Book
Black Hat Python, 2nd Edition
Justin Seitz and Tim Arnold, No Starch Press
Not an OSINT book, but the Python book analysts reach for when spreadsheets stop scaling. Sniffers, scrapers, and tooling written in Python 3, from the author who once ran the Automating OSINT course.
Black Hat Python teaches offensive tooling: networking, sniffers, Scapy, web hackery, Burp extensions, command and control, trojans, exfiltration, privilege escalation, and memory forensics. The web chapter and the general habit of writing small, reliable tools are what transfer to OSINT. Justin Seitz's old Automating OSINT course site is parked; this is the durable text.
Worth it if
- You already know basic Python and want to write collection and parsing tools
- You keep doing the same pivot by hand and want it scripted
- You work in security and want the offensive context too
Skip it if
- You want to learn OSINT; there is no collection, verification, or analysis content
- You do not know Python at all; start with a general Python book
- You expect complete, production-ready exploits; reviewers note many are deliberately incomplete
What is inside
- 01
Chapters 1 to 4: Environment and networking
Setting up Python, basic networking tools, writing a sniffer, and owning the network with Scapy.
- 02
Chapter 5: Web hackery
Scraping and interacting with web applications, the chapter closest to OSINT work.
- 03
Chapters 6 to 9: Tooling
Extending Burp, GitHub command and control, trojaning tasks on Windows, and exfiltration.
- 04
Chapters 10 to 11: Escalation and forensics
Windows privilege escalation and offensive forensics with the Volatility framework, new in this edition.
What you will be able to do
- Write a scraper that collects and parses pages without breaking on the first odd response
- Build small tools that persist results and log what they did
- Read other people's OSINT scripts and modify them with confidence
How current it is
The 2021 edition updated everything to Python 3 and added forensics. Reviewers describe it as a polish rather than a rewrite, and note the field moves slowly. Examples that depend on third-party services may need adjusting.
- Updated
- 2nd edition, April 2021
- Maintained
- Updated now and then
How to get the most from it
- 01
Do chapter 5 first, then chapters 1 to 4
If OSINT is the goal, the web chapter pays off immediately and the networking chapters make it sturdier.
- 02
Automate one boring OSINT job
One identifier type, one output format, logged. Expand only when it is boringly reliable.
- 03
Learn the manual pivot first
Automating a bad process scales the bad process.
Strengths
- Teaches habits that outlast any tool
- Short, with working code and errata
- A respected lineage for OSINT automation
Limitations
- Not an OSINT book
- Offensive framing may be irrelevant to investigators
- Assumes intermediate Python
Pair it with
- ReadCoursePaidAdvanced
SANS SEC587: Advanced Open-Source Intelligence
Teaches Python specifically for OSINT collection over a day.
- ReadCourseFree + paidAll levels
My OSINT Training
Has a short course on using existing Python OSINT tools before you write your own.
- ReadBookPaidIntermediate
OSINT Techniques
Where the scripts and VM you will want to extend come from.
FAQ
Questions, answered
What happened to Automating OSINT?
The course site is parked and is not a storefront. This book is the author's durable text; the OSINT-specific course material is no longer sold.
Why list a hacking book under OSINT?
Because it is the book people recommend when an analyst asks how to automate collection, and it is honest to say what it is: a Python tooling book with one directly relevant chapter and many transferable habits.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days