Coder Legion - Recent posts tagged osint

OSINT for Beginners: What You Need to Know

Tue, 31 Mar 2026 19:55:37 +0000

If you've ever Googled someone's name and found their LinkedIn, Twitter, and old forum posts in one search — congratulations, you've done OSINT. You just didn't call it that.

OSINT (Open Source Intelligence) is the practice of collecting and analyzing publicly available information to answer a question or build a profile. It's used by security researchers, journalists, law enforcement, and yes — hackers.

This guide is for developers and curious minds who want to understand OSINT from the ground up, without the jargon. Based on practical experience building OSINT tools and doing real-world recon.

What Counts as "Open Source"?

The "open source" in OSINT doesn't mean code — it means publicly accessible. If you can access it without breaking any law or bypassing authentication, it's fair game. This includes:

Social media profiles (Twitter/X, LinkedIn, Instagram, Reddit)
Domain registration records (WHOIS)
Search engine results
GitHub repositories and commit history
Government databases and public records
Job listings (yes, companies accidentally leak their tech stack here)
News articles and archived web pages

The internet is full of data that people have forgotten they made public.

Why Should Developers Care?

OSINT isn't just for hackers or detectives. As a developer, understanding OSINT helps you:

Secure your own projects — Know what info you're leaking through your repos, domain registrations, or APIs
Threat modeling — Understand how an attacker could research your app or your company
Bug bounty hunting — Recon is the first phase of any pentest; good OSINT = better vulnerabilities found
Research competitors or dependencies — Who's behind that open source library you're using?

Core OSINT Techniques

1. Username Enumeration

One username across 100 platforms can reveal a surprising amount about a person. Tools like Sherlock, Maigret, or my own project — GhostIntel — automate this process, checking whether a username exists across social networks, forums, and developer platforms simultaneously.

python ghostintel.py -u targetusername

Even if someone uses different usernames, writing style, profile picture metadata, or linked accounts can connect the dots.

2. Email Footprinting

An email address is often a gateway to a larger identity. Techniques include:

Checking breach databases (Have I Been Pwned)
Using hunter.io or similar tools to find associated domains
Looking up SMTP headers from received emails to trace infrastructure

3. Domain Reconnaissance

Domains leak a lot. A basic WHOIS lookup gives you registration dates, sometimes names and contact info, and historical ownership. Going further:

Subdomains — Tools like subfinder or amass reveal hidden services
DNS records — MX, TXT, and SPF records reveal third-party services used
Certificate transparency logs — crt.sh shows every SSL cert ever issued for a domain

4. Google Dorking

Google's advanced search operators are a goldmine. For example:

site:github.com "GhostIntel" password
filetype:pdf "internal use only" site:company.com
inurl:admin site:targetdomain.com

These queries can surface files, login panels, and sensitive documents that were never meant to be indexed.

5. Metadata Analysis

Photos, PDFs, and Word documents often contain hidden metadata — GPS coordinates, author names, software versions, and creation dates. Tools like ExifTool extract this automatically.

A photo uploaded to a public forum can reveal the exact location it was taken if GPS stripping wasn't applied.

The OSINT Workflow

Good recon follows a process, not random searching. Here's a simple framework:

Define your target — username, email, domain, or real name
Passive collection — gather data without touching the target's infrastructure
Active collection — interact with services (DNS queries, web scraping)
Correlation — connect data points across sources
Documentation — organize findings into a report

Jumping straight to step 3 without passive collection first is a common beginner mistake — and it can tip off your target.

Tools Worth Knowing

Tool	Purpose
Sherlock / Maigret	Username enumeration
theHarvester	Email and domain recon
Maltego	Visual link analysis
SpiderFoot	Automated OSINT aggregation
crt.sh	Certificate transparency
OSINT Framework	Curated tool directory
GhostIntel	API-free OSINT CLI built for fast, real-world recon

Most of these are open source and available on GitHub.

Legal and Ethical Boundaries

OSINT operates in a gray area. Just because information is public doesn't mean using it is always ethical or legal depending on context and jurisdiction.

Keep these principles in mind:

Never access systems you don't have permission to touch — Even passive recon can cross a line if you're aggregating data to stalk or harm someone
Know your local laws — Data protection laws like GDPR in Europe limit what you can do with personal data, even public data
Use it defensively — The best reason to learn OSINT is to understand your own exposure and fix it

How to Get Started

The best way to learn OSINT is to practice on yourself first. Search your own username, domain, and email. You might be surprised what you find.

Then explore CTF (Capture the Flag) challenges with OSINT categories — platforms like HackTheBox, TryHackMe, and TraceLabs host beginner-friendly challenges that teach recon in a legal, structured environment.

If you want a hands-on tool to experiment with, check out GhostIntel on GitHub — it's a lightweight CLI that automates recon across 100+ platforms and is designed to be easy to extend.

Final Thoughts

OSINT is one of those skills that changes how you see the internet. Once you understand how much information is publicly available — and how easy it is to aggregate — you start thinking differently about what you post, what you deploy, and what you expose.

