## Open Source Intelligence (OSINT)

**OSINT** is data collected from publicly available sources to be used in an intelligence context. "Open Source" does not mean "Open Source Software" (like Linux). It means **Publicly Accessible Information (PAI)**.

If it is on the internet and you can access it without hacking a password, it is OSINT.

---

### The OSINT Landscape
OSINT is vast. It covers:
1.  **The Surface Web**: Google, News, Company Websites. (4% of web).
2.  **The Deep Web**: Content not indexed by Search Engines (Databases, Court Records, Wayback Machine).
3.  **The Dark Web**: Networks requiring specific software (Tor/I2P) to access. Marketplace for stolen data.
4.  **Social Media**: Twitter, LinkedIn, Instagram, Reddit.
5.  **Technical Data**: DNS records, WHOIS, SSL Certificates, IP Geolocation.

---

### Passive vs Active Reconnaissance
This distinction keeps you out of jail.

#### Passive Reconnaissance (Safe)
Gathering info **without** interacting directly with the target's systems.
*   **Method**: You query Google, Shodan, or Whois.
*   **Visibility**: The target sees traffic from Google/Shodan, not YOU.
*   **Risk**: Near Zero.
*   *Example*: Searching `site:target.com` on Google.

#### Active Reconnaissance (Risky)
Gathering info by **touching** the target.
*   **Method**: Port Scanning (Nmap), Vulnerability Scanning (Nessus), connecting to their web server.
*   **Visibility**: Your IP address appears in their Firewall/Web logs.
*   **Risk**: High. You can be blocked or flagged as an attacker.
*   *Example*: Running `nmap -sS -p- target.com`.

---

### OPSEC: Operations Security
"If you stare into the abyss, the abyss stares back."
When you research a Threat Actor or a malicious domain, you must assume they are watching their logs. If they see a request from "My-Corporate-Laptop", they know you are on to them.

#### The Golden Rules of Intelligence OPSEC
1.  **Never Use Your Real Identity**: Do not use your personal Gmail or corporate email to register for forums.
2.  **Use a Sock Puppet**: A fake online persona.
    *   *Name*: Generic but realistic.
    *   *Photo*: AI Generated (thispersondoesnotexist.com) - avoid reverse image search hits.
    *   *History*: An empty account looks suspicious. A good sock puppet has months of benign activity.
3.  **Manage Attribution**:
    *   **VPN**: Hides your IP.
    *   **Tor**: Anonymizes your traffic (but beware, Tor exit nodes are public).
    *   **Virtual Machines (VM)**: Always browse from a disposable VM (like Whonix or Kali). If you get infected, you just delete the VM.
    *   **User Agents**: Spoof your browser string to blend in.