2.1 OSINT Methodology Overview

OSINT Methodology Overview

How to set up a clean research environment and run structured open source collection that feeds physical access, social engineering, and digital attack planning simultaneously

Open Source Intelligence is the starting point for every red team engagement. Before a single operator approaches a building, before a pretext call is planned, before a cover story is constructed, the OSINT phase should already be producing intelligence across all three operational dimensions: the physical layout and security posture of the target, the digital infrastructure that can be exploited or impersonated, and the human layer of staff behaviors, organizational structure, and procedural norms that makes social engineering possible. Organizations publish far more about themselves than they realize, and a disciplined OSINT effort extracts intelligence from those publications without leaving any trace that someone was looking.

What OSINT Produces Across All Three Dimensions

The value of OSINT is not that it finds interesting facts about a target. It is that it answers specific operational questions before any physical or human contact occurs, reducing the time operators need to spend near the facility and reducing the risk that physical observation sessions will be the first time you discover something that should have been known in advance.

For physical access planning, OSINT produces: building permit records with floor plans, satellite imagery of the facility and approaches, property ownership records that identify whether a building is owner-occupied or has a third-party landlord, and job postings that name the specific access control and camera systems in use.

For social engineering and pretexting, OSINT produces: employee names, titles, and contact information for the people most likely to be targeted or impersonated, organizational structure that reveals reporting lines and authority patterns, vendor and contractor names that form the basis of credible cover stories, and procedural intelligence from publicly posted policies and LinkedIn content that reveals how the organization actually operates.

For digital attack surface mapping, OSINT produces: domain and subdomain infrastructure, email format patterns for spear phishing, technology stack details from job postings and certificate data, and the digital fingerprints that help distinguish on-premises from cloud-hosted infrastructure.

Setting Up a Clean Research Environment

Your default Kali install is not a safe OSINT platform. Fix this before a single search touches anything related to the target.

Route all traffic through a VPN. Every session should start with a VPN connection confirmed active. Verify before starting:

curl https://ifconfig.me

The IP returned must be your VPN exit node, not your real address. If it matches your real IP, the VPN is not routing correctly. Do not proceed.

Use a dedicated browser profile or VM. Create a Firefox or Chromium profile used only for research. No saved logins, no personal extensions, no history connecting it to your real identity. For sensitive engagements, use a dedicated virtual machine with no personal accounts and no persistent history.

Create dedicated research accounts. You will need accounts on LinkedIn, X, and other platforms. These accounts must have no connection to your real identity or firm. Use a separate email address created only for this purpose. Never log into research accounts from your personal devices or real IP.

Disable WebRTC in Firefox to prevent IP leaks even when VPN is active. Navigate to about:config and set media.peerconnection.enabled to false. Install uBlock Origin and configure it to block trackers. Clear cookies between sessions.

The Five-Step Workflow

OSINT without structure produces large volumes of loosely connected output that is hard to act on. The following workflow keeps collection purposeful.

Step 1: Define scope. Pull your open questions directly from the list built in T1-L2. Every OSINT session should have written objectives, specific questions your session is designed to answer. Without written objectives, sessions drift toward whatever seems interesting rather than what the operation requires.

Step 2: Identify sources. Before searching, decide which platforms are most likely to hold the answers. Physical layout questions point to public records and satellite imagery. Social engineering pretext questions point to LinkedIn, company website, and press releases. Digital infrastructure questions point to domain tools and certificate logs. Mapping sources to questions before opening a browser prevents the pattern of defaulting to the same two platforms for everything.

Step 3: Collect. Work through sources systematically. For every finding, immediately record three things: what was found, the exact source (URL, database query, or specific platform search), and the date. A finding without a documented source cannot be verified and cannot be defended if the methodology is later questioned.

Step 4: Analyze. Cross-reference findings across sources. A piece of intelligence confirmed by two independent sources is reliable. Contradictions between sources are operationally significant. They often indicate organizational changes, outdated records, or deliberate misdirection. Look specifically for connections between the physical, digital, and human layers: a vendor name from a job posting corroborated by a badge system reference in a social media photo is a higher-confidence finding than either alone.

Step 5: Report. Organize findings by their operational use: physical access intelligence, social engineering inputs, digital surface findings. The output answers open questions on your list, and gaps that emerged during OSINT tell you what physical observation still needs to cover.

OPSEC: The Specific Mistakes That Alert Targets

LinkedIn profile views from a personal or work account. LinkedIn notifies users when their profile is viewed and shows the viewer’s name and company if they are logged in. Use Private Mode under Settings, or view profiles logged out entirely. Never use your real account for target research under any circumstances.

Searching from your office or home IP. Your firm’s IP address is associated with your firm’s name in geolocation and threat intelligence databases. A target’s security team will notice searches from a known security firm’s IP range. Always confirm VPN is active before any session.

Connecting to or following target accounts. Following a company page or sending a connection request creates a visible signal. View, screenshot, and move on. No follows, no likes, no comments, no requests.

Opening downloaded files without precautions. PDFs and Office documents can contain tracking pixels or web bugs that call home when opened, revealing your IP. Before opening any file from a target or related source, disconnect from the internet or open the file in a sandbox. On Kali, open documents in LibreOffice with macros disabled and network access blocked.

Not documenting sources. Findings without documented sources are findings you cannot verify, defend, or trace. Document as you collect, every time, without exception.

Key Takeaways

• OSINT runs first and shapes everything that follows. Physical observation sessions, cover story development, and digital exploitation planning all work from what OSINT established. Intelligence gathered after field sessions often just confirms what should have been known before.
• Every OSINT session needs written objectives. Define what questions you are answering before opening a browser. Sessions without objectives produce observations rather than intelligence.
• OPSEC failures during OSINT can compromise an operation before it begins. A target security team that knows someone is researching them has a significant advantage. Confirm VPN, use dedicated accounts, and never interact with target content from personal profiles.