OSINT Glossary
169 terms used in open source intelligence, defined in plain English and grouped by field. Free, no account, no tracking.
Cybersécurité
- Attack Surface
- Set of potential entry points an attacker can exploit on a system or organization: domains, APIs, employees, cloud services, mobile applications.See also Recon, Footprinting, Subdomain Enumeration
- Beacon
- Periodic signal sent by malware to its C2 server to maintain communication. Beacon detection is a key threat hunting technique.See also C2 (Command & Control), IOC, Threat Intelligence
- Botnet
- Network of compromised machines remotely controlled via a C2 server. Used for DDoS attacks, spam, cryptomining, or as infrastructure for influence operations.See also C2 (Command & Control), IOC, Astroturfing
- C2 (Command & Control)
- Infrastructure used by an attacker to communicate with compromised systems (botnets, RAT). Identifying C2 servers is a key step in threat intelligence.See also IOC, Threat Intelligence, Lateral Movement
- Canary Token
- Technical variant of honeytokens: URL, document, or credential that sends an alert to its creator when accessed. Used to detect infiltrations or leaks.See also Honeytokens, IOC, Data Breach
- Credential Stuffing
- Automated attack testing lists of credentials from data breaches on many services. Exploits password reuse.See also Data Breach, HaveIBeenPwned, Botnet
- CTEM
- Continuous Threat Exposure Management — continuous program for assessing an organization's exposed attack surface. Integrates offensive OSINT to prioritize remediations.See also Attack Surface, Threat Intelligence, Red Team OSINT
- CVE
- Common Vulnerabilities and Exposures — public database of known vulnerabilities. Each CVE has a unique identifier and standardized description.See also Zero-Day, Threat Intelligence, IOC
- Data Breach
- Security incident where confidential data is exposed without authorization. Breach databases are major OSINT sources for identifying compromised accounts.See also HaveIBeenPwned, Dark Web, IOC
- Email Spoofing
- Technique forging the 'From' field of an email to impersonate a legitimate sender. Detectable via header analysis and SPF/DKIM/DMARC records.See also Phishing, Email Header, DNS
- Exfiltration
- Unauthorized transfer of data out of a compromised system. Exfiltration techniques include DNS tunneling, HTTP covert channels, GRE tunnels, and sending via legitimate cloud services.See also C2 (Command & Control), GRE tunnel, IOC
- Honeypot
- System or resource deliberately exposed to attract and observe attackers. OSINT honeypots collect TTPs and IOCs on adversarial techniques.See also TTP, IOC, C2 (Command & Control)
- Honeytokens
- Fake data (credentials, documents, URLs) scattered to detect unauthorized access. When the token is activated, it signals a compromise or information leak.See also Honeypot, IOC, Data Breach
- Indicator of Attack
- IOA — behavioral sign of an ongoing attack before an IOC is generated. Enables earlier detection based on intent rather than artifacts.See also IOC, TTP, Threat Hunting
- IOC (Indicator of Compromise)
- Artifact observed on a network or system indicating a potential compromise: file hashes, malicious IPs, suspicious domains, modified registry keys.See also C2 (Command & Control), Threat Intelligence, CVE
- Kill Chain
- Lockheed Martin model describing the 7 phases of a cyberattack: reconnaissance, weaponization, delivery, exploitation, installation, C2, actions. Basis of defensive threat hunting.See also TTP, C2 (Command & Control), IOC
- Lateral Movement
- Technique allowing an attacker to progress within a compromised network after an initial entry point. Includes pass-the-hash, pivoting, trust exploitation.See also C2 (Command & Control), Pivot, IOC
- MITM
- Man-in-the-Middle — attack intercepting communications between two parties. Allows listening, modifying or injecting network traffic by positioning between victim and destination.See also GRE tunnel, TOR, OPSEC
- MITRE ATT&CK
- Public framework by MITRE Corporation cataloging tactics, techniques, and procedures (TTPs) of malicious actors. International reference for threat intelligence.See also TTP, Kill Chain, Threat Intelligence
- OWASP
- Open Web Application Security Project — foundation producing free resources on web application security. The OWASP Top 10 lists the most critical web vulnerabilities.See also CVE, Zero-Day, Recon
