Enhancing Technology Fingerprinting Through Human-Generated OSINT: A Comparative Study Against Tool-Only Reconnaissance

Abstract

Technology fingerprinting, the identification of software frameworks, cloud platforms, programming languages, and infrastructure components used by an organization, is a foundational stage of cybersecurity reconnaissance. Automated scanning tools such as Nmap, WhatWeb, and Subfinder are widely used for this purpose. However, these tools share a structural limitation: they primarily detect technologies that produce externally observable signals at the network perimeter, while application-layer frameworks, backend infrastructure, and internal development tooling may remain invisible to tool-based reconnaissance.This thesis investigates whether human-generated open-source intelligence (OSINT), specifically job postings, LinkedIn employee profiles, and GitHub public repositories, can serve as a complementary signal class for improving technology fingerprinting. An empirical study was conducted across twelve purposively selected organizations. Three integration methods were designed and evaluated: a union-based model for maximum recall, a source-strength weighted model using empirically derived reliability values, and a rule-based evidence-tier model requiring no manually assigned numeric scores. Results show that the average Jaccard similarity between tool-detected and OSINT-detected technology sets is 0.005, with zero overlap in ten of twelve organizations. This confirms that the two signal classes are largely complementary rather than redundant. Human-generated OSINT contributed 857 organization-level detections absent from the tool-only baseline, representing an average coverage gain of 94.1%. The dominant OSINT-only categories were programming languages at 34.66% and application frameworks at 17.74%. All three integration methods produced substantially richer fingerprints than tool-only reconnaissance, with integration coverage gains ranging from 53.85% to 96.35%. Only five technologies across the full dataset achieved cross-source validation between tools and OSINT. These findings demonstrate that human-generated OSINT provides a quantifiably valuable complement to active scanning in technology fingerprinting workflows.