of a cyberattack (Reconnaissance/Reconnaissance phase).
Attackers leverage OSINT to:
1. Understanding the Composition and Assets of the Target Company
- Identify subdomains, mail servers, and cloud environments
- Guess the software version you are using (search for vulnerabilities)
2. Identification of the Target Person
- Obtain the name, title, and email address of the department in charge
- Understand everything from social media posts to workplace, work content, and schedule
3. Materials for Social Engineering Attacks
- Spear phishing from LinkedIn posts disguised as specific departments
- "Recently deployed Azure" post → Attacks targeting Azure administrators
Commonly Used Tools and Services in OSINT
- Shodan
Example application: Search for devices exposed to the Internet - theHarvester
Example use: Collect email domain host information - Recon-ng
Application example: Modular OSINT framework - Google Dorks
Example: Information extraction using advanced search operators - Have I Been Pwned
Example use: Account information leakage confirmation - GitHub / Pastebin
Example: Searching for leaked source code and credentials
⚠ > These tools are legitimate on their own and are also utilized for security assessment and risk analysis.
Risks Posed by OSINT
OSINT information alone can lead to attacks such as:
- Targeted email attacks (BEC, spear phishing)
- Vulnerability scanning → intrusion
- Credential Stuffing
- External leakage of internal documents and confidential materials
For example, there have been many cases where cloud API keys have been compromised and accessed from a configuration file ('.env') inadvertently uploaded to GitHub.
How to Prevent It? OSINT measures that companies should take
1. Regular self-diagnosis (self-OSINT)
- Google search and SNS check by company domain and employee name
- Check the presence of your company's information on GitHub, Pastebin, and Shodan
2. Review of Information Disclosure Policy
- Restrict the disclosure of unnecessary technical information (recruitment blogs, IR materials, etc.)
- Information literacy education for employees on social media
3. Stricter Source Code Control
- Never include credentials in the code
- Proper operation of '.gitignore'
- Limit the scope of GitHub
4. Implementing OSINT Monitoring Service
- Continuous monitoring with Threat Intelligence services
- Integrate with SIEM and SOAR to detect signs of leakage early
Conclusion
OSINT is a powerful weapon for both attackers and defenders.
It is essential to understand and manage the exposure of your company and your organization from the OSINT side with the perspective that "publicly available information can be a risk" in future cyber defense.
🔍 > **First, let's search by "company name". You may find some surprising information. **