Key OSINT tools:
Maltego (relationship mapping),
theHarvester (email/domain/host enumeration),
Shodan (internet-exposed device search),
Recon-ng (modular framework),
SpiderFoot (automated OSINT), Google Dorks.
Google Dorks: site:company.com filetype:pdf (find company PDFs), site:company.com inurl:admin (find admin pages), "company.com" ext:sql (find exposed databases). Shodan: org:"Target Corp" port:3389 (find exposed RDP). LinkedIn: company filter + connections + tech stack from job postings.