Background Information Gathering and Open Source
OSINT is the disciplined collection of publicly available information about a target before touching it. Candidates must know the categories: organizational (domains, subsidiaries, staff, technologies), infrastructure (IP ranges, DNS records, certificates), and human (roles, emails, social presence). Understand passive versus active collection: passive uses third-party sources (search engines, WHOIS, certificate transparency, DNS history, job postings, social media) and does not directly touch target systems; active interacts with target infrastructure and may be logged.
Know the key record types and their OSINT value: A/AAAA (hosting), MX (mail provider), TXT (SPF/DMARC, verification tokens), NS (DNS provider), CNAME (third-party services). Certificate transparency logs reveal subdomains. WHOIS gives registration and sometimes contact data (often redacted now). Search operators (site:, filetype:, inurl:) and the concept of Google dorking appear in questions - understand the intent, not memorized strings.
Trap: confusing passive with active. Querying the target's own DNS server directly is active; reading a cached third-party record is passive. Also, do not assume WHOIS contact data is accurate or current.
Rule of thumb: if your traffic reaches target-owned infrastructure, treat it as active and ensure it is in scope. Prefer passive sources first to build a picture without alerting the target.