OSINT Learning Center

What is OSINT?

Open Source Intelligence is the collection and analysis of information from publicly available sources. Unlike traditional intelligence, OSINT doesn't require hacking or unauthorized access.

Passive vs Active Recon

Passive recon doesn't interact with the target directly — searching public databases, social media. Active recon does — like port scanning. Learn when to use each approach.

Legal Considerations

Understanding privacy laws, computer fraud acts, and ethical guidelines is essential before any investigation. Different countries have different rules — learn them.

OSINT Lifecycle

Planning → Collection → Processing → Analysis → Dissemination → Feedback. Understanding this framework makes investigations more systematic and effective.

OpSec for Investigators

Protecting yourself during investigations — burner accounts, VPNs, Tor, virtual machines, and avoiding attribution back to yourself.

Building Investigation Notes

Maintaining organized, timestamped notes with source citations. Learn tools like CherryTree, Obsidian, and Maltego for structured documentation.

Complete Beginner Roadmap

1. 1.Learn OSINT fundamentals
2. 2.Master Google dorking
3. 3.Understand social media platforms
4. 4.Try username enumeration with Sherlock
5. 5.Practice email investigation
6. 6.Complete beginner CTFs
7. 7.Build first investigation report

Social Media OSINT Path

1. 1.Platform-specific search operators
2. 2.Reverse image search mastery
3. 3.Username cross-platform searching
4. 4.Metadata extraction from images
5. 5.Network mapping with Maltego
6. 6.Open-source social media scrapers

Technical OSINT Path

1. 1.DNS fundamentals
2. 2.Shodan and Censys queries
3. 3.Certificate transparency
4. 4.Network scanning basics
5. 5.Subdomain enumeration
6. 6.Vulnerability correlation
7. 7.API usage for OSINT

• ☐Check with Sherlock
• ☐Check with Maigret
• ☐Use WhatsMyName.app
• ☐Reverse image search profile photo
• ☐Check for linked email accounts
• ☐Search for username on paste sites
• ☐Check for name variations and typos

• ☐Check HaveIBeenPwned
• ☐Use Holehe for account check
• ☐Run EmailRep.io reputation check
• ☐Check email in IntelX
• ☐Investigate email domain WHOIS
• ☐Search email on Google/Bing
• ☐Check dark web paste sites

• ☐WHOIS lookup
• ☐DNS record analysis (A/MX/TXT/NS)
• ☐Subdomain enumeration with Subfinder
• ☐SSL certificate search (crt.sh)
• ☐Email harvesting with theHarvester
• ☐VirusTotal reputation check
• ☐Shodan infrastructure scan