Open Source Intelligence is the operation of gathering information about target, from publicly available sources. You don't use anything illegal, you don't get into contact with target so you don't leave trace. In short, you don't do anything to alert the target.
When harmless/unimportant looking publicly available informations about target systematically collected and gathered together, it becomes harmful, especially in social engineering attacks.
Examples of resources for OSINT:
Internet Service Registration – The global registration and maintenance of IP address information
DNS: Local and global registration and maintenance of host naming
- Search Engines: The specialist retrieval of distributed material relating to an organisation or their employees
- Email Systems: The information contained within each email delivery process
- Naming Conventions: The way an organisation encodes or categorises the services their online hosts provide
- Website Analysis: The information intentionally made public, that may pose a risk to security
Examples of tools for OSINT:
- Google Dorks: Sophisticated Google searches, shortly.
- Shodan: Search engine for inter-connected devices
- EXIF-Viewers: Sometimes you can find very useful information inside photographs
- Metagoofil: Info gathering tool for extracting metadata from public sources.
And many others...