1. Web Resources
   1. OSINT Web Sites
      1. http://www.onstrat.com/osint/
      2. http://www.inteltechniques.com/
      3. http://osintframework.com
   2. Proxy Sites
      1. urlquery.net
      2. urlscan.io
      3. builtwith.com
   3. People Search Engines
      1. http://www.zabasearch.com
      2. http://thatsthem.com
      3. http://spokeo.com
      4. http://pipl.com
      5. http://www.advancedbackgroundchecks.com
      6. http://www.usa-people-search.com/names/p/
      7. http://www.whitepages.com/
      8. https://familysearch.org/search
      9. http://inteltechniques.com/OSINT/person.html
      10. http://www.peekyou.com/usa/
      11. http://publicrecords.searchsystems.net/
      12. http://www.familytreenow.com/
      13. radaris.com
      14. thatsthem.com
      15. truepeoplesearch.com
      16. cubib.com
   4. Street Address/Real Estate
      1. trulia.com
      2. zillow.com
      3. www.melissadata.com
   5. Phone Numbers
      1. spoofcard.com
      2. truepeoplesearch.com
      3. thatsthem.com
      4. https://pipl.com
   6. Email Addresses
      1. truepeoplesearch.com
      2. cubib.com
      3. hunter.io
      4. https://sites.google.com/site/emails4corporations
   7. Username Search
      1. inteltechniques.com
      2. knowem.com
      3. namechk.com
      4. inurl:profile|user inurl:dreadpirateroberts
      5. keybase.io
      6. Recon-ng(profiler) spiderfoot (what'smyname)
   8. Image/Avatar
      1. https://en.gravatar.com
      2. https://tineye.com
      3. Bing Image search
      4. Google Image Search
   9. Social Media
      1. facebook
         1. https://www.facebook.com/billy.crystals.16?lst=100026630350008%3A100007279452759%3A1528497759
         2. findmyfbid.com
         3. inteltechniques.com
         4. stalkscan.com
         5. Facebook Graph Searching
            1. Informational Site for Facbook Graph Searching
            2. http://researchclinic.net/graph.html
            3. https://www.facebook.com/search/100015178120082/groups/100015233462172/groups/intersect
            4. https://www.facebook.com/search/100015233462172/photos-commented/
            5. https://www.facebook.com/search/100015233462172/videos-liked/
            6. Users-named
            7. Places-named
            8. employees/past
            9. Friendship
            10. https://www.facebook.com/friendship/#1target/#2target
      2. linkedin
         1. Tools
            1. Spiderfoot
            2. recon-ng
         2. google search directive
            1. linkedin.com Name intitle:professional
         3. resumes
            1. https://icwatch.wikileaks.org
      3. Instagram
         1. Inteltechniques
         2. URL Components
            1. https://www.instagram.com/the.princess.bride/followers/
            2. ?taken-by=[ID/USER]
            3. name/followers
            4. name/following
            5. explore/tag/XXXX/
         3. View source for username
         4. Tools
            1. instagram-scraper --comments --include-location --maximum 20 the.princess.bride
         5. https://netbootcamp.org/instagram.html
      4. Twitter
         1. Twitter Adavnced Search option
            1. https://twitter.com/search-advanced
            2. site:twitter.com "@username"
         2. https://socialbearing.com
         3. https://echosec.net
         4. https://www.mapd.com
         5. deleted tweets at archive.org
         6. google cache for archived tweets
      5. Dating Apps
         1. https://start.me/p/VRxaj5/dating-apps-and-sites-for-investigators
         2. site:datingsite.com username
      6. Registry & wish list
         1. https://registryfinder.com
         2. https://www.myregistry.com
         3. https://www.theknot.com
   10. IP/DNS
       1. http://viewdns.info
       2. spiderfoot
       3. ip2location.com
       4. infosniper.net
       5. robtex.com
   11. Wireless
       1. wigle.net
   12. Government
       1. www.eia.gov
       2. fcc.gov
       3. netronline.com
   13. Corporate
       1. wwww.sec.gov/edgar
       2. buzzfile.com
       3. annualreports.com
