Building on the intelligence cycle introduced in the foundations lesson, raw OSINT without a framework is just noise. Structured frameworks like the OSINT Framework (osintframework.com) and Trace Labs' Missing Persons workflow provide a tree-based hierarchy that guides analysts from broad domain searches down to granular metadata extraction. These frameworks transform passive recon from a guessing game into a repeatable scientific process.
The 'Sock Puppet' Methodology: Before querying social media or forums that might log visitors, always operate under a managed false identity (Sock Puppet). This account should have a realistic backstory, aged history, and dedicated non-attributable infrastructure. Direct access from your personal account burns your operational cover.
Start at the root node—the domain name. From here, branch into sub-domains, IP ranges, ASNs, email addresses, employee names, leaked documents, and social profiles. Every piece of data is a 'pivot point'. A single employee's Instagram post might reveal their email signature format; that format then seeds a Google dork to find internal documents.
Trace Labs, known for crowdsourced missing persons OSINT, maintains a specialized Kali-based VM. This distro bundles hundreds of tools categorized strictly by data type. Instead of hunting for tools, analysts query the category. If you need to analyze an image, the 'Multimedia' folder presents ExifTool, Foremost, and Ghiro. If you need to map a social network, Twint and Sherlock are pre-configured.
⚠️ Ethical Usage: Running Sherlock against a username scrapes public-facing social APIs, but rate-limiting can cause IP blacklisting. Never run this outside the scope of an authorized test. For Blue Team exercises, use it to map your own CEO's exposed attack surface.
Assume you found an employee's Twitter handle via Sherlock. Pivot immediately: search for this handle on Bug Bounty platforms (HackerOne, Bugcrowd) to see if they write code. Search Pastebin for their email. Every pivot exposes a new layer of the organization's shadow infrastructure. This methodology ensures you didn't just collect data; you collected relationship data.
💡 Automation vs. Analysis: Tools automate collection, not analysis. Running Maltego transforms generates massive graphs. Spend 70% of your time manually correlating nodes in the graph, not running more transforms.
Verify exercises to earn ★ 150 XP and unlock next lab level.