- Phishing
- Social engineering technique to trick a victim into providing credentials or installing malware, via fraudulent emails or websites.See also Spear Phishing, Sock Puppet, OPSEC
- Ransomware
- Malware encrypting victim data and demanding a ransom to decrypt it. Ransomware group leak sites are OSINT sources for identifying victims.See also Dark Web, IOC, C2 (Command & Control)
- Spear Phishing
- Targeted variant of phishing using personal information gathered via OSINT to personalize the attack and increase success rate.See also Phishing, SOCMINT, OPSEC
- STIX/TAXII
- Structured Threat Information eXpression / Trusted Automated eXchange — standards for exchanging threat intelligence data between organizations. Foundation of CTI sharing.See also Threat Intelligence, IOC, TTP
- Threat Actor
- Entity (state, criminal group, hacktivist, insider) conducting malicious operations. Threat actors are categorized by TTPs, motivations, and geopolitical attributions.See also TTP, Attribution, Threat Intelligence
- Threat Feed
- Real-time data feed listing active IOCs: malicious IPs, domains, malware hashes. Integrated into SIEMs and firewalls to automatically block known threats.See also IOC, Threat Intelligence, STIX/TAXII
- Threat Hunting
- Proactive search for undetected threats in a computing environment. Combines behavioral analysis, IOCs, and TTPs to discover silent compromises.See also IOC, TTP, Beacon
- Threat Intelligence
- Collection, analysis, and sharing of information about current and emerging cyber threats. Includes threat actor TTPs, IOCs, and exploited vulnerabilities.See also IOC, CVE, Dark Web
- Threat Landscape
- Global view of all active threats in a given context: actors, TTPs, attack vectors, and targeted sectors. Central analytical product of threat intelligence reports.See also Threat Intelligence, Threat Actor, TTP
- TTP
- Tactics, Techniques and Procedures — standardized description of methods used by malicious actors. Formalized in the MITRE ATT&CK framework.See also Threat Intelligence, IOC, C2 (Command & Control)
- Whitelisting
- List of entities (IPs, domains, applications) explicitly allowed to access a system. In defensive OSINT, whitelisting identifies legitimate vs suspicious sources.See also DNSBL, IOC, Threat Intelligence
- Zero Trust
- Security architecture eliminating implicit trust: every access must be verified, every user authenticated, even inside the network. Principle: 'never trust, always verify'.See also Lateral Movement, IOC, OPSEC
- Zero-Day
- Vulnerability unknown to the manufacturer with no patch available. Zero-days are prime targets for state actors and cybercriminals.See also CVE, IOC, Threat Intelligence
Discipline OSINT
- ADINT
- Advertising Intelligence — exploitation of digital advertising data (tracking pixels, mobile advertising IDs) to geolocate or profile an individual without their consent.See also GEOINT, PII, OPSEC
- Blockchain OSINT
- Investigation on public blockchains (Bitcoin, Ethereum) to trace fund flows, identify linked wallets, or de-anonymize transactions.See also FININT, Pivot, Attribution
- FININT
- Financial Intelligence — intelligence from analyzing financial flows, transactions, corporate structures, and ownership records to detect fraud, corruption, or money laundering.See also Blockchain OSINT, Due Diligence, Corporate Intelligence
- GEOINT
- Geospatial Intelligence — intelligence based on the analysis of satellite imagery, mapping, and geospatial data to identify locations and activities.See also EXIF, SIGINT, HUMINT
- HUMINT
- Human Intelligence — intelligence gathered through direct human interactions: interviews, source recruitment, infiltration. Complementary to digital sources.See also GEOINT, SIGINT, SOCMINT
- IMINT
- Imagery Intelligence — intelligence from image analysis (satellite, aerial, ground photos). Sub-discipline of GEOINT, central in conflict investigation.See also GEOINT, Reverse Image Search, EXIF
- MASINT
- Measurement and Signature Intelligence — intelligence based on detecting physical and technical characteristics of equipment: radar emissions, chemical signatures, acoustics.See also SIGINT, TECHINT, GEOINT
- OSINT
- Open Source Intelligence — collection and analysis of intelligence from publicly accessible sources: web, social media, public records, media, etc.See also HUMINT, GEOINT, SIGINT, SOCMINT
