jieyab89/osint-cheat-sheetCurated OSINT cheat sheet with tools, datasets, wiki, and tips for reconnaissance, social media intelligence, and red team operations. Includes educational resources and legal guidance.
Contains a list of OSINT tools, OSINT tips, datasets, Maltego transform and others. There are free and paid tools you can use and owner is not responsible (take your own risks), only for knowledge or educational purposes. Apologies if some of the resources are no longer available or contain errors, as the owner does not regularly check the status of these resources, If there is new information, the owner will add it to this repo along with the category. If you want to read about techniques and intelligence some have already been added to the Wiki page Jieyaboo Wiki The owner will add them back. If there are any errors let us know thank you.
Please take a notes. Due to the large number of supply chain attacks, refer to OWASP TOP 10 2025 also the TA campaign like fake captcha, injected script, obfuscate script and other. My advice is to use a sandbox machine that does not contain your personal data and office. With the rise of malware stealers, crypto miners, and other threats, to reduce this risk, you can use fake accounts on social media, email, phone numbers, and your sandbox machine, as well as turn on your AV (Anti Virus) and firewall. For malicious activiy also untracked resouces Jieyab will remove it
Tips:
Contains information about OSINT tips, OSINT branches and knowledge about intelligence
Contains information about OSINT tips, write up usage resouces and more tips about OSINT and OSINT branch
Notes: "I recommend always using the hot reload function (CTRL + F5 OR Ctrl + Shift + R) to view updated content and clear the cache. I use DeepL to assist with creating articles in English also AI LLM, and my writing style tends to be a mix of informal and formal language, adhering to EYD (Enhanced Spelling) standards. Narrative"
Info
| Date | Remarks |
|---|---|
| 5 Jul 2026 | Update the article about Darkweb scrapping and All About OSINT Matters Things in OSINT also Intelligence Base & Knowledge Base at Gitbook and Wiki Github pages |
| 5 Jul 2026 | Add license MIT |
You can build it with VM or Live USB make sure you have sandbox machine
Artist string
Author string
Caption string
Categories string
Collections string
DateTime date
DPP lang-alt
EditStatus string
FixtureIdentifier string
Keywords string
Notes string
ObjectCycle string
OriginatingProgram string
Rating real
Rawrppused boolean
ReleaseDate string
ReleaseTime string
RPP lang-alt
Snapshots string
Tagged boolean
More : man exiftool (Run on your terminal)
Site :
example : exiftool -Author="Bayu" test.txt
you can add multiple tag and multiple file
example : exiftool -Author="" test.txt
example : exiftool -all="" file
Usage : man exiftool or read documentation exiftool.org
Not there are tag no writetable, make sure tagname can write
Automated tool by David Bombal
Use fresh file, if your file has been compressed or edit metadata you got a default metadata You can use xmp format for edit, write and delete metadata Check the documentation
Site and forums OSINT community arround world
Pro Tips
Try search on forum like programmer forums, web framework forums, social media and other things. Use a google dork to easy way find information with site target
List endpoint Github for search code
Endpoint list Github (Better login with your account for best results)
Guide Github search code by Jieyab89 : https://github.com/Jieyab89/OSINT-Cheat-sheet/tree/main/Script/Github-Search
Hastag and keyword analysis in search engine, social media or other platform (Text Intel)
Notes this is for surface web or clearnet site
*Tips web cache
Use this if google cache was gone (no index sites)
https[:]//www[.]google[.]com/search?q=cache:<url of interest>
There is a resouces to investigae malicious link and bypass url shortlink
Browser Sandbox
Tips
You can find the file hash or other threat indicator
Github Dork
Dorking is a wonderful thing, you can use this technique to search for anything such as index of a website, looking for live online camera server and other specifics, as for dorking commands that you can do for example
Example
Example
Web Defacement Archive
Tips
You can use dork and cache for Google index search hacker nickname also try search into archiver data broker like wayback, archive today and etc
Politic and Geopolitic Archive
Malware Database Archive
Crack medium article
Pro Tips
You can also use Google dork to search blogger profile
Pro Tips
If you has found the person phone number you can check at data breach, e wallet, social media, email address (via reset password), getcontact, truecaller, ipqs, fraud checker and last trying to dork or search any info into social media too
Group Search: site:facebook.com inurl:group
Group Wall Posts Search: site:facebook.com inurl:wall
Pages Search: site:facebook.com inurl:pages
Public Profiles: allinurl: people 'name' site:facebook.com
Photos By - https://www.facebook.com/search/taget_id/photos-by
Photos Liked - https://www.facebook.com/search/taget_id/photos-liked
Photos Of - https://www.facebook.com/search/taget_id/photos-of
Comments - https://www.facebook.com/search/taget_id/photos-commented
Friends - https://www.facebook.com/search/taget_id/friends
Videos Tagged - https://www.facebook.com/search/taget_id/videos
