OSINT Field Manual Tools & Search Operators
Advanced search operators and vetted tools for open-source intelligence competitions — CTF-style events such as Trace Labs, university OSINT challenges, and authorized recon exercises. Public sources only.
⚑ Rules of engagement — read before the clock starts
- Work only the target and scope your competition assigns — nothing adjacent, nothing personal.
- Passive and public sources only: no phishing, no social engineering, no logging into accounts that aren't yours, no paywalled data outside what the ruleset allows.
- Never contact the subject, their family, or their employer directly. Observation, not interaction.
- Capture a source URL and timestamp/screenshot for every finding — unsourced intel doesn't score and doesn't verify.
- Corroborate with two independent sources before you report anything as fact.
Exhibit 01
Search Operators & Dorking
The fastest lever in any search: narrowing a general-purpose engine down to exactly the page, filetype, or phrase you need. Google and Bing accept the same core grammar with a few engine-specific extras.
| Operator | Example | Finds |
|---|---|---|
site: | site:linkedin.com/in "acme corp" | Results confined to one domain or subpath |
intitle: | intitle:"index of" "backup" | Term appears in the page title |
inurl: | inurl:profile inurl:member | Term appears in the URL path |
filetype: / ext: | filetype:pdf "org chart" | Documents of a given type |
intext: | intext:"contact us" "regional office" | Term anywhere in body text |
" " | "jane q. public" | Exact phrase, no stemming |
- | jaguar -car -nfl | Excludes noisy senses of a term |
OR / | | "jane doe" OR "j. doe" | Either term matches |
* | "born in *, 19*" | Wildcard placeholder inside a phrase |
AROUND(n) | jane AROUND(3) doe | Bing: terms within n words of each other |
from: to: since: until: | from:acmecorp since:2024-01-01 | X/Twitter advanced search date & author filters |
geocode: | geocode:40.7,-74.0,5km | X/Twitter posts near a coordinate |
Exhibit 02
Usernames & Handles
A handle from one platform is usually reused elsewhere. These sweep hundreds of sites in one pass to find where else it appears.
Social Searcher
Real-time mention search across public social posts, keyed by name or handle.
Exhibit 03
Email & Breach Data
An address ties a real identity to accounts, breach exposure, and registered services — without ever touching the account itself.
Have I Been Pwned
Checks an email against known public breach corpora — confirms exposure, not content.
Epieos
Traces an email to linked Google, PayPal, and other service accounts via public metadata.
Holehe
CLI that tests an email against 120+ sites' "forgot password" flows to confirm registration.
Exhibit 04
Phone Numbers
Carrier, line type, and cross-platform registration — enough to corroborate an identity without ever placing a call.
Exhibit 05
Image & Face Search
Reverse search finds where a photo has appeared before; forensic tools tell you whether it's been altered and what device or moment produced it.
Yandex Images
Generally the strongest reverse-image engine for matching faces, not just exact-image duplicates.
PimEyes
Facial-recognition search engine. Powerful and controversial — many competitions restrict or ban it; confirm your ruleset before use.
Jeffrey's EXIF Viewer
Reads embedded EXIF metadata — camera model, timestamp, sometimes GPS coordinates.
Exhibit 06
Geolocation
Pinning a photo or claim to a place using shadows, signage, terrain, and mapping data — classic "GEOINT" tradecraft.
SunCalc
Cross-references shadow angle and length against date/time to narrow latitude and hour.
Overpass Turbo
Queries raw OpenStreetMap data for distinctive local features — signage, road layout, POIs.
Exhibit 07
Public Records & People Search
Aggregators of publicly filed records — voter rolls, property, court dockets. Standard tradecraft for missing-persons style events; treat every hit as a lead to verify, not a fact.
IntelTechniques Tools
Michael Bazzell's single-page index of search forms spanning dozens of engines and record types.
OSINT Framework
The master map of the field — a browsable tree of tools by category, maintained by the community.
FastPeopleSearch
US public-record aggregator — historical addresses, associated names, age range.
TruePeopleSearch
Similar aggregator, useful for cross-checking FastPeopleSearch results against a second source.
Exhibit 09
Domains & Infrastructure
When the target is an organization rather than a person, DNS and certificate records map its real footprint fast.
crt.sh
Certificate-transparency log search — surfaces subdomains a company never intended to advertise.
Shodan
Search engine for internet-facing devices and services by banner, port, and location.
WHOIS (DomainTools)
Registration and ownership history for a domain, where not redacted by the registrar.
Exhibit 10
Archives & Cache
Deleted or edited pages rarely disappear — these hold snapshots the live web no longer shows.
Wayback Machine
The largest historical snapshot archive — check a page's edit history over years.
Archive.today
On-demand single-page snapshots — good for capturing a page before it changes mid-investigation.
Exhibit 11
Aggregator Frameworks
For larger scopes, automate the first pass — these run dozens of the lookups above in one job and hand back a structured result set.
Maltego
Link-analysis graphing — visualizes how people, domains, and infrastructure connect.
theHarvester
Pulls emails, subdomains, and names for an organization from public search sources.
Exhibit 12
Case Method
Tools win rounds; discipline wins the scoreboard. This is the checklist that separates a clean submission from a disqualified one.
- Screenshot every hit — with the URL and timestamp visible in frame, before the page can change or vanish.
- Corroborate before you claim — two independent sources for any fact you submit as confirmed.
- Log your pivot trail — note which finding led to the next search, so your path is reconstructable and defensible.
- Use an investigator persona — a dedicated account, never one tied to your own identity.
- Stay inside scope — the assigned target only; do not follow curiosity into an adjacent person or account.
- Submit sources with findings — an unsourced claim doesn't score in most rulesets and isn't real intelligence anywhere else.
Reference sheet for lawful, competition-scoped OSINT work. Every tool above operates on information its subject or platform has already made public — treat what you find with the same restraint you'd want applied to your own.
Exhibit 08
Social Platforms
Native advanced-search pages beat the public web crawl every time — they see posts the general engines never index.
X / Twitter Advanced Search
Native filter builder for author, date range, phrase, and engagement thresholds.
LinkedIn X-Ray (via Google)
site:linkedin.com/in "job title" "company"— sidesteps LinkedIn's own weak internal search.Reddit Search
Native search plus
author:andsubreddit:operators for a user's post history.