highefforthreads
Active member
- Joined
- Aug 19, 2026
- Messages
- 42
- Online time
- 20h 55m
- Reputation
- 114
BEGINNER OSINT GUIDE/TOOLS
(this is satire btw)
DISCLAIMER: THIS GUIDE SHOULD BE USED FOR ETHICAL AND LEGAL PURPOSES ONLY. This guide is intended for CTFs, OSINT exercises, public-interest research, and investigations where you have a legitimate reason to investigate. Don't use these techniques to identify, locate, expose, monitor, or harass privacy individuals. Never attempt to obtain non-public information, or access accounts you aren't authorized to access.
(this is satire btw)
DISCLAIMER: THIS GUIDE SHOULD BE USED FOR ETHICAL AND LEGAL PURPOSES ONLY. This guide is intended for CTFs, OSINT exercises, public-interest research, and investigations where you have a legitimate reason to investigate. Don't use these techniques to identify, locate, expose, monitor, or harass privacy individuals. Never attempt to obtain non-public information, or access accounts you aren't authorized to access.
introduction: Alright so I’ve been lurking for a while and been seeing threads about OSINT (open source intelligence), and personally I think it's a really cool and fun thing to do. It’s almost like solving a puzzle or a mystery by using small little clues. I’ve been practicing in tryhackme for about a year now, and i want to share some tactics i learned along the way as a beginner hoping to do this full time one day (as a career) The techniques I am going to describe have some niche things (although I think most people will know them but I want to share this anyways for those who don’t) Also, please use this guide in an ethical way, please do not become a super scary sinister blud who rots on discord all day and contributes nothing to society. Also in this thread I’m kinda unorganized and all over the place so take it if you will. OSINT can actually be a really fun thing to do if you're into solving puzzles and internet mysteries!
----------------------------------------------------------------------------------------------------------------------------------------------------------------
01 - Mindset
----------------------------------------------------------------------------------------------------------------------------------------------------------------When you're doing an investigation, it's super important that you do the following things:
Pay attention to every little detail:
You don’t realize how much people reveal about themselves everyday just through small habits. For example, you can tell if someone’s primary language by the way they speak (For instance in Poland, many people don't add a [thing] or the [thing] they just say [thing] because there is no “a” or “the” in the polish language. (obviously this isn't a very good clue because many other languages do the same thing but the point is pay attention to even the smallest of details)
Bridging/pivoting:
Your main goal should be to gather leads so you can “bridge” to other related accounts to uncover more clues. For example, going from Roblox account --> discord account --> link in bio --> social media --> workplace social media showcases how you "bridge" between different platforms based on evidence and leads.
Confirmation:
I cannot stress this enough. I’ve seen so many people find a small clue that is completely false and it leads them to wrong clues. DOUBT every piece of information you get and only accept it once you are confident in it and have SOLID proof. Remember, one bad lead at the beginning of the investigation can mess EVERYTHING up and you will end up finding some random guy in fucking Albania or some shit :lul: The general framework you want to follow is uncover --> correlate --> confirm
----------------------------------------------------------------------------------------------------------------------------------------------------------------
02 - Roblox account recon:
----------------------------------------------------------------------------------------------------------------------------------------------------------------This section is mainly useful when analyzing a Roblox account in a CTF, OSINT exercise, or other authorized investigation.
Check followers/following:
See if there is anyone with first names, locations (for example some people will have there first name then an abbreviation: “AndreaES” Also, just look through their following to see if any of them are in specific groups, sometimes people will be in friend groups and have the discord server linked which can be useful for later if you find the followers/following and you find a pattern of people in specific groups in a certain language, you can store that in the back of your mind when deciding to narrow countries. Also, those people might be irl connections, and if their names are displayed and you get to the later stages where you find Facebook/instagrams, you often spot people with those names and it's easier to confirm.