- RFINT
- Radio Frequency Intelligence — intelligence collected through radio frequency spectrum analysis. In civilian OSINT: SDR networks to listen to ADS-B, AIS, PMR, satellite weather communications.See also SIGINT, AIS, IMINT
- SIGINT
- Signals Intelligence — intelligence collected through electromagnetic signal interception: radio, telephone, digital communications. Traditionally a government domain.See also HUMINT, GEOINT, OPSEC
- SOCMINT
- Social Media Intelligence — intelligence derived from public social media analysis. Includes behavioral analysis, network mapping, and trend monitoring.See also OSINT, HUMINT, Sock Puppet
Désinformation
- Deepfake
- Synthetic media (image, audio, video) generated by AI to make a person appear to say or do something false. Major tool in disinformation operations.See also Reverse Image Search, Désinformation, SOCMINT
Forensique
- Digital Forensics
- Science of collecting, preserving, and analyzing digital evidence. Includes disk, memory, network, and log analysis to reconstruct events.See also Metadata, EXIF, IOC
- Email Header
- Email metadata containing the routing path (SMTP servers), sending IP, timestamp, and DKIM/SPF signatures. Key tool for detecting phishing.See also Phishing, Spear Phishing, Footprinting
- EXIF
- Exchangeable Image File Format — metadata embedded in digital images. Can contain GPS coordinates, camera model, exact date and time.See also GEOINT, Reverse Image Search, Footprinting
- Hash
- Unique digital fingerprint of a file (MD5, SHA-1, SHA-256). Used to verify file integrity, identify known malware, or compare artifacts.See also IOC, Digital Forensics, Threat Intelligence
- IOCA
- IOC Analyzer — methodology for systematic analysis of compromise indicators to correlate incidents, identify campaigns, and map a malicious actor's infrastructure.See also IOC, TTP, MITRE ATT&CK
- Metadata
- Data describing other data. In OSINT forensics, file metadata (images, documents, videos) reveals author, date, software used, GPS coordinates.See also EXIF, FOCA, Footprinting
- Sandbox
- Isolated environment for executing and analyzing suspicious files without risking production infrastructure. Tools: ANY.RUN, Cuckoo, Hybrid Analysis.See also IOC, Threat Intelligence, Digital Forensics
- SMTP Header
- Email message metadata revealing the complete routing path, relay server IPs, and timestamps. Essential for tracing the origin of a suspicious email.See also Email Header, Phishing, Footprinting
- STEGO
- Forensic analysis of steganography — detection and extraction of hidden data in media files. Tools: StegExpose, zsteg, steghide.See also Steganographie, Digital Forensics, EXIF
- Timeline Analysis
- Chronological reconstruction of investigation events: file timestamps, network logs, social media activity. Fundamental technique in digital forensics.See also Digital Forensics, Metadata, EXIF
Formation
- CTF (Capture The Flag)
- Cybersecurity competition where participants solve technical challenges to find 'flags'. Excellent method for learning OSINT and forensic techniques.See also Recon, OSINT, CVE
- Geoint Challenge
- Geographic identification exercise from an image without indications (GeoGuessr, Bellingcat challenges). Popular training method for developing GEOINT skills.See also GEOINT, CTF, Reverse Image Search
GEOINT
- Geospatial Analysis
- Analysis and interpretation of data with a geographic component: satellite imagery, GIS, movement mapping. Central discipline of GEOINT and conflict investigation.See also GEOINT, IMINT, Pattern of Life
- Waypoint
- Precise geographic reference point used to document and corroborate a geolocation. In conflict investigation, waypoints allow retracing routes.See also GEOINT, Geospatial Analysis, Pattern of Life
Influence
- Astroturfing
- Artificial creation of the impression of a spontaneous popular movement via coordinated accounts or bots. Key technique in influence operations and disinformation.See also CIB, Sock Puppet, SOCMINT
- CIB
- Coordinated Inauthentic Behavior — coordinated behavior by accounts that conceal their artificial nature to manipulate public debate. Term defined by Meta/Facebook.See also Astroturfing, Sock Puppet, SOCMINT
- Désinformation
- Deliberate spread of false or misleading information to manipulate public opinion. Distinct from misinformation (unintentional spread of errors).See also Astroturfing, CIB, False Flag, Deepfake