Start small. Pick a target (yourself), run some searches, and see what comes back. The rabbit hole goes deep.

If you're building in OSINT, security, or automation — I'd love to connect and see what you're working on.

If you want a hands-on tool to start with, check out GhostIntel on GitHub — API-free, lightweight, and built for real-world recon.

Google Dorking Tutorial: Learn Smart Searching (Beginner Guide)

Wed, 07 Jan 2026 13:16:49 +0000

Google Dorking Tutorial: Learn Smart Searching (Beginner Guide)

Google is more powerful than most people realize.

With the right search operators, you can find specific files, research papers, public documents, and indexed pages that normal searches miss.
This technique is commonly known as Google Dorking.

This tutorial explains what Google dorking is, how it works, and how to use it responsibly.

❓ What Is Google Dorking?

Google dorking means using advanced search operators to narrow down Google search results.

Instead of:

documents

You search:

filetype:pdf site:gov.in

This tells Google exactly what you want.

Important:
Google dorking is not hacking.
It only searches publicly available and indexed data.

Why Learn Google Dorking?

Google dorking is useful for:

Research & academics
OSINT (Open-Source Intelligence)
️ Cybersecurity awareness
Journalism & fact-finding
Finding public documents

Used responsibly, it’s a search skill, not an attack.

Common Google Search Operators

1️⃣ `site:` – Search Within a Website

site:example.com

Searches only pages from one domain.

Example:

site:gov.in education policy

2️⃣ `filetype:` – Find Specific File Types

filetype:pdf
filetype:docx
filetype:xls

Example:

filetype:pdf climate change report

3️⃣ `intitle:` – Search Page Titles

intitle:login

Example:

intitle:"annual report"

4️⃣ `inurl:` – Search Keywords in URLs

inurl:admin

Example:

inurl:dashboard

5️⃣ Quotation Marks `" "` – Exact Match

"data protection policy"

This finds exact phrases.

Combining Operators (Real Power)

You can combine multiple operators:

site:edu filetype:pdf "machine learning"

This searches:

Only .edu sites
Only PDF files
Only with the exact phrase “machine learning”

️ Using a Dorking Terminal (Easier Way)

Instead of typing everything manually, you can use a simple UI like:

Vyoma G-Dork
https://vyomagdork.vercel.app/

It:

Lets you type dorks in a terminal-style interface
Opens results directly in Google
Does not scrape or collect data

⚠️ Ethical & Legal Guidelines (Very Important)

Google dorking should be used responsibly.

✅ Allowed

Research
OSINT
Public data discovery
Learning search techniques

❌ Not Allowed

Accessing private systems
Exploiting vulnerabilities
Searching for passwords
Misusing information

If data is not meant to be public, don’t interact with it.

️ Google Dorking ≠ Hacking

Let’s be clear:

Google Dorking	Hacking
Uses Google Search	Bypasses security
Public data only	Unauthorized access
Legal	Illegal

Learning how search engines work is a fundamental digital skill.

Final Thoughts

Google dorking teaches you one important lesson:

How you search matters more than what you search.

Used correctly, it can:

Save time
Improve research
Build OSINT skills
Increase cybersecurity awareness

Tools like Vyoma G-Dork aim to make this learning simple, ethical, and accessible.

Resources

Google Advanced Search
OSINT learning communities
Vyoma (https://vyomaco.vercel.app)

Disclaimer

This tutorial is for educational purposes only.
Always respect privacy, laws, and platform terms of service.

UserScanner

Mon, 01 Dec 2025 14:19:20 +0000

User Scanner

Repo: https://github.com/kaifcodec/user-scanner

Scan a username across multiple social, developer, and creator platforms to see if it’s available.
Perfect for finding a unique username across GitHub, Twitter, Reddit, Instagram, and more, all in one command.

Features

✅ Check usernames across social networks, developer platforms, and creator communities.
✅ Clear Available / Taken / Error output for each platform.
✅ Fully modular: add new platform modules easily.
✅ Command-line interface ready: works directly after pip install.
✅ Can be used as username OSINT tool.
✅ Very low and lightweight dependencies, can be run on any machine.

Installation

pip install user-scanner

Usage

Scan a username across all platforms:

user-scanner -u <username>

Optionally, scan a specific category or single module:

user-scanner -u <username> -c dev
user-scanner -l # Lists all available modules
user-scanner -u <username> -m github

Contributing:

Modules are organized by category:


user_scanner/
├── dev/        # Developer platforms (GitHub, GitLab, etc.)
├── social/     # Social platforms (Twitter/X, Reddit, Instagram, etc.)
├── creator/    # Creator platforms (Hashnode, Dev.to, Medium, etc.)
├── community/  # Community platforms (forums, niche sites)
├── gaming/     # Gaming sites (chess.com, roblox, monkeytype etc.)
├── donation/   # Donation taking sites (buymeacoffe.com, similar...)