Check Groups:
See if there are any smaller groups with less than 100 people ideally, as some people have friend groups where they link discord servers or the friend group might be an irl friend group from a long time ago. After identifying these groups, look through the members and see if you remember any of the followers because now you can establish a mind map of who is the individuals relevant connections (useful for later) Tip 2.5: Ok, now most people use discord and will join big game’s discord server and if your lucky, they might reveal a small clue or sometimes they will link another account through bloxlink which can potentially reveal more. (Keep in mind you can also do this for the individual's favorite game section) if you know this user’s discord, you can go into these servers, go to the search operators at the top right, and type from: user. Do this on server, and you have a chance of finding something. (Remember, every little clue is absolutely necessary.
Study the username:
I’ve noticed a lot of people sleep on the username itself. Like think about it, most people on roblox created their accounts with meaning in their names, and unless your user was like “ejifefeofejf” then it usually has some significance. Common username giveaways include:
Birthdate; e.g. “name05” (meaning 2005) or “name2005" first name: e.g. “DonaldVDM” initials: e.g. LTfire Character from game/show: e.g. “Zelda03” (useful for later bc it shows individuals interests which can help with confirmation) country: e.g. “unitedstatespatriot” might be larping country if its like an egangster though so be careful. Also, look at past users/join date for later correlation/more leads.
Honorable Mentions:
1. Checking Badges to see if the individual joined niche games.
2. Checking whether you can click on the followers/following page. Usually if you cannot, it may signal the user is from the UK but not always. Its good if you have other information pointing to the individual being in the United Kingdom.
3. Check games/game-passes for any small clues.
Tools:
BloxLeak — Roblox OSINT
bloxleak.com
Roblox Player Search
Quickly search for Roblox players and view their profiles with extra stats, charts, and limited item inventory.
www.rolimons.com
Summary:
Roblox is pretty useless in terms of OSINT. It’s good at collecting data and past usernames, but other than that, most people who are privacy conscious will secure their Roblox and private everything. Don’t expect to find any groundbreaking clues, but at least try to find some patterns.
DISCLAIMER ABOUT ROBLOX TECHNIQUES:
Here's the thing, everyone is different, some people may just put random numbers that happen to resemble a country or a birthdate. Use this more as a gauging tool to see if the same user on other platforms has similar clues. This is probably the weakest section tbh, but it's still worth noting.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
03 - Discord Recon
----------------------------------------------------------------------------------------------------------------------------------------------------------------Discord recon is useful for narrowing timezones, finding connected links, finding interests and occasional pieces of small but powerful clues. You must be in an active server with an individual where they talk regularly.
look through their connected accounts:
Discord has a feature that lets users connect their accounts. This means you have the physical link + username which can be useful for alias mapping as well as OSINT within each of those connections. guns.lol is another one, as you might find information that can be useful such as other social media, etc.
Track when they seem to talk mostly for timezone recon:
Go to the search operator and browse through their messages and try to correlate when they talk the most/least. However, if they travel frequently, are on college summer break or have a shit sleep schedule this may not work as well. Your best bet is to look at past messages during winter or if you have clues they are in Australia or other countries with different summers, adjust accordingly.
Join servers from Roblox groups:
Well now's your time to go into every server and use the search operators from:user and also use from:user contains:images because lots of times users will screenshot things on discord revealing clues. This usually reveals clues that is useful for later. This usually works in smaller niche servers but may work in larger servers. Another strategy is to join the top 50 most popular game discord servers and use the from:[user] command and see if anything shows up.
Tip 5: EXTREMELY USEFUL
Relevant account searching: What i've noticed is many people will give their IRL socials to online contacts. While it seems harmless if you trust the friend, its actually one of if not the most effective way to find social media accounts. This works best if the individual is aware of privacy and takes active measures (not reusing usernames, wiping data from data brokers, etc) Just apply the same tips in this guide to a few relevant contacts and 95% of the time you will get an instagram/tiktok/other platform account (especially Europe and the United States) where you can look through followers/following and correlate previous data with certain accounts.
