OSINT Basics

Find information about people, organisations, and infrastructure using only public sources — the OSINT mindset and starter toolkit.

The OSINT mindset

OSINT (Open-Source Intelligence) is structured searching. Everything you need is publicly available — the challenge is knowing where to look and how to connect the dots. CTF OSINT challenges give you one piece of information (a name, a photo, a username) and ask you to find another.

Where to search

People and usernames

Google with "firstname lastname" site:linkedin.com or in quotes.
Sherlock — scans 400+ platforms for a username: sherlock username.
WhatsMyName — web UI version.

Photos and locations

Google Lens or TinEye — reverse image search finds where a photo appears online.
Yandex Images — superior for face recognition in reverse search.
Google Maps Street View — match environmental details in a photo to geolocate it.

Domains and infrastructure

whois domain.com — registrant, registrar, dates.
Shodan — internet-connected devices by IP, banner, port.
Censys — certificate and host data.
crt.sh — certificate transparency logs; find all subdomains that have ever had a cert.

Twitter advanced search: from:@handle until:2023-01-01 for old posts.
Wayback Machine — https://web.archive.org/web/*/example.com for cached pages.

Metadata in files

Photos taken on a phone embed GPS coordinates in EXIF data:

exiftool photo.jpg | grep -i GPS

Copy the coordinates into Google Maps.

CTF OSINT workflow

Identify every piece of information given (name, handle, photo, domain).
For each, pick the right tool (username → Sherlock; photo → Lens/Yandex).
Follow each lead one step further — the flag is usually 2-3 hops away.
Document each step; you’ll loop back.