OSINT
Index of all OSINT pages - open source intelligence, Google dorking, geolocation, and metadata.
OSINT (Open Source Intelligence)
OSINT challenges ask you to find information using only publicly available sources - social media, search engines, domain records, image metadata, and public databases. No hacking required - just smart research.
All OSINT techniques on this wiki are intended for CTF competition use and authorized research only. Never apply these methods against real individuals or organizations without explicit permission. Unauthorized OSINT against private persons may violate privacy laws depending on your jurisdiction.
External link status: Some external services (crt.sh, InVID, certain scraping tools) may be rate-limited or intermittently unavailable - see the per-page notes for known issues and suggested alternatives.
Pages in This Section
| Page | Difficulty | Description |
|---|---|---|
| Google Dorking | Beginner | Advanced search operators |
| Social Media OSINT | Beginner | Twitter, GitHub, Reddit, Instagram |
| Image OSINT | Beginner | Reverse image search, EXIF data |
| Geolocation | Intermediate | Pinpoint photo locations |
| Domain Recon | Beginner | DNS, WHOIS, subdomain enumeration |
| Username Enumeration | Beginner | Find accounts across platforms |
| Metadata OSINT | Beginner | Extract intelligence from file metadata |
OSINT Investigation Framework
OSINT Methodology
Define the Target
Identify what you have: a name, image, domain, username, email, or phone number. The starting artifact determines your first tools.
Passive Collection
Gather intelligence without touching target systems directly - Google dorking, WHOIS, crt.sh, Wayback Machine, social media profiles.
Active Enumeration
Query systems more directly - DNS lookups, subdomain brute-forcing, running Sherlock/Maigret, port scanning.
Analyze & Cross-Reference
Correlate findings across sources. A username found on GitHub may link to an email; an email links to breach data; a profile photo links to other platforms.
Pivot & Iterate
Each new data point is a new starting artifact. Email → LinkedIn → GitHub → commits → real name → Google → flag.
Report / Submit
Extract the flag or required answer. Document the chain of evidence for writeups.
Starting Point by Artifact
Given: A name/alias
→ Google: "name" site:twitter.com OR github.com OR linkedin.com
→ Sherlock: search 400+ platforms
→ Check GitHub commits for emailTools Quick Reference
Last updated on