DISCLAIMER ABOUT DISCORD TECHNIQUES:
as i said before, everyone is different, some people may just put random numbers that happen to resemble a country or a birthdate. Use this more as a gauging tool to see if the same user on other platforms has similar information.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
04 - Instagram:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Lots of people use a tool called “osintgram” which is fine, but I think using your brain is better in this case because if the account is private it doesnt work. Instagram OSINT can help reveal relevant connections, activities, etc.
Public accounts:
Pretty self explanatory. go through the followers/following lists and map out people with common, work places, etc in their bios.
Private accounts:
Look through the suggested accouns tab. This is usually compiled of the followers/following.
Picture hunting:
also self explanatory, look who commented, liked, description of post, and contents of post or any gps location.
Bio hunting:
Look for initials, location, school initials, teams, workplace, businesses, etc.
Tools:
GitHub - Datalux/Osintgram: Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname
Osintgram is a OSINT tool on Instagram. It offers an interactive shell to perform analysis on Instagram account of any users by its nickname - Datalux/Osintgram
github.com
Anonymous Instagram Story Viewer & Downloader (Free, 2026)
Free Instagram Story viewer and downloader. View and download Stories anonymously from any public account — no login, no app needed. The poster never knows.
FOR TiKTOK AND FACEBOOK:
do the same, there isn’t really much difference between these platforms interns of techniques, I would say instagram is the easiest for recon. The issue with tiktok and facebook is if the individual makes their profile private, there isn't really much you can do.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
05 - Email OSINT:
----------------------------------------------------------------------------------------------------------------------------------------------------------------There isn’t much to say about this section except using tools, so will link the best free tools below.
Tools:
1. https://emailosint.org/
2. https://fingerprint.to/
3. https://oathnet.org/
4. https://haveibeenpwned.com/ (is not great in my opinion)
5. https://epieos.com/
1. https://www.osint.industries/ (supposedly the best one idk I have never used it
2. https://www.csint.tools/
Tip:
you can use a technique known as google dorking to search for the email in google. Sometimes files showcase the email.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
06 - Username OSINT:
----------------------------------------------------------------------------------------------------------------------------------------------------------------In my opinion, username OSINT has to be one of the best methods for normal ppl, but bad if someone is aware of username OSINT and uses an alias like “wjdwjdwdl” or “3nez’ or just doesn’t reuse usernames across platforms. Again, this is mainly a tool based thing but you can manually search it in google If you want. I’ll link the best tools below:
Tools:
1. https://fingerprint.to/ (great one my personal favorite and its niche I found it the other day)
2. https://whatsmynameapp.us/ (gold standard)
3. https://usersearch.org/
4. https://github.com/sherlock-project/sherlock
Tip:
These other accounts generate more leads, even the smallest of details, i.e. interests, rellevant connections, etc)
----------------------------------------------------------------------------------------------------------------------------------------------------------------
07 - Phone Number OSINT:
----------------------------------------------------------------------------------------------------------------------------------------------------------------I don’t know much about this, but I still know some good tools to use. This again is a tool based option, but I reckon you can google dork this and see if it shows up.
Tools:
1. https://fingerprint.to/ (Has phone number option)
2. https://www.numlookup.com/
3. https://www.whitepages.com/reverse-phone
Tip:
You can also use the email OSINT tools with phone numbers, names, etc interchangeably because most have the option to do so
----------------------------------------------------------------------------------------------------------------------------------------------------------------
08 - Name OSINT:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Tool based, much more useful for finding lots of clues. This requires a people search tool which there are a few good options, but most are scams.