Videos By - https://www.facebook.com/search/taget_id/videos-by
Videos Liked - https://www.facebook.com/search/taget_id/videos-liked
Videos Commented - https://www.facebook.com/search/taget_id/videos-commented
Events Attended - https://www.facebook.com/search/taget_id/events-joined
Relatives - https://www.facebook.com/search/taget_id/relatives
or you can use dork for spesific example
id site:facebook.com
page site: facebook.com
id site:facebook.com *
page site: facebook.com *
For this case u must know the context also dorking for better results
Pro Tips
Note is for investigator like search scandal, deepfake porn or blackmail, red district review, women, dating platform and porn actress. Searching for scandal or blackmail or deepfake porn doesn't have to be on the listed sites, there are many perpetrators uploading on several platforms You need to do massive scrapping to collect this information, but there are times when they do it on platforms such as telegram, X or adult sites, you can search using dork, regex and linguistic like slang, abbreviation of word and other things
Twitter Search Engine
Google queries for LinkedIn
Public Profiles: site:linkedin.com inurl:pub
Updated Profiles: site:linkedin.com inurl:updates
Company Profiles: site:linkedin.com inurl:companies
Google queries for MySpace
Profiles: site: myspace.com inurl:profile
Blogs: site:myspace.com inurl:blogs
Videos: site:myspace.com inurl:vids
Jobs: site:myspace.com inurl:jobs
Videos: site:myspace.com 'TARGET NAME' 'videos'
Comments: site:myspace.com 'TARGET NAME' 'comments'
Friends: site:myspace.com 'TARGET NAME' 'friends'
Mostly general for searching data like web enumerate, attack surface, email, person and etc with hosted and manual installation (local install) in your machine
Search channel, username, bot and anymore
Telegram Tips
View and parse the data like usernanme, private group, phone number and etc
Telegram tips. Change the hash value, username, phone number on the endpoint or url's
Scribd viewer
Scribd downloader
| Country / Region | Legal Framework | Key Legal Considerations | OSINT / PII Implications |
|---|
| Indonesia 🇮🇩 | Personal Data Protection Law (Law No. 27 of 2022) — UU PDP Electronic Information and Transactions Law (UU ITE) — Law Overview | Requires a lawful basis for processing personal data (consent, contract, legal obligation, legitimate interest, etc.). Data subjects have rights. UU ITE prohibits unlawful access and misuse of electronic data. | OSINT using publicly available data is generally permissible, but processing identifiable personal data must comply with PDP Law principles such as purpose limitation and data minimization. |
| European Union 🇪🇺 | General Data Protection Regulation (GDPR) — Official EU Text | Processing requires a lawful basis (consent, legitimate interest, etc.). Transparency, accountability, and data subject rights apply. High-risk processing may require a DPIA. | Public availability does not remove GDPR obligations. OSINT involving EU residents’ personal data must meet GDPR compliance standards. |
| Spain 🇪🇸 | LOPDGDD (Spain’s Organic Law on Data Protection) + GDPR — Official Text (BOE) | Supplements GDPR with national rules. Legitimate interest may apply for research under strict necessity and proportionality tests. | OSINT research must document lawful basis and balance privacy impact against legitimate interest. |
| Mexico 🇲🇽 | Federal Law on Protection of Personal Data Held by Private Parties — Official Government Portal | Requires privacy notice, lawful basis, and safeguards when processing personal data. Individuals have rights to access, rectify, cancel, or oppose data use. | Collecting public data is allowed, but processing personal data still falls under legal protections. |
| United States 🇺🇸 | Computer Fraud and Abuse Act (CFAA) — Cornell Law School Reference State Privacy Laws (e.g., CCPA/CPRA) — California DOJ | Prohibits unauthorized access to computers and bypassing authentication. Privacy laws vary by state. | OSINT is legal when using publicly accessible sources. Accessing restricted systems or circumventing security controls is illegal. |
| China 🇨🇳 | Personal Information Protection Law (PIPL) — Official Text (NPC) Cybersecurity Law (CSL) — Overview Data Security Law (DSL) — Overview | PIPL requires lawful basis and strict consent rules for personal data processing. Strong state controls on data handling, cross-border transfer restrictions, and broad definitions of sensitive personal information. | Even publicly available personal data can be regulated under PIPL. Large-scale OSINT data aggregation, profiling, or export outside China may trigger compliance reviews or security assessments. |
| International (Human Rights) | International Covenant on Civil and Political Rights (ICCPR), Article 17 — UN Text | Recognizes the right to privacy and protection from arbitrary interference. Applies to digital environments. | OSINT activities should respect fundamental privacy rights even when data is publicly accessible. |
| OSINT Ethical Principles (Non-Legal) | Community-driven OSINT codes of conduct and research ethics | Use only lawfully and publicly available sources. Avoid doxxing, stalking, harassment, or data resale. Minimize sensitive data collection. | Ethical practice often goes beyond legal requirements and reduces risk of harm, misuse, or reputational damage. |