The OSINT Hacker’s Cheat Sheet in 2025 | Cyber Codex

In a world drowning in public data, the real edge isn’t access — it’s knowing how to transform raw noise into intelligence that matters.

---

Overview

Open Source Intelligence (OSINT) is now a core discipline for cybersecurity, threat hunting, and investigative journalism.

Modern OSINT demands not only mastery of reconnaissance tools but also AI-driven analytics, automation dashboards, and strong operational security. This guide walks through the OSINT methodology, hands-on commands, AI integrations, and the powerful OSINTel-Dashboard v2.0.

The OSINT Intelligence Cycle

Effective OSINT follows a structured intelligence process:

1. Planning & Direction: Define intelligence objectives, legal/ethical boundaries, and operational security (OPSEC).

2. Collection: Systematic acquisition of public data (domains, APIs, social media, dark web).

3. Processing & Exploitation: Normalizing, enriching, and correlating raw data.

4. \Analysis & Production: Identifying patterns, relationships, and risk.

5. Dissemination: Delivering actionable intelligence in reports or dashboards.

Tool Arsenal and Commands with Descriptions

Tool Arsenal and Commands Reference

Web Enumeration & Infrastructure Discovery

• Gobuster: Fast directory, DNS, and virtual host brute-forcer to discover hidden web resources and subdomains.

gobuster dir -u https://target.com -w /path/wordlist.txt
gobuster vhost -u target.com -w vhosts.txt
gobuster dns -d target.com -w subdomains.txt

• Dirb: Simple web content scanner that brute-forces directories and files using pre-built wordlists.

dirb https://target.com /usr/share/dirb/wordlists/common.txt
dirb https://target.com -r
dirb https://target.com -X .php, .html

• Dirbuster (GUI): Java-based GUI for multi threaded directory and file brute-forcing against web servers.

• Nmap: Versatile network scanner for port discovery, service fingerprinting, and vulnerability detection.

nmap -sV target.com
nmap -A -p- target.com
nmap --script http-enum target.com

Domain Intelligence & Subdomain Enumeration

• theHarvester: Gathers emails, subdomains, hosts, and IPs from search engines, PGP key servers, and APIs.

theHarvester -d example.com -b all -l 500 -f results

• Sublis3r: Rapid subdomains enumerator leveraging multiple search engines for passive discovery.

sublist3r -d example.com -o subs.txt

• Amass: Powerful framework for passive/active asset discovery, mapping subdomains and infrastructure relationships.

amass enum -passive -d example.com

• Censys CLI: Searches Censys datasets for certificates, hosts, and services across the global internet.

censys search 'services.service_name:HTTP and ip:target_ip'

Network and Service Enumeration

• Shodan: Internet-wide search engine to find exposed devices, services, and vulnerabilities by keywords or CVE.

shodan search "apache country:US"

• Masscan: Ultra-fast port scanner capable of scanning the entire internet in minutes.

masscan 192.168.0.0/15 -p1-65535 --rate=10000

Social Media Intelligence (SOCMINT)

• Sherlock: Checks for the presence of a given usernmae across hundreds of social networks and platforms.

python3 sherlock username

• Maigret: Multi-platform profiler that searches thousands of websites for accounts linkedin to a username.

python3 migret username --html

• Osintgram: Instagram OSINT toolkit to gather followers, hashtags, media, and profile metadata.

python3 main.py -u target_username

• Twint: Twitter scraper that collects tweets, followers, and analytics withotu requiring API keys.

twint -u username

Automated Reconnaissance Frameworks

• Recon-ng: Modular reconnaissance environment with workspaces, marketplace modules, and built-in database.

recon-ng

• SpiderFoot: Automated footprinting tool with 200+ modules for domain, IP, and dark web intelligence.

spiderfoot -l 127.0.0.1:5001

• Maltego: Graph-based link analysis platform for visualizing relationships across domains, emails, and social networks.

Image, Video & Metadata Intelligence

• ExfiTool: Reads and writes image/video metadata such as GPS coordinates, camera details, and timestamps.

exfitool image.jpg

• Tesseract OCR: Optical Character Recognition engine to extract text from images and scanned documents.

tesseract image.png output.txt

• OpenCV Python (Face Recognition): Library to detect, locate, and compare face in images for identification or clustering.