Tools:
1. https://www.truepeoplesearch.com/
2. https://thatsthem.com/
3. https://freepeoplesearch.com/
4. https://www.cyberbackgroundchecks.com/
Tip:
In this instance, google dorking or simply looking the individual up can reveal a sizable amount of information.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
09 - Google Dorking:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Google dorking can be a powerful tool if the individual Is in the corporate world or is prevalent on social media but sucks otherwise. Basically, you use different search operators in the text bar which includes:
Operators:
1. Filetype:
2. Site:
3. Inurl:
4. Intitle:
5. Intext:
here's a more detailed guide for those interested:
https://www.group-ib.com/resources/knowledge-hub/google-dorks/
----------------------------------------------------------------------------------------------------------------------------------------------------------------
10 - GEOSINT/Picture Analysis:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Ok so if you play geoguessr you will naturally be good at this. There aren’t great free tools to help so its best just to break down the image bit by bit and try to find unique characteristics. I’ve actually never done this apart from tryhackme rooms and a bit of geoguessr. But from what I’ve learned:
Brute Force It:
Try a metadata extractor if it’s not on a main platform to see if there is any revealing information. 99% of the time, there won’t be as more people are becoming aware of this and most platforms strip it anyways. (This site doesn’t strip it to my knowledge)
Identify unique characteristics in the photos:
For example, unique brick patterns, license plates, road signs, type of grass, etc .this will help you narrow your searches down
Consistency Correlation:
Try to inspect multiple photos across different time periods if possible to see if there is a common theme.
Shadow Correlation:
if there is a shadow, and you know the time of the photo, you can actually get gps coordinates (I know, pretty crazy) ill link the tools below.
Reverse Image Search:
pretty self explanatory, go into google and see if it shows anything, you can also ask chatgpt or gemini to try to approximate where it is.
Tools:
https://geospy.ai/
https://geospy.net/en
https://geotips.net/
Guide to GeoGuessr — Plonk It
Overall pretty generic, but as I said, I’ve never really partaken in this before, so this is my guess.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
11 - Metadata Extraction:
----------------------------------------------------------------------------------------------------------------------------------------------------------------i’m sure many of you are aware of metadata especially considering this forum doesn’t wipe it i believe but for those who don’t know, images contain data within them including type of camera and even gps coords. It can be a useful tool if you're on a niche platform without metadata scrubbing and have an image.
Tools:
1. https://exif.tools/
----------------------------------------------------------------------------------------------------------------------------------------------------------------
12 - IP/ISP:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Ah yes, the IP. We’ve all been tricked into clicking a link and it ended up being an ip grabber by some skid and thought they were going to show up to our house sob.. but in all seriousness, I really wouldn’t waste your time with this, because A. It’s hard to get unless you have breach databases/a friend who is an admin on a website (which is illegal) or B. Are able to pull their ip using social engineering which really depends on the individual’s trust, which isn’t really even OSINT.
Tools:
https://whatismyipaddress.com/ip-lookup
Grabify IP Logger - Log and Track IP addresses. IP Grabber. URL tracker.
Grabify IP Logger & URL Shortener allows you to tracks IP address, track locations and much more. Get someone else's ip with one click. IP grabber. URL tracker.
grabify.org
----------------------------------------------------------------------------------------------------------------------------------------------------------------
13 - Facial Analysis:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Facial analysis is used mainly when you have a picture and want to identify the user’s social media accounts through that photo. Most sites are pretty shitty from my experience but they may work if someone is active on social media or generally has many pictures of their face on the internet (Facesearch results are leads, not proof of identity. Always independently verify an apparent match)
Tools:
1. https://pimeyes.com/en
2. https://facecheck.id/
3. https://search4faces.com/
----------------------------------------------------------------------------------------------------------------------------------------------------------------
14 - Social Engineering: (NOT OSINT)
----------------------------------------------------------------------------------------------------------------------------------------------------------------Social engineering is the practice of getting information through persuasion, usually by manipulating or lying, etc. I won’t comment much on this because to be honest, I know nothing about social engineering. also, this isnt really OSINT i just put it out there:
----------------------------------------------------------------------------------------------------------------------------------------------------------------
15 - Generalized Tools:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Here's the place to go for all the generalized tools that include all of these techniques in one website. If you didn’t see any technique that matches your scenario.
Sites:
https://osintframework.com/
https://tools.osintnewsletter.com/
https://www.csint.tools/
OSINT Industries | Powerful Tools For Online Investigations
The Investigation Platform for Unmatched Accuracy & Real-time Data. The Leading OSINT Tools Built to Accelerate Your Investigations.
www.osint.industries
All-In-One OSINT Investigation Platform
Run faster investigations with one OSINT platform for usernames, emails, domains, and digital footprint analysis.
