## What is OSINT?

**Open Source Intelligence** is the art of finding information that is publicly available but hidden in plain sight.

### The Scope
*   **Public**: It must be accessible without hacking.
*   **Legal**: You are not breaking into servers. You are reading what they posted.

### Passive vs Active
*   **Passive Recon**: You never touch the target's servers.
    *   Looking at Archive.org, LinkedIn, Whois.
    *   *Risk*: Zero. The target doesn't know you exist.
*   **Active Recon**: You touch the target.
    *   Port Scanning (Nmap), Banner Grabbing.
    *   *Risk*: High. The firewall logs your IP.

### The "Grey Man" Concept
An OSINT analyst must be invisible.
*   Do not like posts on LinkedIn with your real account.
*   Do not visit the target website from your corporate VPN.
*   Use a "Sock Puppet" (Fake Persona).