Open-Source Intelligence

Data is key and it is everywhere

OSINT is using any tool to collect and analyze publicly accessible data. Sources can be divided into six categories:

Media
newspapers, magazines, television, radio
Internet
blogs, user created content, social media websites, and message boards
Public Government Data
court documents, land deeds, census, press conferences, websites, and speeches
Professional and Academic Publications
journals, academic papers, symposia, and dissertations
Commercial Data
satellite imagery, financial and industrial assessments
Grey Literature
business documents, newsletters, technical reports, and patents

Record as much information about your target.

Use Google Earth and Maps to for physical recon.

Start a TECHNICAL map of systems/technologies/methodologies of target
ex Facebook, Twitter, LinkedIn, Google+, Instagram

LinkedIn gives real names to twitter accounts!
Search social networks, public sites, and visit the company websites. See if they leak information on what systems they are using. Search job boards for tech stacks.

Look for current projects, trips to conferences, phone numbers, and email addresses. Craft phishing and impersonation attacks.

Search for Company contracts with the US Government or other public entities.

Run whois and get