The OSINT Tricks Hackers Use to See What Everyone Else Misses

Most people use the internet like they use a flashlight in a dark warehouse. They point it straight ahead and see what's directly in front of them.

Hackers use it like a thermal imaging drone. They see the heat signatures left behind, the footprints in the dust, the wiring behind the walls. They aren't seeing a different internet. They're seeing the same internet, but with layers everyone else filters out.

That skill has a name: OSINT. Open Source Intelligence. It's not hacking in the Hollywood sense. There's no brute forcing, no zero-days. It's the art of collecting, connecting, and weaponizing information that is already public. And it's the first step in 90% of real-world attacks.

I spent years thinking OSINT was just "Googling stuff." It's not. Here are the tricks actual operators use that separate them from the people who just type a name into Google and give up.

Google Dorking: They Don't Search, They Interrogate

Normal people search: Tesla employee list

Hackers search: site:tesla.com filetype:xlsx "employee" -jobs

This is Google Dorking, or Google Hacking. Google indexes far more than you think it should. Misconfigured servers, accidentally public directories, old backup files, internal spreadsheets left in public S3 buckets.

The syntax is a language:

• site: — Only search within that domain. site:linkedin.com/in "Works at Apple"

• filetype: — Hunt for specific documents. filetype:pdf confidential, filetype:env DB_PASSWORD — yes, people commit .env files to public GitHub and Google indexes them.

• inurl: — Find patterns in URLs. inurl:admin inurl:login

• intitle: — Find pages with specific titles. intitle:"index of" "parent directory"

• — - Exclude noise. -jobs -career removes all the HR fluff.

• " " — Exact match. "john.smith@company.com"

The Hacker Trick: They chain these. Want to find all PowerPoint decks a company left public?

site:company.com filetype:pptx

Want to find Zoom recordings they forgot to lock?

site:zoom.us "company.com" intitle:"Video Conferencing"

One dork I see used constantly: site:docs.google.com "company name". You'd be shocked how many internal Google Docs are set to "Anyone with the link can view" and then that link gets indexed.

2. They Never Look at a Photo, They Look Through It

You see a profile picture of a CEO on Instagram at a conference. Nice photo.

A hacker sees:

1. The background reflection in his glasses that shows his laptop screen.

2. The badge on his lanyard that has a QR code and a 6-digit employee ID.

3. The EXIF data.

EXIF data is metadata embedded in almost every photo. It can contain the exact GPS coordinates where the photo was taken, the device model, the date and time, even the serial number of the camera. Most social media strips EXIF on upload, but not all. Personal websites, forums, old blogs, press release images — they often don't.

Tools like ExifTool, Jeffrey's Exif Viewer, or just right-clicking properties on Windows can reveal it.

Beyond EXIF, there's Reverse Image Search on Steroids. Don't just use Google Images. Use:

• PimEyes / FaceCheck.ID: Facial recognition search engines. Upload a face and find where else that person appears online — even with different names.

• Yandex Images: Far better than Google at finding faces and similar locations.

• Google Lens + Maps: Take a photo from someone's LinkedIn — the office background. Crop to just the window view. Run it through Lens. It can often geolocate the exact building.

That "work from home" photo with a coffee mug? The mug has the company logo, the window shows a distinctive building across the street, and the street sign is blurred but readable if you enhance it. That's enough.

3. The Wayback Machine is a Time Machine for Secrets

Companies clean up their messes. They delete the page that listed all their internal Jira boards. They remove the staff directory.

The internet never forgets. web.archive.org

Hackers use the Wayback Machine not for nostalgia, but for reconnaissance.

Example workflow:

1. Go to web.archive.org and search for target.com/robots.txt — you can see what they used to hide.

2. Search for target.com and look at snapshots from 2018, 2019. Look at /team.html or /about. People who were deleted from the current site still exist in 2019.

3. Look for old API documentation. target.com/api/docs might be gone now, but it was archived in 2021 with all the endpoints still listed.

Pro Trick: Wayback + GitHub. Search Wayback for. github.com/targetorg. You can find repositories that are now private or deleted, but their file structure and commit messages were archived.

If Wayback fails, try archive.is and Google's cache: cache:target.com/page

4. Username Enumeration: One Username to Rule Them All

People are lazy. We reuse usernames. If my username is chaincoder_ on Instagram, it's probably chaincoder_ on GitHub, Reddit, Twitter, and a forgotten forum from 2014.

Hackers know this. They use tools that automate this:

• WhatsMyName, Sherlock, UserSearch: Feed in one username, it checks it against 300+ sites instantly and tells you where it exists.

Suddenly, from one Instagram handle, you have:

• Their Reddit account where they complained about their company's VPN.

• Their GitHub with public repos containing API keys.

• Their old Minecraft forum account that uses the same password they use now (which you can check against breach data).