Légal
- Aggregation Problem
- Ethical/legal problem where combining individually innocuous public data creates an intrusive private view of a person. Central privacy issue in OSINT.See also PII, Doxing, OPSEC
- ITAR
- International Traffic in Arms Regulations — US regulation controlling the export of defense materials and services. Affects some dual-use OSINT tools.See also OPSEC, Threat Intelligence
- PII
- Personally Identifiable Information — any information that can directly or indirectly identify a natural person. Protected by GDPR in Europe.See also Doxing, Data Breach, OPSEC
OPSEC
- Burner Account
- Temporary and untraceable online account created for a specific investigation. Must be isolated from any real identity: dedicated email, VPN/TOR, separate device.See also Sock Puppet, OPSEC, TOR
- EXIF Stripper
- Tool removing EXIF metadata from an image before publication to avoid inadvertent disclosure of GPS data, device model, or author identity.See also EXIF, OPSEC, Metadata
- OPSEC Failure
- Operational security error revealing the identity or methods of an investigator or malicious actor. Famous example: Silk Road — Ross Ulbricht identified via a StackOverflow post.See also OPSEC, Doxing, Attribution
- Persona
- Complete fictional digital identity built for undercover investigation. Includes account history, photo, biography, consistent activity, and total separation from real identity.See also Sock Puppet, OPSEC, Burner Account
- Virtual Machine
- Isolated computing environment running inside a physical host. Essential in OSINT for isolating investigations, analyzing malware, and separating digital identities.See also OPSEC, Sandbox, Burner Account
Outil
- Archive.today
- Independent web archiving service creating permanent snapshots of web pages. Alternative to Wayback Machine, often used to archive evidence before deletion.See also Wayback Machine, Passive Reconnaissance, SOCMINT
- FOCA
- Fingerprinting Organizations with Collected Archives — tool for extracting metadata from Office, PDF documents, etc. Reveals usernames, software, and internal network paths.See also EXIF, Footprinting, Recon
- HaveIBeenPwned
- Online service to check if an email address or phone number appears in known breach databases. Maintained by Troy Hunt.See also Data Breach, Dark Web, Username Enumeration
- Maltego
- Link visualization and OSINT investigation platform for mapping relationships between entities (people, domains, IPs, organizations) via 'transforms'.See also Recon, Footprinting, SOCMINT
- Maltego Transform
- Maltego plugin querying an external data source and returning linked entities. Transforms are the engine of automated relationship mapping in Maltego.See also Maltego, Graph Analysis, Pivot
- Shodan
- Search engine for internet-connected devices indexing IPs, ports, service banners. Allows discovering webcams, routers, industrial servers, and other exposed equipment.See also Censys, FOFA, IP Geolocation
- Tor Browser
- Firefox-based browser configured to automatically route traffic via the TOR network. Basic tool for anonymous Dark Web access and investigator identity protection.See also TOR, OPSEC, Dark Web
- Wayback Machine
- Web archiving service by Internet Archive allowing consultation of historical versions of websites. Essential for recovering deleted content.See also Passive Reconnaissance, OSINT, Footprinting
- Wireshark
- Open-source network protocol analyzer capturing and dissecting network traffic in real-time. Essential tool for network forensic analysis and IOC detection.See also Traffic Analysis, IOC, Digital Forensics
Renseignement
- Attribution
- Process of identifying the actor responsible for a cyberattack or influence operation. Based on TTP analysis, IOCs, infrastructure, and metadata.See also TTP, IOC, False Flag, Threat Intelligence
- Corporate Intelligence
- Collection and analysis of information about companies: shareholders, executives, subsidiaries, contracts, litigation, patents. Sources: business registries, EDGAR, OpenCorporates.See also FININT, Due Diligence, OSINT
- Correlation
- Linking information from multiple sources to confirm a hypothesis or detect a connection between entities. Central process of intelligence analysis.See also Link Analysis, Graph Analysis, Intelligence Cycle
- Dark Web
