OSINT Methodology — Labs & Discussion

Rules for every lab: passive techniques only unless the lab says otherwise; only approved targets (yourself, consenting classmates, instructor-provided or instructor-owned targets, purpose-built practice sites); don’t share findings about real people outside class.

Templates referenced below are in 3.4-planning-an-investigation.md.

Lab 1: Company Recon on a Sanctioned Target

• Objective: Run a full OSINT cycle, from scope sheet to findings table, against an approved organization target.
• Time: 75–90 minutes (plus 15 minutes debrief) / Difficulty: Intermediate
• Setup / what the instructor prepares:
• An approved target. Options, from easiest to most realistic:
  1. A fictional company the instructor built: a simple website on an instructor-owned domain with a team page, a careers page with a job posting that names technologies, a couple of PDFs with author metadata left in, a public code repo with a fake “leaked” config file, and a few subdomains with TLS certificates (so they appear in Certificate Transparency logs)
  2. An instructor-owned domain with real DNS records and certificates
  3. A purpose-built practice target from an OSINT training platform
• A written “client request” and a one-page rules of engagement (passive + semi-passive only; no contacting “employees”; no logging in)
• A “similar-name decoy” mentioned somewhere (e.g., a different fictional company with a near-identical name) to test scope discipline
• Steps:
  1. In teams of 2–3, read the client request and fill out the Scope Sheet (Template A). Instructor checks it before anyone searches.
  2. Write 3–5 Intelligence Requirements (Template B) with “done when” rules and time boxes.
  3. Build a Collection Plan (Template C) and tick through the Source Checklist (Template D).
  4. Collect. Keep the Pivot Log (Template E), Parking Lot (Template F), and Time Budget (Template G) as you go.
  5. Process: de-duplicate, normalize, tag each item with its requirement.
  6. Write a Findings table (Template H) with confidence levels.
  7. Flag anything that would require an “immediate notice” to the client.
• Deliverable: One markdown document containing all completed templates, plus a 3-sentence “analytic judgment” for the client.
• Debrief questions:
• Which requirement took longest, and why?
• Did anyone fall for the similar-name decoy? How did you catch it?
• What went into your parking lot? Was anything there actually out of scope?
• Which findings were “Likely” instead of “Confirmed,” and what would confirm them?
• Which of your steps were semi-passive rather than fully passive?

Lab 2: Pivot Chain Exercise

• Objective: Practice following, documenting, and judging a chain of pivots, including dead ends and false matches.
• Time: 45 minutes / Difficulty: Beginner–Intermediate
• Setup / what the instructor prepares (pick one version):
• Offline “pivot cards” version (no internet needed): Print 15–25 cards. Each card represents a search result for a fictional persona or company: a profile page, a document’s metadata, a DNS record, a photo with a caption, a forum post. Each card contains one or more selectors that lead to other cards. Include:
  • At least one dead end (a selector that leads nowhere)
  • At least one false match (same username, clearly different person: different country, language, and interests)
  • At least one weak link that only becomes believable with a second, independent card
  • A final “answer” card (e.g., which conference the fictional IT admin spoke at, revealing an internal tool name)
• Online version: A trail of instructor-created accounts and pages for a fictional persona, all controlled by the instructor, or an instructor-approved OSINT training challenge.
• Steps:
  1. Start from the single selector the instructor provides (e.g., a company domain or a username).
  2. For every pivot, fill in a row of the Pivot Log: from, method, to, confidence, in scope?
  3. Draw the chain as a diagram (paper, whiteboard, diagrams.net, or a link analysis tool). Label each edge with its pivot number and confidence.
  4. Mark dead ends and false matches on the diagram with the reason you rejected them.
  5. State the final answer and its overall confidence, remembering that a chain is only as strong as its weakest link.
• Deliverable: Completed pivot log + labeled diagram + final answer with confidence.
• Debrief questions:
• Where did the chain branch? How did you choose which branch to follow?
• Which match did you reject, and what evidence convinced you?
• Which link was weakest? Did it lower your overall confidence?
• If this persona were a real private individual, which pivots would have been out of scope for an organizational engagement?

Lab 3: Requirements Workshop (tabletop, no computers)

• Objective: Turn vague requests into specific, answerable, bounded intelligence requirements.
• Time: 25 minutes / Difficulty: Beginner
• Setup / what the instructor prepares: 4–6 vague request cards, for example:
• “Find out everything about our competitor.”
• “Is this domain dangerous?”
• “Our CEO wants to know what hackers can see about us.”
• “Check out the new vendor before we sign the contract.”
• “Someone posted a video claiming to be from our warehouse. Is it real?”
• Steps:
  1. Each team picks two cards.
  2. For each, write: the decision the requester is trying to make, 3–4 intelligence requirements, a “done when” rule for each, and at least two scope exclusions.
  3. Swap with another team and critique: Is each requirement specific? Answerable with open sources? Bounded?
• Deliverable: Two completed requirement tables (Template B).
• Debrief questions:
• Which vague request was hardest to turn into requirements?
• Did any request need clarification from the requester before you could scope it?
• Did any request raise legal or ethical concerns (see Module 2)?

Lab 4: Passive, Semi-Passive, or Active? (sorting + ATT&CK mapping)

• Objective: Classify recon activities by how they touch the target and map them to MITRE ATT&CK Reconnaissance techniques.
• Time: 20 minutes / Difficulty: Beginner
• Setup / what the instructor prepares: 15–20 activity cards, e.g., “search Certificate Transparency logs,” “browse the careers page,” “run a port scan,” “request a DNS zone transfer,” “look up WHOIS,” “email the help desk pretending to be a new hire,” “search a scan database for the company’s IP range,” “view an archived copy of the website,” “brute force web directories,” “ask a public AI chatbot about the company.” Plus the TA0043 technique table from 3.3-passive-vs-active-recon.md.
• Steps:
  1. Sort each card into Passive / Semi-passive / Active.
  2. For each card, write whether it needs explicit authorization.
  3. Label each card with the best-matching ATT&CK technique ID.
• Deliverable: Sorted, labeled card set (or a table).
• Debrief questions:
• Which cards caused disagreement? Why?
• Which “passive” activities can still alert a person (not the organization)?
• How would a defender detect the active ones?

Discussion Questions

1. Why do you think planning is the most commonly skipped phase of the OSINT cycle? What goes wrong when it’s skipped?
2. A client asks you to “find everything” about their company. What questions do you ask before you start?
3. You’re 40 minutes into a 45-minute time box and you’ve found a promising lead that doesn’t answer any requirement. What do you do?
4. Two accounts share a username and a profile photo. Is that enough to say they belong to the same person? What else would you want?
5. Your pivot chain goes: company domain → employee name → personal photo account → family member’s account. At which step should you have stopped for an organizational engagement, and why?
6. A scan search engine shows a remote desktop service exposed on a client IP, but the data is five weeks old. How do you report it? What would confirm it, and who is allowed to do that?
7. Is browsing a target’s public website “passive”? Argue both sides.
8. During passive recon you find a working-looking API key in a public repo. What do you do, and what do you not do?
9. How would a defender use the MITRE ATT&CK Reconnaissance techniques list?
10. Automated tools can pivot hundreds of times in seconds. What are the risks of trusting their output, and how do you manage them?