🔒

DELIGHT Cybersecurity Workbook Series

OSINT & Cybersecurity

This workbook is restricted to enrolled students. Enter the access code provided by your instructor to continue.

Incorrect code. Please try again.

🔍 DELIGHT Cybersecurity Workbook Series

OSINT & Cybersecurity
Training Workbook

A hands-on learning path from beginner to advanced — self-paced, free tools only

Modules

Lab Exercises

45+

Free Tools

~25h

Total Time

Module 1

Foundations of OSINT

Beginner · ~3.5 hours

Module 2

Digital Footprinting

Beginner · ~4 hours

Module 3

Network & Domain Intel

Intermediate · ~4 hours

Module 4

People & Social Media

Intermediate · ~4 hours

Module 5

Advanced Recon & CTF

Advanced · ~9 hours

Appendix

Tools & Certifications

Reference guide

👤

Module 2

Digital Footprinting

Search usernames, emails, images, and breached credentials

● Beginner — ~4 hours

📌

Practice Target: All labs in this module use yourself as the target — search your own username, email, and images. This is the safest and most educational approach. Never investigate real people without consent.

🛠 Tools You Will Use

Tool	Purpose	URL	Cost
Namechk	Username availability across 100+ platforms	namechk.com	Free
Sherlock	CLI username hunt across social networks	GitHub	Free
HaveIBeenPwned	Check email in known data breaches	haveibeenpwned.com	Free
Google Images	Reverse image search	images.google.com	Free
TinEye	Reverse image search with history	tineye.com	Freemium
IntelTechniques Email	Multi-source email lookup	inteltechniques.com	Free
OSINT Industries	Real-time email/phone/username → linked account lookup	osint.industries	Freemium
Intelligence X	Searches leaks, dark web archives & historical records	intelx.io	Freemium

2.1

Username OSINT — Finding Your Digital Presence

⏱ 30 min ▼

🎯

Objective: Discover which platforms your username appears on using two different tools and compare results.

Go to Namechk.com. Enter one of your common usernames (not your real name, just a handle you use online). Note all platforms where it shows as "taken".

Go to whatsmyname.app — an alternative with more detailed results. Enter the same username.

Visit each found profile URL and verify: does this account actually belong to you, or is someone else using the same username?

Optional — Sherlock (requires Python):

pip install sherlock-project
sherlock yourusername

Sherlock is a command-line tool that searches 300+ sites. Compare results with Namechk.

Record your findings below. Note: which tool found more? Which had fewer false positives?

📝 Findings — Platforms Where Your Username Exists

Ran username search on Namechk
Ran username search on whatsmyname.app
Documented at least 5 platform results
Compared both tools and noted differences

2.2

Email Breach Check & Exposure Analysis

⏱ 20 min ▼

Go to HaveIBeenPwned.com. Enter your personal email address. Note which breaches it appears in.

For each breach listed, click the breach name to read: What data was exposed? (email, password, phone, address?) When did it happen?

Go to IntelTechniques Email Search. Enter your email and note which additional platforms it finds.

Defence reflection: For every breach you found, consider: Have you already changed the password for that service? Do you reuse that password anywhere else?

📝 Breach Analysis Notes

Checked email on HaveIBeenPwned
Documented all breaches and exposed data types
Identified which passwords need changing

2.3

Reverse Image Search — Image Footprinting

⏱ 25 min ▼

⚠️

Privacy tip: Attackers use reverse image search to identify people from profile photos. This lab shows you your own exposure.

Save your profile photo from any social media platform to your computer.

Go to Google Images → click the camera icon → upload your photo. Note all pages where this image appears.

Repeat using TinEye.com. Compare results — TinEye often finds older instances that Google misses.

Try PimEyes.com (free tier limited). This specialises in finding faces across the internet.

Metadata check: Right-click your photo → Properties → Details. Does it contain GPS coordinates, camera model, or date/time? If yes, this metadata is embedded in every copy of this photo you share.

📝 Image Footprint Findings

Ran reverse image search on Google Images
Ran reverse image search on TinEye and compared results
Checked photo metadata (EXIF) for GPS/camera data

2.4

OSINT Industries — Cross-Platform Identity Lookup

⏱ 20 min ▼

ℹ️

About OSINT Industries: A real-time lookup tool — feed it an email, phone number, username, or crypto wallet address and it shows which online accounts (Instagram, Telegram, CashApp, and more) are tied to it. The free tier limits how many lookups you get, so use it deliberately.

Create a free account at osint.industries using your investigation-only email from Lab 1.2.

Run a lookup on your own email address. Note every platform it returns — does it match what you already found manually in Lab 2.1/2.2?

Check whether it surfaces anything Namechk, WhatsMyName, or HaveIBeenPwned missed (e.g. account creation dates, profile photos, last-active timestamps).

Reflect: this tool aggregates several lookups into one pass. What's the trade-off of using an aggregator like this versus checking each source manually?

📝 OSINT Industries — Findings vs Manual Search

Created a free OSINT Industries account
Ran a lookup and documented returned accounts
Compared results against Lab 2.1/2.2 findings

2.5

Intelligence X — Deep & Dark Web Search

⏱ 30 min ▼

⚠️

Scope reminder: Intelligence X indexes data from the dark web and leak sites. You are only ever searching your own identifiers in this lab — never search or attempt to access another person's data, and never attempt to browse the dark web directly through this tool.