- Part of the Internet accessible only through encrypted overlay networks like TOR. Hosts illegal marketplaces, criminal forums, and sensitive data leaks.See also TOR, Data Breach, OPSEC
- Darknet
- Overlay network requiring specific software to access (TOR, I2P, Freenet). Distinct from the 'Dark Web', darknet refers to the underlying technical infrastructure.See also TOR, Dark Web, OPSEC
- Digital Exhaust
- Digital data involuntarily generated by an individual's online activities: metadata, cookies, connection logs, GPS traces. Unintentional but exploitable OSINT source.See also PII, Metadata, Pattern of Life
- Due Diligence
- Thorough verification process of an entity (company, person, investment) before a decision. OSINT is central to commercial and legal due diligence.See also FININT, Corporate Intelligence, HUMINT
- False Flag
- Operation designed to attribute an action to a third party. In cybersecurity, some state actors plant artifacts to mislead investigators.See also Threat Intelligence, HUMINT, OPSEC
- Intelligence Cycle
- Iterative 5-phase process: direction, collection, processing, analysis, dissemination. Universal methodological framework applied to both state intelligence and civilian OSINT.See also OSINT, HUMINT, Threat Intelligence
- Modus Operandi
- Characteristic working method of a malicious actor or criminal. MO analysis allows attributing actions to a known actor and anticipating their next targets.See also TTP, Attribution, Kill Chain
- OSIF
- Open Source Information — term for raw collected information before analysis, as opposed to OSINT which refers to intelligence produced after analytical processing.See also OSINT, Intelligence Cycle, Recon
- Pattern of Life
- Analysis of behavioral patterns of an individual or group over time: schedules, frequented locations, regular contacts. Central technique in military and civil intelligence.See also GEOINT, SOCMINT, Surveillance
- Signal-to-Noise Ratio
- Ratio between relevant information (signal) and irrelevant information (noise) in an OSINT corpus. Investigation quality depends on the ability to maximize this ratio.See also Intelligence Cycle, OSINT, Threat Intelligence
- Source Reliability
- Evaluation of information source reliability according to standardized grids (NATO STANAG 2511: A-F for source, 1-6 for information). Fundamental in intelligence analysis.See also Intelligence Cycle, Correlation, OSINT
- Surveillance
- Systematic observation of individuals, groups, or organizations. Digital OSINT surveillance uses public traces left on the Internet, social media, and open databases.See also Pattern of Life, GEOINT, SOCMINT
- Veille Stratégique
- Continuous process of monitoring an organization's environment to detect threats and opportunities. Includes competitive, technological, geopolitical, and reputational monitoring.See also Intelligence Cycle, Threat Intelligence, OSINT
Réseau
- ASN
- Autonomous System Number — unique identifier assigned to a network managed by a single entity on the Internet. Used to route IP packets and identify the operator of an IP range.See also CIDR, IP Geolocation, WHOIS
- BGP
- Border Gateway Protocol — inter-domain routing protocol for the Internet. BGP hijacking allows redirecting an entire ASN's traffic. Investigation tool: BGPView.See also ASN, CIDR, IP Geolocation
- BSSID
- Basic Service Set Identifier — unique MAC address of a Wi-Fi access point. Used in OSINT to geolocate a wireless network via databases like WiGLE.See also IP Geolocation, OPSEC
- CDN
- Content Delivery Network — network of servers distributing web content from nodes close to the user. Can hide a server's origin IP (Cloudflare, Fastly).See also IP Geolocation, WHOIS, Recon
- Certificate Transparency
- Public log of all TLS/SSL certificates issued by certificate authorities. Allows subdomain enumeration and detection of fraudulent certificates via tools like crt.sh.See also Subdomain Enumeration, CIDR, DNS
- CIDR
- Classless Inter-Domain Routing — notation to define IP address ranges (e.g. 192.168.1.0/24). Used to target entire network blocks during scans.See also ASN, IP Geolocation, WHOIS
- Clearnet
- Accessible and indexed part of the standard Internet, as opposed to the Dark Web or overlay networks. Represents the majority of daily web traffic.See also Dark Web, Darknet, TOR
- CNAME
- Canonical Name — DNS record pointing a subdomain to another domain name. Abandoned CNAMEs are a common target for subdomain takeover.See also DNS, Subdomain Enumeration, Subdomain Takeover
