OSINT Sources — Labs & Discussion

Rules for every lab: passive techniques only unless the lab says otherwise; only approved targets (yourself, consenting classmates, instructor-provided or instructor-owned targets, purpose-built practice sites); don’t share findings about real people outside class.

These labs cover all 12 source categories in this module:

#	Category	#	Category
01	Search engines	07	Public records & government data
02	Social media & online communities	08	People-search sites & data brokers
03	Organization-owned sources	09	Images, video & geospatial
04	Code repositories & developer platforms	10	Breach & leak data
05	Domains, DNS & internet infrastructure	11	News, media, academic & genealogy
06	Archives & historical data	12	Curated directories & toolkits

---

Lab 1: Build a Source Map for Company X

• Objective: Plan an investigation by mapping all 12 source categories to a target before collecting anything, and practice judging what each source reveals, who benefits, and what the risks are.
• Time: 45 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• A one-page fictional profile of Company X, for example:
  • Name: Company X, Inc. Domain: companyx.com (placeholder)
  • Mid-size, publicly traded medical device manufacturer, ~2,000 employees, HQ in a mid-size US city
  • Recently acquired a small startup; currently hiring security engineers
  • Sells a Bluetooth-connected home health device and a companion mobile app
  • CEO speaks at industry conferences; engineering team has a public blog
• A blank source map worksheet (table below)
• Steps:
  1. In groups of 3–4, fill in one row per source category (all 12).
  2. For each row, name at least two specific sources from this module’s notes.
  3. Mark each source as Passive, Semi-passive, or Active (see the intro script’s Passive vs. Active section).
  4. Note any legal or ethical flags (ToS, use restrictions, personal data, breach data).
  5. Prioritize: answer the question “How would an attacker build a convincing phishing email to Company X’s finance team?” Pick the five sources you’d check first and justify the order.
  6. Flip it: pick the three sources Company X’s security team should monitor first, and explain why.

Category	Specific sources	What we expect to find about Company X	Attacker use	Defender use	Passive / Semi / Active	Legal / ethical flags
01 Search engines
02 Social media
03 Organization-owned
04 Code repositories
05 Domains/DNS/infrastructure
06 Archives
07 Public records
08 People-search/data brokers
09 Images/video/geospatial
10 Breach & leak data
11 News/academic/genealogy
12 Directories & toolkits

Hints to look for: SEC filings (public company), FCC ID (Bluetooth device), press release about the acquisition, job postings (security tool stack), engineering blog and conference talks (architecture), app store listing (developer info and privacy policy), HIBP domain search (only if you are Company X).
- Deliverable: Completed source map + the two prioritized lists with justifications.
- Debrief questions:
- Which categories gave the attacker the most value for the least effort?
- Which sources did groups disagree on classifying as passive vs. active?
- Which rows had the most legal or ethical flags, and would you need written authorization before touching them?
- How did the “attacker” and “defender” priority lists differ?
- Optional extension: With instructor approval, check your map against a real large public company, collecting organization-level facts only (no individual employees).

---

Lab 2: Public Records Scavenger Hunt

• Objective: Get hands-on with official government and corporate records, and practice citing every finding.
• Time: 45–60 minutes / Difficulty: Beginner–Intermediate
• Setup / what the instructor prepares:
• Choose one large, well-known US public company (and optionally a federal agency or a public university) as the class target.
• Confirm beforehand which items have answers for that target, and swap out any that don’t.
• Scoring sheet with point values.
• Rules specific to this lab:
• Organization-level information only. Where a record names individuals (inventors, donors, litigants other than the company), record the count or topic, not personal details. Executives named in SEC filings are fine to list.
• Don’t pay for anything. Use CourtListener instead of buying PACER documents.
• Every answer needs the source URL and the date/time you retrieved it (practice for Module 7 Documentation).
• Steps (find as many as you can):

#	Item	Suggested source	Points
1	State of incorporation and registered agent	Secretary of State business search	1
2	Number of related entities listed	OpenCorporates	1
3	Three subsidiaries	Latest 10-K (Exhibit 21) on SEC EDGAR	1
4	CEO, CFO, and one board member	10-K or DEF 14A proxy statement	1
5	Two points from the 10-K’s cybersecurity disclosure section	Latest 10-K	2
6	Has the company ever filed an 8-K under Item 1.05? If yes, the date and a one-line summary	EDGAR Full Text Search	2
7	One recent press release about an acquisition, partnership, or executive hire	Wire services (PR Newswire, Business Wire, GlobeNewswire) or company newsroom	1
8	Topic of one patent granted in the last two years (no inventor names)	USPTO Patent Public Search or Google Patents	1
9	Total federal contract/grant dollars in the most recent fiscal year (or “none found”)	USASpending.gov	2
10	One FCC ID for a wireless product and the list of exhibit types available	FCC Equipment Authorization search or fccid.io	2
11	One federal case where the company is a party (case name, court, filing year)	CourtListener	2
12	One historical news article about the company from before 2010	Google News Archive, library databases	2
13	(If target is a nonprofit/university) Number of employees listed as highest compensated	ProPublica Nonprofit Explorer	2

• Deliverable: Completed scavenger sheet with citations and retrieval timestamps.
• Debrief questions:
• Which records were fastest to find? Which were hardest, and why?
• Which findings would help an attacker most? A defender?
• Did any record surprise you by being public at all?
• Where did you have to stop yourself from collecting personal information?

