Welcome back, aspiring cyberwarriors!

Open Source Intelligence, or OSINT, is a powerful yet underrated cybersecurity discipline. A solid reconnaissance phase uncovers vast target information before active probing even begins.

Traditionally, effective OSINT was a painful process. It meant juggling fragmented tools and manually parsing disjointed data to map a target. AI can completely automate this workflow. It calls the right tools in order and explains its analytical reasoning.

This article explores OpenOSINT, an automated intelligence agent built for security researchers. We will install the framework and test its core capabilities using real commands. Let’s get rolling!

What is OpenOSINT?

OpenOSINT is an artificial intelligence assistant designed to automatically gather public information and conduct digital investigations. To interact with OpenOSINT, you can choose from four different methods depending on your comfort level with computers. Beginners will likely prefer the web interface. For those who prefer working with text, the tool offers an interactive terminal. There is also a direct command line interface for running quick commands. Finally, it can act as a background server using MCP that plugs directly into other AI applications, like Claude Desktop.

The way this AI works makes it super reliable and gets rid of that annoying problem of AI making stuff up. When we ask OpenOSINT to do something, it connects to an AI engine. If the AI realizes it needs to look something up, it totally pauses and waits. Your computer then boots into tools, runs the actual program it needs, gathers the right info, and sends that back to the AI. Because the model has to wait for real results instead of just guessing, it can’t fake or invent any findings (or at least will do that less often).

If OSINT is a skill you want to develop seriously, we strongly encourage you to check out the dedicated OSINT series. It covers passive and active reconnaissance techniques, social media intelligence, geolocation, and much more, all taught by practitioners who do this work professionally.

Step 1: Installing OpenOSINT

Let’s clone and install the framework.

kali > git clone https://github.com/OpenOSINT/OpenOSINT.git

kali > cd OpenOSINT

From the observation of the source file, we can confirm that it’s a Python project. Our next step should be the installation of dependencies. Before that, it’s wise to create a dedicated virtual environment.

kali > pip install -e .

The command above uses the -e flag to install the package in editable mode. This means that any changes we make to the source files will be reflected immediately without the need to reinstall the package.

Next, we will install the external dependencies for OpenOSINT. Each dependency supports a specific investigation module, and the framework will still function properly even if some dependencies are missing. Holehe is used for email account enumeration, while Sherlock conducts username enumeration across more than 300 platforms. Sublist3r is utilized for subdomain enumeration. Installation is simple and can be done easily using pip.

kali > pip install holehe

kali > pip install sherlock-project

kali > pip install sublist3r

Another important tool for OpenOSINT is PhoneInfoga. It’s distributed as a standalone binary rather than a Python package, so download the latest release for your architecture from its GitHub releases page.

kali > tar -xzf phoneinfoga_Linux_x86_64.tar.gz

kali > sudo mv phoneinfoga /usr/local/bin/

Step 2: Configuring API Keys

OpenOSINT becomes significantly more effective when supplemented with additional information from external tools like VirusTotal. This integration allows OpenOSINT to gain a clearer understanding of the situation and ultimately make better decisions.

To configure the API keys, we need to open the .env file:

OpenOSINT supports a wide range of services. In this instance, I will specify my Anthropic API, VirusTotal, and Censys.

Step 3: Testing OpenOSINT Web Mode

OpenOSINT offers several ways to use its features. One of them is the AI REPL (Read-Eval-Print Loop), which is a simple, interactive programming environment that accepts user inputs, executes them, and returns the results. Another option is through the web interface, which I will use. There is also a direct tool usage method, but since it does not involve AI, I will not focus on it here, as we can use those tools directly without OpenOSINT.

To start the OpenOSINT web server, use the following command:

kali> openosint web

This command will open a webpage that looks like the one shown below.

Let’s start with a username investigation.

First, the system initiated a broad tool-based check across numerous platforms, returning raw data showing specific profile URLs for the username “tomilov” on sites ranging from Audiojungle and Behance to Codeforces and Discord, indicating presence on creative, social, and gaming platforms.

Finally, it synthesizes these findings into points, such as the subject’s probable Russian origin and their clear professional background. Essentially, the tool executed a digital footprinting task and transformed the results into categorized intelligence.

Next, let’s investigate a domain.

As shown in the screenshot above, the tool initiated its workflow by pulling WHOIS registration data, which fetched the registrar, the creation date from 2009, and the owning organization, LLC KUPISHUZ. At the same time, it performed a subdomain enumeration scan to map out associated hosts and queried VirusTotal to check the domain’s reputation against multiple security vendors.

The system then processed this raw data into a structured intelligence report. It verified that the domain possesses a long-standing, 14-plus year history with no malicious detections on VirusTotal. It also classified the discovered subdomains into operational roles, identifying specific functions such as a main website, a careers portal, internal networking infrastructure, an order tracking portal, and a Single Sign-On authentication platform.

Now, let’s test the email module.

This tool initiated its workflow by running an email enumeration scan using a utility called Holehe, checking the address across 121 websites. This initial check successfully verified active account registrations on Amazon, Flickr, Gravatar, Office365, and Twitter. During this phase, the tool also attempted to query breach data, paste sites, and search engine footprints, but these background tasks failed.

Following the raw scans, the tool generated a series of pre-configured Google dork links targeted at finding the email or username on LinkedIn, Twitter, and Facebook. The system then compiled these results into an Investigation Summary, detailing the discovered platforms and extracting specific metadata, such as the full name and profile URL linked to the target’s Gravatar account.

Finally, the tool outlined a set of next steps for a manual investigator.

Now, let’s run automated open-source intelligence investigation on the specific IP address.

The single successful data extraction came exclusively from the VirusTotal module. This integration successfully returned infrastructure information revealing that the IP address belongs to a network block managed by Senko Digital LLC, which operates as a hosting or virtual private server provider located in Germany. More importantly, the tool retrieved threat assessment telemetry showing that twelve distinct security engines explicitly flagged this specific IP address as malicious, while one categorized it as suspicious, forty-six marked it clean, and thirty-two left it undetected.

Based entirely on this VirusTotal telemetry, the tool synthesized the findings into a security alert status. It concluded that the infrastructure carries a high risk because it is hosted by a VPS provider commonly leveraged for anonymity and possesses a high detection rate across reputable security vendors.

Summary

OSINT remains one of the most high-leverage skills in the cybersecurity field, and tools like OpenOSINT that bring AI-driven automation to the reconnaissance phase will only become more effective and beginner-friendly. If you want to develop your OSINT skills from first principles alongside hands-on tool training, make sure to check out the OSINT Training and join the growing community of intelligence practitioners.

The post Artificial Intelligence (AI) in Cybersecurity, Part 22: Grounding OpenOSINT with Real Tool Execution to Prevent AI Hallucinations first appeared on Hackers Arise.