- DNS
- Domain Name System — protocol translating domain names into IP addresses. DNS analysis reveals a target's infrastructure: A, MX, TXT, NS records, etc.See also WHOIS, Subdomain Enumeration, DNSBL
- DNS Zone Transfer
- DNS replication mechanism allowing transfer of all records in a zone. Misconfigured, it exposes all subdomains of a domain.See also DNS, Subdomain Enumeration, Recon
- DNSBL
- DNS Blacklist — list of servers considered spam sources or malicious, consultable via DNS queries. Used to check the reputation of an IP or domain.See also DNS, IP Geolocation, Threat Intelligence
- GRE tunnel
- Generic Routing Encapsulation — encapsulation protocol creating a point-to-point link between two networks. Used to hide C2 infrastructure or exfiltrate data.See also C2 (Command & Control), TOR, OPSEC
- I2P
- Invisible Internet Project — anonymous peer-to-peer network alternative to TOR. Optimized for internal hidden services (eepsites). Less known but used on some criminal markets.See also TOR, Darknet, Dark Web
- IP Geolocation
- Technique for associating an IP address with an approximate geographic location (country, city, ISP). Precision varies depending on the databases used.See also ASN, CIDR, WHOIS
- Open Port
- Network port accepting incoming connections on a system. Identifying open ports via Shodan, Nmap, or Censys reveals exposed services and potential attack vectors.See also Recon, Footprinting, Subdomain Enumeration
- Passive DNS
- History of DNS resolutions observed over time for a domain or IP. Allows finding old hosts, shared domains, and infrastructure pivots.See also DNS, WHOIS, Pivot
- Port Scanning
- Technique for enumerating open ports on a target host to identify exposed services. In passive mode via Shodan/Censys without directly contacting the target.See also Open Port, Shodan, Recon
- RDAP
- Registration Data Access Protocol — modernized successor to WHOIS, providing structured JSON responses for domain and IP registration information.See also WHOIS, DNS, IP Geolocation
- Reverse DNS
- Reverse resolution of an IP address to a domain name (PTR record). Allows identifying the service hosted on an IP and discovering associated domains.See also DNS, IP Geolocation, Passive DNS
- SSL Certificate
- Digital certificate authenticating a web server's identity and encrypting communications (HTTPS). Certificate analysis reveals domains, organization, and history.See also Certificate Transparency, Subdomain Enumeration, DNS
- TOR
- The Onion Router — anonymizing network routing traffic through multiple encrypted nodes. Used for Dark Web access and to protect identity during sensitive investigations.See also Dark Web, VPN, OPSEC
- Traffic Analysis
- Analysis of network traffic metadata (volumes, timing, endpoints) without decrypting content. Allows identifying communication patterns even when encrypted.See also SIGINT, Beacon, OPSEC
- VPN
- Virtual Private Network — encrypted tunnel masking the real IP address during OSINT investigations. Essential for basic OPSEC, but not sufficient alone for complete anonymity.See also TOR, OPSEC, IP Geolocation
- WHOIS
- Protocol for querying domain name and IP address registration databases. Provides owner, registration dates, DNS servers, and contact information.See also RDAP, DNS, IP Geolocation
- WHOIS Privacy
- Service masking a domain owner's real information in WHOIS records. Bypassable via WHOIS history, Certificate Transparency, and passive DNS.See also WHOIS, RDAP, Passive DNS
- Zone File
- Text file containing all DNS records of a domain. TLD zone files (like .com) are partially accessible and constitute a massive enumeration source.See also DNS, Subdomain Enumeration, DNS Zone Transfer
SOCMINT
- Shadowban
- Discreet restriction applied by a platform reducing account visibility without informing the user. Moderation technique avoiding disputes.See also SOCMINT, Sock Puppet, CIB
- Telegram OSINT
- Exploitation of Telegram channels, groups, and profiles for investigation: public messages, propaganda channels, criminal markets, extremist group coordination.See also SOCMINT, Dark Web, Pastebin OSINT
Source OSINT
- Public Records
- Publicly accessible government records: business registries, land registry, civil registry, court judgments, public contracts. Fundamental legal OSINT source for investigation.See also Corporate Intelligence, FININT, Due Diligence