       4. infobel.com
       5. investigativedashboard.org
       6. corporationwiki.com
       7. littlesis.org
       8. salary.com
       9. glassdoor.com
       10. censys.io
       11. shodan.io
       12. pastebin.com
2. Tool Collection Sites
   1. Justin Nordine's http://osintframework.com
   2. Technisette's http://technisette.com
   3. Bruno Mortier’s https://start.me/p/W2kwBd/sources-cnty (International)
   4. Emanuelle Welsh’s https://start.me/p/VRxaj5/dating-apps-and-sites-for-investigators (Dating sites)
   5. The large PDF handbook from i-intelligence at https://www.i-intelligence.eu/wp-content/uploads/2018/06/OSINT_Handbook_June-2018_Final.pdf
   6. https://github.com/Ph055a/awesome_osint
   7. https://github.com/IVMachiavelli/OSINT_Team_Links
   8. https://github.com/jivoi/awesome-osint
   9. https://start.me/p/b5Aow7/asint_collection
3. Tools
   1. wget
      1. wget -U "user agent string" -m --no-check-certificate http://www.sans.org
   2. curl
      1. curl -A "user agent string" https://swww.ans.org >index.html (output to filename index.html)
      2. curl --silent -L https://www.match.com| grep -o -E "UA\-[0-9]+"
   3. exiftool
      1. exiftool imagename.jpg | grep -E "GPS|Make|Date|Model"
   4. Document Google Analytics
      1. UA- or PAB-
   5. Spyonweb.com
      1. find domains using UA and PUB numbers
   6. harvester
      1. opt/tools/theharvester/
         1. python theharvester.py -d domainname.com -b google (or all)
   7. recon-ng
      1. recon-ng --no-analytics --no-check
         1. Use profiler after workspace creation
            1. add profiles the enter data
            2. use reporting to export data
      2. use profiler
      3. query select * from profiles
   8. EyeWittness
      1. Eyewitness.py --headless -f /home/student/labs/inigo_reconng_sites
   9. Search Engine Directives
      1. Physical
         1. “city state” county
         2. “company_name” branch office
         3. “company_name” headquarters address
      2. Logical
         1. site:company_domain.com partners
         2. site:company_domain.com customers
         3. site:company_domain.com clients
         4. company_name competitors
         5. company_name “case stud
         6. company_name “meeting minutes”
         7. site:company_domain.com filetype:pdf meeting minutes
         8. site:company_domain.com calendar
         9. site:company_domain.com events
      3. Electronic
         1. site:company_domain.com filetype:pdf
         2. site:company_domain.com filetype:docx
         3. site:company_domain.com filetype:xlsx
         4. site:company_domain.com filetype:pptx
         5. site:company_domain.com “company_name” logo
         6. filetype:xls intitle:password
      4. Infrastructure
         1. mailto company_domain.com
         2. site:company_domain.com directory
         3. “company_name” “purchase agreement” filetype:pdf
         4. site:company_domain.com “purchase agreement”
         5. “company_name” vpn
         6. “company_name” remote access
         7. site:company_domain.com inurl:vpn
         8. site:company_domain.com inurl:remote
      5. Financial
         1. “company_name” “annual report” filetype:pdf
         2. “company_name” “annual report” year filetype:pdf
         3. “company_name” financial report filetype:pdf
         4. “company_name” financial report year filetype:pdf
         5. “company_name” “8-k” filetype:pdf
      6. Org Chart
         1. site:bizjournals.com inurl:potm “company_name“
         2. site:linkedin.com “company_name” “present (1 month)”
         3. “company_name” accepted position
         4. “company_name” “new job”
         5. “company_name” “hired”
         6. “company_name” “resigned”
      7. People
         1. "dealth notice"|obit
   10. Geolocation
       1. freemaptools
       2. mapdevelopers.com
       3. GPS visualizer.com
   11. spiderfoot
   12. dnsrecon.py
   13. aquatone DNS discovery
   14. https://udger.com/resources/ua-list
4. Collection Flow Charts
   1. Email
   2. Domain
   3. Real Name
   4. Telephone
   5. Location
   6. Username