---

Lab 3: Data Broker & Breach Exposure Self-Check (Yourself Only)

• Objective: See firsthand how much data brokers and breaches reveal about an ordinary person, and plan to reduce it.
• Time: 20–30 minutes / Difficulty: Beginner
• Setup / what the instructor prepares:
• A worksheet with the exposure table below.
• A list of opt-out pages for common people-search sites (or point to Module 9).
• An alternative for students who shouldn’t or don’t want to search themselves (for example, students with safety concerns): a pre-made, fictional example report to analyze instead. Participation in the self-search must be optional.
• Rules specific to this lab:
• Search only yourself. Do not search classmates, friends, family, or instructors.
• Use free results only; don’t buy reports.
• Record categories (yes/no), never the actual values, on anything you submit.
• Steps:
  1. Search your own name (and city) on two or three people-search sites.
  2. Check your personal email on Have I Been Pwned. Optionally sign up for “Notify me.”
  3. Check whether your email has a public Gravatar profile.
  4. Search your full name and username in a search engine (quotation marks help).
  5. Fill in the table:

Data type	Found? (Y/N)	Where (site type, not URL)	Accurate? (Y/N/Partly)
Current address
Past addresses
Phone number
Email address
Age / date of birth
Relatives / associates
Photo
Breaches your email appears in (count)

6. Note any errors (merged identities, wrong relatives, stale data).
7. Pick two actions from Module 9 you’ll take (opt-outs, HIBP alerts, changing reused passwords, turning on MFA). California residents: consider the state’s DROP platform.
   - Deliverable: The category-only table plus your two chosen actions (no personal details).
   - Debrief questions:
   - How much was found without paying anything?
   - Were the errors harmless, or could they cause real problems (for example, being confused with someone who has a criminal record)?
   - What would an attacker be able to do with what you found?
   - Why is opting out an ongoing process rather than a one-time fix?

---

Lab 4: OSINT Tool Evaluation

• Objective: Practice judging an unfamiliar tool before trusting it with an investigation.
• Time: 30–40 minutes / Difficulty: Intermediate
• Setup / what the instructor prepares:
• A list of 8–12 candidate tools drawn from OSINT Framework, Bellingcat’s Toolkit, awesome-osint, or Cyber Detective’s collection. Mix actively maintained tools with some that appear abandoned or have changed pricing.
• Copies of the evaluation rubric from 5.12-curated-directories-and-toolkits.md.
• For downloadable tools: a lab VM (don’t install unvetted tools on personal machines).
• Steps:
  1. Each group draws one tool.
  2. Research it without running it against anyone: its website, privacy policy, Terms of Service, GitHub activity, pricing page, and reviews.
  3. If appropriate and safe, test it only on yourself, an instructor-owned domain, or example.com.
  4. Score it on the rubric: maintenance, operator and data handling, OPSEC impact, legality/ToS, cost and limits, verifiable output, and software safety (0–2 each, 14 max).
  5. Decide: Would you use this tool on a paid client engagement? Yes, no, or “only if…”
• Deliverable: Completed scorecard and a 3-minute group presentation with your verdict.
• Debrief questions:
• What was the hardest criterion to evaluate from public information?
• Did any tool’s privacy policy surprise you?
• Did any “free” tool turn out to be limited or paid?
• How often should a team re-check the tools in its kit?

---

Discussion Questions

1. Which is more trustworthy: a court record or a LinkedIn profile? Can you think of a situation where the court record would be misleading?
2. FEC donor data is public, but federal law restricts using it for commercial purposes or soliciting contributions. Why would lawmakers make data public but limit its use? Does this apply to OSINT?
3. Two people-search sites list the same old address for someone. Is that two independent sources? Why or why not?
4. The “ElonJet” account used public flight data. Where is the line between public information and a safety risk? Would your answer change if the aircraft belonged to a private citizen instead of a public figure?
5. A client asks you to use a commercial breach search service that returns plaintext passwords. What would you need in place before agreeing? How would you report what you find?
6. Should face-search engines like PimEyes be legal? Who benefits and who is harmed?
7. You’re researching Company X and find its CEO’s parent’s obituary listing the whole family. Does any of it belong in your report? What if the engagement is a social engineering test?
8. Your university library gives you free access to paid databases. Are there OPSEC or ToS concerns with using your student account for OSINT work?
9. A tool directory lists a tool that has had no updates in three years but “still seems to work.” Would you use it? What could go wrong?
10. Which source category would you check first to learn a company’s email format, and which would you check to confirm it? Why use two?