Module guidelines:

Each module must define a validate_<site>() function that takes a username and returns:
- 1 → Available
- 0 → Taken
- 2 → Error / Could not check
Use httpx for requests, colorama for colored output.
Optional: modules can define a CLI parser if they support custom arguments.

See CONTRIBUTING.md for examples.

Dependencies:

License

This project is licensed under the MIT License. See LICENSE for details.

user-scanner

Sat, 22 Nov 2025 14:13:01 +0000

User Scanner

Github: https://github.com/kaifcodec/user-scanner

Features

✅ Check usernames across social networks, developer platforms, and creator communities.
✅ Clear Available / Taken / Error output for each platform.
✅ Fully modular: add new platform modules easily.
✅ Command-line interface ready: works directly after pip install.
✅ Can be used as username OSINT tool.
✅ Very low and lightweight dependencies, can be run on any machine.

Installation

pip install user-scanner

Usage

Scan a username across all platforms:

user-scanner -u <username>

Optionally, scan a specific category or single module:

user-scanner -u <username> -c dev
user-scanner -l # Lists all available modules
user-scanner -u <username> -m github

Example Output:

Note*: New modules are constantly getting added so this might have only limited, outdated output:

 Checking username: johndoe078

== DEV SITES ==
  [✔] Codeberg: Available
  [✔] Cratesio: Available
  [✔] Dockerhub: Available
  [✘] Github: Taken
  [✔] Gitlab: Available
  [✔] Launchpad: Available
  [✔] Npmjs: Available
  [✔] Replit: Available

== SOCIAL SITES ==
  [✔] Bluesky: Available
  [✔] Discord: Available
  [✘] Instagram: Taken
  [✔] Mastodon: Available
  [✔] Pinterest: Available
  [✘] Reddit: Taken
  [✔] Snapchat: Available
  [✔] Telegram: Available 
  [✘] Threads: Taken
  [✔] X (Twitter): Available
  [✔] Youtube: Available

== CREATOR SITES ==
  [✔] Devto: Available
  [✔] Hashnode: Available
  [✔] Kaggle: Available
  [✔] Medium: Available
  [✔] Patreon: Available

== COMMUNITY SITES ==
  [✔] Coderlegion: Available

== GAMING SITES ==
  [✔] Chess_com: Available
  [✔] Osu: Available
  [✔] Roblox: Available
  ...
  ...
  ...

Contributing:

Modules are organized by category:

user_scanner/
├── dev/        # Developer platforms (GitHub, GitLab, etc.)
├── social/     # Social platforms (Twitter/X, Reddit, Instagram, etc.)
├── creator/    # Creator platforms (Hashnode, Dev.to, Medium, etc.)
├── community/  # Community platforms (forums, niche sites)
├── gaming/     # Gaming sites (chess.com, roblox, monkeytype etc.)

Module guidelines:

Each module must define a validate_<site>() function that takes a username and returns:
- 1 → Available
- 0 → Taken
- 2 → Error / Could not check
Use httpx for requests, colorama for colored output.
Optional: modules can define a CLI parser if they support custom arguments.

Coder Legion - Recent posts tagged osint

OSINT for Beginners: What You Need to Know

What Counts as "Open Source"?

Why Should Developers Care?

Core OSINT Techniques

1. Username Enumeration

2. Email Footprinting

3. Domain Reconnaissance

4. Google Dorking

5. Metadata Analysis

The OSINT Workflow

Tools Worth Knowing

Legal and Ethical Boundaries

How to Get Started

Final Thoughts

Google Dorking Tutorial: Learn Smart Searching (Beginner Guide)

Google Dorking Tutorial: Learn Smart Searching (Beginner Guide)

❓ What Is Google Dorking?

Why Learn Google Dorking?

Common Google Search Operators

1️⃣ site: – Search Within a Website

2️⃣ filetype: – Find Specific File Types

3️⃣ intitle: – Search Page Titles

4️⃣ inurl: – Search Keywords in URLs

5️⃣ Quotation Marks " " – Exact Match

Combining Operators (Real Power)

️ Using a Dorking Terminal (Easier Way)

⚠️ Ethical & Legal Guidelines (Very Important)

✅ Allowed

❌ Not Allowed

️ Google Dorking ≠ Hacking

Final Thoughts

Resources

Disclaimer

UserScanner

User Scanner

Repo: https://github.com/kaifcodec/user-scanner

Features

Installation

Usage

Contributing:

Dependencies:

License

user-scanner

User Scanner

Features

Installation

Usage

Example Output:

Contributing:

Dependencies:

⚠️ community/ and gaming/ are small, looking for contributions

1️⃣ `site:` – Search Within a Website

2️⃣ `filetype:` – Find Specific File Types

3️⃣ `intitle:` – Search Page Titles

4️⃣ `inurl:` – Search Keywords in URLs

5️⃣ Quotation Marks `" "` – Exact Match

⚠️ `community/` and `gaming/` are small, looking for contributions