The Trick Within The Trick: Don't just search the username. Search the variations. If the username is john.doe, also search johndoe, john_doe, jdoe. Tools like Namechk do this automatically.

And email? john.doe@gmail.com becomes johndoe, john.doe, j.doe. The pattern is predictable.

5. Breach Data is Not About Passwords. It's About Patterns.

When people hear "breach," they think "my password was leaked." Hackers think "my entire digital biography was leaked."

Sites like HaveIBeenPwned are the ethical front door. But in the OSINT world, people work with collections like DeHashed, Intelligence X, or even raw combolists.

What they are actually looking for:

• Password patterns: If your 2012 LinkedIn breach shows your password was Fluffy2012!, and your 2019 Dropbox breach shows Fluffy2019!, your 2025 password is probably Fluffy2025!.

• Security questions: Old breaches often included security questions and answers. Mother's maiden name, first pet.

• Internal emails: A breach of a company doesn't just leak customers. It leaks firstname.lastname@company.com — a complete employee list, with their roles.

• Location history: Many breaches include IP addresses, physical addresses, phone numbers.

You don't need to hack anyone if they already hacked themselves five years ago and never changed anything.

6. Metadata in Documents is a Goldmine

Download any PDF from a company's website — a whitepaper, an investor report, a job application form.

Now, don't read it. Inspect it.

In Adobe Acrobat: File > Properties. Or use exiftool document.pdf in your terminal.

You'll often find:

• Author: Created by: jsmith — That's a username. Likely jsmith@company.com.

• Software: Microsoft Word 2016 + Company-Name-PC — You now know their internal naming convention and OS.

• Creation path: C:\Users\ Sarah Connor\Desktop\Q3_Layoffs_Confidential.docx — Oops.

• Tracked changes: Many PDFs and DOCXs are just exported Word docs with tracked changes still inside. You can literally see who edited what, and the comments: "John, remove the part about the vulnerability."

Hackers automate this: FOCA is a classic tool that downloads all documents from a domain and extracts all metadata in bulk, building a user list, software map, and network map in minutes.

7. The Real Superpower: Connecting Disconnected Dots

Any single piece of OSINT is useless. The magic is in the link analysis.

This is what separates a beginner from an operator. They use mind-mapping tools like Maltego, SpiderFoot, or Obsidian to connect:

Instagram photo (geotagged at a coffee shop) -> Coffee shop WiFi login page shows ISP name -> Job listing from same company says they use that ISP for corporate VPN -> Employee's Reddit post: "Our VPN at [ISP] always drops" -> Shodan search for that ISP + company name reveals an exposed firewall login page.

No step was illegal. Every step was public.

Other underrated connectors:

• Shodan / Censys: Google for devices, not websites. Search org:"Target Company" port:22 and see all their internet-facing servers, webcams, and Jenkins instances that shouldn't be public.

• Certificate Transparency Logs (crt.sh): Every time a company creates an SSL certificate for dev.target.com, vpn.target.com, jira.target.com, it gets logged publicly. Search %.target.com on crt.sh and you get their entire secret subdomain list.

• LinkedIn + Email Permutator: Find the format. If you see John Smith and Jane Doe work at Company, and you find one email j.smith@company.com in a breach, you now have the format for every employee. Use hunter.io to verify j.doe@company.com.

Why This Matters Even If You're Not a Hacker

You don't need to be a criminal to be a target. This is exactly how:

• Recruiters vet you beyond your resume.

• Scammers craft spear-phishing emails that look like they came from your boss.

• Journalists find sources.

• Stalkers find victims.

OSINT is a mirror. It shows you what you look like to someone who is actually paying attention.

If you want to defend yourself, you have to think like an attacker for 10 minutes:

1. Google Dork yourself. site:github.com "your name" filetype:pdf "your name" "your email"

2. Check HaveIBeenPwned and delete old accounts you don't use.

3. Strip EXIF data before you upload photos (most phones have a setting).

4. Use a unique username for sensitive things. Don't reuse your gamer tag for your professional GitHub.

5. Audit your document metadata. In Word: File > Info > Check for Issues > Inspect Document.

Everyone leaves a digital exhaust trail. Most people never look back to see how thick it is.

Hackers do. And they follow it home.

THE NUMBPILLED SECURITY THEATER PACK - COUNTERS & CRCS DECODED [DEFENSIVE EDITION] THE NUMBPILLED SECURITY THEATER PACK - COUNTERS & CRCS DECODED [DEFENSIVE EDITION] Your car's "security" is a 4-bit…

PERSONAL ATTACK SURFACE: Map Everything Connected to Your Identity Treat personal privacy like security engineering. This isn't another "delete your cookies" checklist. It's a full OPSEC…

THE WATCHER'S WATCHER: Counter-OSINT How to Know You're Being Investigated THE WATCHER'S WATCHER: Counter-OSINT How to Know You're Being Investigated How to tell if someone is OSINT'ing you. Most…