Fingerprint | Public Data Search Engine
Search online identities across 700+ platforms in real time. Look up by username or email - the OSINT investigation tool trusted by professionals.
https://dehashed.com/
https://www.proximityosint.com/
https://swolesome.pages.dev/
----------------------------------------------------------------------------------------------------------------------------------------------------------------
16 - Specialized Tools
----------------------------------------------------------------------------------------------------------------------------------------------------------------I previously touched on a few website specific OSINT techniques, but obviously there are many more websites. So i'll provide a list down below with the most popular ones:
Gaming:
Minecraft:
GitHub - Gobutsu/MineSight: Minecraft OSINT tool
Minecraft OSINT tool. Contribute to Gobutsu/MineSight development by creating an account on GitHub.
github.com
Minecraft Lookup | OSINT Forge
An intelligence workspace for turning open-source signals into accountable OSINT cases.
Steam:
Steam Profile, Games & Friends Lookup Tool
Search Steam accounts by vanity name, profile URL, or SteamID64 and inspect public profile, bans, games, friends, badges, groups, stats, content, and...
SteamReveal - Analyze Steam Profiles
SteamReveal is an OSINT tool designed for the Steam community. Analyze Steam profiles, discover real friends, and locate players using public data. Built with a responsive design and multilingual experience
steam-reveal.vercel.app
Fortnite:
Epic Games Account Lookup
Search any Fortnite (Epic Games) account and find linked accounts, location, creation date, account ID, and more data with this tool.
epic-lookup.com
Xbox:
Xbox Gamertag & XUID Player Lookup Tool
Search Xbox profiles by Gamertag or XUID and inspect public presence, social signals, games, achievements, media, clubs, and linked accounts.
Social Media:
(adding soon)
----------------------------------------------------------------------------------------------------------------------------------------------------------------
17 - Careers:
----------------------------------------------------------------------------------------------------------------------------------------------------------------OSINT offers lots of opportunities for high paying jobs. These include:
1. Open-Source Analyst
2. Cyber Threat Intelligence
3. Global Threat / Protective Intelligence Manager
and many more! These jobs pay between 80k to over 200k depending on position.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
18 - Practice:
----------------------------------------------------------------------------------------------------------------------------------------------------------------Use sites like tryhackme and complete the OSINT rooms. Also, play a lot of geogusser as it will develop your skills.
Sites:
https://tryhackme.com/ (search OSINT)
https://www.geoguessr.com/
https://gralhix.com/list-of-osint-exercises/
https://www.osintdojo.com/
https://freeosint.github.io/
Tip:
just look up random images and try to use the skills said in this video to find who created it.
----------------------------------------------------------------------------------------------------------------------------------------------------------------
19 - Conclusion:
----------------------------------------------------------------------------------------------------------------------------------------------------------------OSINT can be used as a tool to find publicly available information about people through many lenses. It’s what law enforcement uses to take down pdf’s and other horrid individuals. However, it can also be used for malicious purposes. It’s important that you use OSINT for good and for the love of god please PLEASE do not become some edgy e-gangster who thinks their tuff for doxxing someone over some lousy internet beef. It’s super lame and it just makes people more unwilling and paranoid to share personal information and become closer. If you can take one thing away from this thread, treat OSINt as a fun investigation where you use your brain to put together different pieces of the puzzle to form a coherent image. And honestly, OSINT is really stimulating for the mind because you must think of innovative solutions to get data.
I can already smell the DNR comments which is understandable considering this shit is 10 pages long on a google doc :lul:
ALSO LMK IF I MISSED ANYTHING REMEMBER IM NEW TO OSINT SO I PROB MISSED NICHE THINGS!!!
ALSO KEEP COMING BACK TO THIS THREAD IMA BE UPDATING WITH MORE TOOLS AND MAYBE KEYS TO PAID SITES OVER THE NEXT FEW DAYS AND THEN ILL PROB LET THIS DIE.
Last edited:
