OSINT 101 — Hacking With Nothing but Public Info

OSINT sounds like spy stuff, but it's just this: finding useful information that's ALREADY public. No hacking required. And for a bug hunter, OSINT is how you map a target before you ever send a single "attack" request. Let me open this world up for you.

What OSINT Actually Is

OSINT = Open Source Intelligence. It means gathering info from publicly available sources: search engines, code repos, DNS records, certificate logs, social media, job postings, leaked data dumps, company filings. Stuff anyone can access. You're just the person who bothers to connect the dots.

For bug bounty, OSINT answers the questions that make everything else possible: What does this company OWN? What tech do they use? Where are their forgotten assets? What have they accidentally exposed?

Why It's So Powerful

Here's the thing — companies leak information constantly without realizing it. A job posting says "experience with AWS, Jenkins, and MongoDB" — congrats, you now know their tech stack. A developer's public GitHub reveals internal tools. A DNS record points to a forgotten server. None of it is "hacking." It's just paying attention.

And the payoff: OSINT surfaces the soft, forgotten, exposed stuff — exactly where the bugs live.

The OSINT Sources That Matter For Bug Bounty

• Search engines & dorking — exposed files, panels, docs (Google, and GHDB for ready-made dorks)
• Certificate Transparency logs — reveal subdomains (whole post coming — it's a superpower)
• DNS records — map infrastructure, find dangling records
• GitHub/GitLab — leaked secrets, internal code, endpoint references
• Shodan/Censys — exposed servers, services, databases
• Wayback Machine — old URLs, old JS, dead-but-alive endpoints
• Job postings & LinkedIn — tech stack, internal tool names, team structure
• Breach/leak databases — exposed credentials (for understanding exposure, not for misuse!)

The Mindset

Good OSINT is about curiosity and patience. You're building a picture of the target from a hundred small public clues. The hunter who spends an hour on OSINT first will out-hunt the one who dives straight into poking the main app — because they know where to poke.