Incident response: How to use OSINT

Open-Source Intelligence (OSINT) is vital to understand incident response in today’s cyber world. It is a combination of any proper threat intelligence operation, providing useful information about a particular threat and risk. We will take a detailed look at some OSINT tools available in the cybersecurity industry.

What are Open Source Intelligence Tools?

Cybersecurity experts use open-source intelligence tools in the inspection phase of an incident response plan to gather information from hundreds of websites in minutes. OSINT tools use AI features to collect multiple information from public sources about all related information and can be used later.

With OSINT tools, the investigation phase becomes streamlined. It is essential to know that OSINT tools effectively decreases the number of permutations and combinations concerning the data gathered from publicly available sources. OSINT is used to discover cyber-attacks such as phishing and ransomware.

7 OSINT Tools for Cyber Incident Response

Maltego

Maltego is one of the most powerful OSINT frameworks used by security professionals and digital forensics investigators to collect useful information. Maltego can quickly gather information from various public sources, using various transforms to create graphical results. However, these transforms are in-built and are customizable. Maltego’s investigator helps in gathering specific information such as social networking activity, websites, and email addresses associated with the user account.

Shodan

Shodan is an acronym for Sentient Hyper Optimized Data Access Network. Like, Google, the Shodan tool is the search engine for cyber-attackers. Shodan doesn’t show results like regular search engines; it presents results that only cybersecurity experts understand. Shodan is a vital tool for an incident response plan; it allows cybersecurity experts to see all devices connected to a particular network, helping them to detect and test them for vulnerability purposes.

Metagoofil

Metagoofil is also a handy tool for any incident response procedure. It is an excellent gathering tool used to extract metadata from the target. It is compatible with lots of file types such as pdf, doc, and ppt. This OSINT tool can also be used to mine MAC addresses from these file types. Metagoofil is also used to get a fair idea to an attacker of the type of operating system and network that was used.

The Harvester

Harvester is an OSINT tool used to get the email and domain-related information. It is used to gather information and it is pre-bundled in Kali.

Recon-ng

Recon-ng is an important OSINT tool to gather information from the target; it is also pre-bundled in Kali. Recon-ng has different modules in its framework to extract information. All you need to do is to include your preferred domains in its workspace and use the modules.

Social Engineer Toolkit

Social Engineer Toolkit is an OSINT tool used for online social engineering attacks. This OSINT tool is also be used to perform various cyber-attacks such as website-attack vectors and spear phishing. Social-Engineer Toolkit power lies in the modular approach – those who have used Metasploit will know how powerful modular tools are. Social-Engineer Toolkit can execute client-side attacks. You can also enter an executable and send it to the preferred target.

Recorded Future

Recorded Future is an open-source tool powered by AI used to trend predictions and massive data analysis. It uses AI algorithms to make future predictions.

Source: eccouncil.org