Threat Intelligence & Dark Web

• H8mail: Finds email breaches and password leaks using multiple public and premium breach sources.

h8mail -t [e-mail]

• OnionSearch: Searches dark web .onion sites for keywords, leaks, or illicit content.

python3 onionsearch.py --query "target"

• TorBot: Crawler for Tor hidden services that indexes and searches onion content for intelligence.

python3 torbot.py -s "keyword"

Mobile Forensics

• Mobile Verification Toolkit (MVT): Detects spyware and analyzes iOS/ Android backups for compromise indicators.

mvt-ios check-backup --output results/ /path/to/backup

• Autopsy: Digital forensics platforms for timeline analysis, file recovery, and artifact extraction from disk images.

AI-Enhanced & Advanced Techniques

• spaCy: High-performance NLP library for entity extraction, text parsing, and linguistic analysis.

• scikit-learn: Machine learning toolkit for clustering, anomaly detection, and predictive modelling of OSINT data.

• TextBlob: Simplified Python library for sentiment analysis and language processing.

• Transformers (Hugging Face): Framework for running large language models for summarization, classification, or translation.

• NetworkX: Python library for building and analysing relationship graphs and network connections.

Automation with OSINTel-Dashboard

OSINTel-Dashboard v2.0 is a next-generation automation hub that brings all these tools together.

GitHub - aenoshrajora/OSINTel-Dashboard: A dynamic, Flask-based web application providing a centralized interface for executing various open-source intelligence (OSINT) and cybersecurity command-line tools.GitHub

Key Features:

• Preconfigured 43 Tools spanning reconnaissance, enumeration, social media, metadata, and dark web.

• Dynamic Gradient UI with two themes (black and white), each featuring multiple color gradients for a sleek experience.

• Multiple Tools per Process: e.g. several subdomains finders, metadata extractors, and reconnaissancec modules.

• History Tracking with Git-like Recall: revisit any pass command by clicking it in the history list to instanly rerun or modify.

• Full Customization: add, edit, or delete tools; create custom commands tailored dto unique investigations.

• Two-Theme Switching: switch between black or white gradient themes instantly.

Setup

git clone https://github.com/aenoshrajora/OSINTel-Dashboard.git
cd OSINTel-Dashboard
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Configure API keys in .env, then run:

python app.py

Access the dashboard at http://127.0.0.1:5001.

Workflow

1. Choose a theme and gradient.

2. Select one of the 43 built-in tools or a custom module.

3. Input target parameters (domain, IP, username, etc.).

4. View results instantly with rich formatting.

5. Return to any previous command from the history list to repeat or modify.

6. Add your own tools or delete default ones for a fully personalized setup.

Secure Investigation Environments

OSINT investigations must protect both the analyst and collected evidence.

Environment Isolation

• Virtual Machines — run investigations inside isolated Kali/Ubuntu VMs with snapshots for easy rollback.

• Docker Containers — package and run tools individually for process-level isolation.

Network Anonymization

• VPNs & Tor — mask your IP and provide multi-hop anonymity.

• ProxyChains — route traffic through chained proxies for additional obfuscation.

System Hardening

• Apply UFW or iptables firewalls to control traffic.

• Use AppArmor or SELinux to sandbox applications.

• Operate as a non-root user to limit privileges.

Data Security

• Encrypt evidence at rest (LUKS, VeraCrypt).

• Maintain cryptographic hashes (SHA256) for collected files.

• Store logs and outputs in access-controlled directories.

OPSEC

• Use disposable identities and browser profiles for each engagement.

• Never mix personal accounts with investigative activities.

• Keep detailed, timestamped notes of all findings.

Final Thought:

By mastering these tools, commands, and secure practices — and by leveraging automation through OSINTel-Dashboard v2.0 — analysts can convert the flood of public data into actionable intelligence with speed, accuracy, and safety.

“Master the cycle, wield the tools, and automate the grind — because in OSINT, speed and precision aren’t just advantages, they’re survival.”