Reconnaissance and OSINT
Treat open-source intelligence as a pivot loop rather than a search, and know what metadata survives which route.
By the end you can
- Run the pivot loop: enumerate, expand, cross-reference, record
- Predict which metadata survives a given publication route, and check the right thing first
- Narrow an image's location from visible constraints without recognising the place
- Enumerate an organisation's subdomains from certificate transparency rather than by probing
- State where open-source ends and unauthorised access begins
1. Read
OSINT as a method, not a lucky search
Open-source intelligence challenges reward discipline over cleverness. The pivot loop, what metadata actually survives, how to geolocate from an image without recognising the place - and where the line is.
Working a leaked dataset: OSINT on a pile of data
Some OSINT challenges hand you a dump - a CSV, a SQL export, a folder of documents - and a question buried in it. The command-line workflow for turning gigabytes of leaked data into the one record that answers the challenge.
2. Use the tools
In the order they come up while solving. Each opens the workspace tab that runs it.
EXIF metadata viewer
Read EXIF, GPS coordinates, camera details, timestamps, and embedded comments from images - the metadata that answers OSINT challenges.
GPS coordinate converter (DMS, decimal, UTM)
Convert between degrees-minutes-seconds, decimal degrees, and other coordinate notations - for EXIF locations and OSINT challenges.
Timestamp converter (Unix, ISO, FILETIME, HFS+)
Convert between Unix seconds and milliseconds, ISO 8601, local time, and the non-standard epochs used by Windows, macOS, and Flask.
Strings extractor for binaries and blobs
Pull printable ASCII and UTF-16 strings out of any file, filtered by length, with flag-pattern highlighting.
3. Try one now
Generated in your browser and checked in your browser. No account, nothing to download, and a fresh one whenever you want another.
4. Practise on the real thing
Real picoCTF challenges that use these techniques, easiest first. 30 match in total - see the full index.
Checkpoint
Given one photograph with no GPS tag, narrow its location to a city and state which visible constraint eliminated each region you ruled out.
Teaching note
The ethics half is not an aside and should be taught first, not last. OSINT technique transfers directly to real people who did not consent to being investigated, and a class that learns the pivot loop without the line learns half a skill.