- RSS Feed
- Syndication format allowing subscription to site updates without visiting. OSINT monitoring tool allowing automatic tracking of multiple sources (media, blogs, forums).See also Passive Reconnaissance, SOCMINT, Footprinting
- Web Cache
- Temporary copy of a web page stored by search engines or proxies. Allows access to recently deleted or modified content via Google Cache or Bing.See also Wayback Machine, Archive.today, Passive Reconnaissance
Surveillance
- IMSI Catcher
- Device simulating a cell tower to intercept mobile communications and identify IMSI (SIM identifiers) of nearby devices. Used by law enforcement.See also SIGINT, Surveillance, OPSEC
Sécurité
- OPSEC
- Operational Security — set of practices to protect sensitive investigation information: VPN, dedicated accounts, device isolation, digital trace management.See also VPN, TOR, Sock Puppet
Technique
- Browser Fingerprinting
- Collection of browser technical attributes (resolution, plugins, fonts, timezone) to identify a user without cookies. Major OPSEC risk during investigations.See also OPSEC, User-Agent, PII
- CAPTCHA bypass
- Set of methods to bypass CAPTCHA systems during scraping or OSINT automation. Includes using third-party services or AI models.See also Footprinting, Passive Reconnaissance
- Dark Pattern
- Deceptive interface technique designed to manipulate users: pre-checked boxes, hidden subscriptions, difficult opt-out. Relevant in OSINT for analyzing data collection practices.See also PII, OPSEC, Social Engineering
- Domain Fronting
- Technique masking the real destination of network traffic by routing through a trusted CDN. Used to bypass censorship or hide a C2 infrastructure.See also C2 (Command & Control), CDN, TOR
- Doxing
- Collection and publication of personally identifiable information (PII) about a person without their consent. Illegal practice in many countries.See also OSINT, SOCMINT, OPSEC
- Favicon Hash
- Unique hash of a website's favicon.ico file. Used with Shodan (query: http.favicon.hash) to identify all instances of a service or framework.See also Shodan, Footprinting, Recon
- Footprinting
- Initial reconnaissance phase aimed at collecting maximum information about a target (domains, IPs, employees, technologies). Can be active or passive.See also Passive Reconnaissance, Recon, OSINT
- Geofencing
- Virtual delimitation of a geographic area for filtering or triggering location-based actions. Used in GEOINT to analyze population movements.See also GEOINT, IP Geolocation, BSSID
- Google Dorks
- Advanced Google queries using special operators (site:, filetype:, inurl:, intitle:) to find sensitive information inadvertently indexed.See also Footprinting, Passive Reconnaissance, Recon
- Graph Analysis
- Analysis of relationships and connections between entities via directed graphs. Used to map criminal, influence, or infrastructure networks. Tools: Gephi, Maltego.See also Maltego, SOCMINT, Pivot
- Link Analysis
- Method of analyzing relationships between entities (people, organizations, events) to identify hidden connections and network structures. Foundation of complex OSINT investigation.See also Graph Analysis, Maltego, Pivot
- MIME type
- Multipurpose Internet Mail Extensions — standard identifying the type of content in a file. Used to detect disguised malicious files or analyze suspicious uploads.See also EXIF, IOC, Footprinting
- Natural Language Processing
- Automated processing of natural language by AI models. Used in OSINT to analyze massive volumes of text, detect sentiment, identify authors or bots.See also Désinformation, SOCMINT, CIB
- Network Graph
- Visual representation of connections between nodes (people, domains, IPs) in a network. Reveals hubs, clusters, and central actors invisible in tabular lists.See also Graph Analysis, Maltego, Link Analysis
- Passive Reconnaissance
- Information gathering without direct interaction with the target. Uses public sources, DNS archives, search engines, and third-party databases.See also Footprinting, Google Dorks, WHOIS
- Pastebin OSINT
- Monitoring paste sites (Pastebin, paste.ee, ghostbin) to detect data leaks, credentials, sensitive configs, or messages from criminal groups.See also Data Breach, Dark Web, IOC
- Pentest Passif
- Penetration test using exclusively passive sources to assess a target's attack surface without directly contacting it. Legally less risky than active pentesting.See also Passive Reconnaissance, Footprinting, Attack Surface
- Phone Number OSINT
- OSINT investigation starting from a phone number: carrier, country, owner, associated accounts (WhatsApp, Telegram, Signal), data leaks.See also PII, SOCMINT, Pivot
- Pivot
- OSINT/offensive technique starting from a discovered element (email, IP, username) to find related information and broaden the investigation scope.See also Lateral Movement, Recon, SOCMINT
- Pivot Point
- Key element in an investigation allowing transition from one entity to another: a shared IP between two domains, an email in multiple leaks, a recurring username across platforms.See also Pivot, Link Analysis, Correlation
- Recon
- Reconnaissance — preliminary phase of an investigation or attack aimed at mapping the attack surface or a target's profile. Includes active and passive reconnaissance.See also Footprinting, Passive Reconnaissance, OSINT
- Red Team OSINT
- Use of OSINT techniques in an offensive red team context to map an organization's attack surface: employees, emails, technologies, physical access points.See also Attack Surface, Footprinting, Social Engineering
- Reverse Image Search
- Image search by visual similarity rather than keywords. Used to identify a photo's origin, find other online occurrences, or detect deepfakes.See also EXIF, GEOINT, SOCMINT
- robots.txt
- File at a site's root telling indexing robots which sections not to crawl. Can reveal sensitive directories not publicly linked.See also Footprinting, Google Dorks, Recon
- Shodan Dork
- Advanced Shodan query using specific filters (product:, port:, org:, favicon.hash:) to identify vulnerable equipment, infrastructure, or specific technologies.See also Shodan, Google Dorks, Recon
- Sock Puppet
- Fake online identity created to infiltrate communities, monitor a target, or conduct influence operations. Requires rigorous OPSEC management.See also OPSEC, SOCMINT, Doxing
- Steganographie
- Technique of hiding data within an innocuous file (image, audio, video) without apparent modification. Used for covert communications or evidence concealment.See also OPSEC, Digital Forensics, EXIF
- Subdomain Enumeration
- Systematic discovery of a target domain's subdomains via brute-force, Certificate Transparency logs, DNS zone transfers, or specialized engines.See also DNS, Certificate Transparency, Recon
- Subdomain Takeover
- Vulnerability where a subdomain points to a deactivated third-party service (dangling CNAME), allowing an attacker to claim it and host malicious content.See also CNAME, Subdomain Enumeration, DNS
- Typosquatting
- Registration of domain names similar to legitimate sites (typos, homoglyphs) to intercept traffic, for phishing, or monitoring communications.See also Phishing, DNS, Footprinting
- URL Shortener
- Service shortening URLs (bit.ly, t.co). In OSINT, expanding short URLs reveals the real destination and may contain identifying tracking parameters.See also OPSEC, Phishing, Footprinting
- User-Agent
- HTTP header identifying the browser or client during a web request. Modifying the User-Agent is a basic OPSEC technique to hide scraping tools.See also OPSEC, Footprinting, Passive Reconnaissance
- Username Enumeration
- Searching for the presence of a username on as many online platforms as possible to establish a digital footprint and link accounts together.See also OSINT, SOCMINT, Pivot
- Web Scraping
- Automated extraction of data from web pages via scripts or dedicated tools. Technical foundation of many OSINT investigations. Legal framework varies by jurisdiction.See also Footprinting, Google Dorks, Passive Reconnaissance
- Wi-Fi OSINT
- Investigation based on Wi-Fi networks: geolocation via BSSID on WiGLE, infrastructure identification, SSID analysis to profile an organization or individual.See also BSSID, GEOINT, Footprinting
Transport
- ADS-B
- Automatic Dependent Surveillance-Broadcast — air surveillance protocol broadcasting aircraft position, altitude, and identifier in clear. Basis of flight tracking tools like Flightradar24.See also AIS, GEOINT, RFINT
- AIS
- Automatic Identification System — maritime tracking system broadcasting real-time position, speed, and identity of vessels. Exploitable via MarineTraffic or VesselFinder.See also GEOINT, SIGINT, Passive Reconnaissance