Go to intelx.io and create a free account.

Search your own email address. Intelligence X will show you which leak databases, pastes, or historical web archives mention it.

Compare the result set to what HaveIBeenPwned showed you in Lab 2.2. Intelligence X often surfaces raw paste data and historical snapshots that breach-checkers don't.

Note the free-tier limits you hit (search count, result depth) — this is typical of "freemium" deep-search tools and important to know before relying on one professionally.

📝 Intelligence X — Search Log

Created a free Intelligence X account
Searched own email and documented sources returned
Compared results to HaveIBeenPwned (Lab 2.2)

🌐

Module 3

Network & Domain Intelligence

Investigate domains, IPs, subdomains, and internet-connected devices

● Intermediate — ~4 hours

⚠️

Important: Only investigate domains you own or have explicit permission to test. For practice, use dedicated training targets like scanme.nmap.org (maintained by Nmap for testing) or use your own domains.

🛠 Tools You Will Use

Tool	Purpose	URL	Cost
Shodan	Search engine for internet-connected devices	shodan.io	Freemium
WHOIS	Domain registration info	domaintools.com	Free
DNSDumpster	DNS records and subdomain enumeration	dnsdumpster.com	Free
Censys	Internet-wide scan data, certificates	censys.io	Freemium
VirusTotal	Scan URLs/IPs/files for malware	virustotal.com	Free
Wayback Machine	View old versions of websites	web.archive.org	Free

3.1

WHOIS & DNS Investigation

⏱ 40 min ▼

🎯

Practice Target: Use example.com for WHOIS practice — it is a public domain maintained by IANA specifically for documentation purposes.

Go to whois.domaintools.com. Search for example.com. Note: registrar, creation date, expiry date, name servers, and whether WHOIS privacy is enabled.

Go to DNSDumpster.com. Search for example.com. This reveals: A records (IP addresses), MX records (mail servers), TXT records, and subdomains.

Using the Command Line (Windows PowerShell, Mac/Linux Terminal):

# On Windows:
nslookup example.com
nslookup -type=MX example.com
nslookup -type=TXT example.com

# On Mac/Linux:
dig example.com
dig MX example.com
dig TXT example.com

Go to web.archive.org and search example.com. How far back does the history go? What has changed?

Record all discovered information in the notes below. This is the format a real OSINT report would use.

📝 OSINT Report — example.com

Completed WHOIS lookup and documented registrar info
Ran DNS dump and found MX/TXT/A records
Used command-line DNS tools (nslookup or dig)
Checked Wayback Machine history

3.2

Shodan — Exploring Exposed Devices

⏱ 45 min ▼

ℹ️

About Shodan: Shodan continuously scans the entire internet and indexes what it finds — open ports, services, software versions, and more. Create a free account at shodan.io for basic access.

Create a free account at shodan.io. The free tier gives you 2 search pages.

Try these example searches to understand what Shodan can find:

# Find webcams running on default HTTP
webcamxp

# Find devices running Apache in a country
apache country:"NG"

# Find default login pages
"default password" port:80

Click on any result and study the device record: What port is open? What software version? Is it vulnerable? Shodan often links to known CVEs (vulnerabilities).

Do NOT attempt to connect to or interact with any device you find on Shodan. Viewing the record is passive and legal. Connecting is not.

Reflect: Why is it dangerous that these devices are publicly visible? Write your analysis below.

📝 Shodan Analysis — What You Found

Created a free Shodan account
Ran at least 2 example searches
Reviewed a device record for software version/CVE info

3.3

Google Dorking — Advanced Search Techniques

⏱ 40 min ▼

🔍

Google Dorking uses advanced Google search operators to find information that isn't easily visible through normal searches — exposed files, login pages, email lists, and more.

Essential Google Operators

Operator	Function	Example
`site:`	Search only within a domain	`site:example.com login`
`filetype:`	Find specific file types	`filetype:pdf "confidential"`
`intitle:`	Words in page title	`intitle:"index of" passwords`
`inurl:`	Words in URL	`inurl:admin panel`
`cache:`	Google's cached version	`cache:example.com`
`"exact phrase"`	Search exact string	`"error: password incorrect"`

Open Google and practice each operator above using your own website or school domain as the target. For example: site:youruniversity.edu filetype:pdf

Try this safe search to see exposed directory listings:

intitle:"index of" "parent directory"

These are web server folders left open by accident — a common misconfiguration.

Visit Google Hacking Database (GHDB) on Exploit-DB. Browse categories — this is a public repository of Google dorks for educational research.

Create your own dork that finds PDFs containing your university/school name:

site:youruniversitydomain.edu filetype:pdf "student"

📝 Google Dorks You Discovered

Practiced all 6 essential Google operators
Browsed the Google Hacking Database (GHDB)
Created and documented at least 3 original dorks

🏆

Module 5

Advanced Recon & CTF Challenges

Automated OSINT tools, Maltego, and hands-on CTF practice

● Advanced — ~9 hours

🛠 Tools You Will Use

Tool	Purpose	URL	Cost
theHarvester	CLI — automates email, subdomain, employee discovery	GitHub	Free
Maltego CE	Visual link analysis across people, domains, IPs	maltego.com	Freemium
SpiderFoot	Automated OSINT collection from 100+ sources	GitHub	Free
Recon-ng	Modular CLI recon framework	GitHub	Free
DataSploit	Aggregates OSINT on companies, people, phones, crypto	GitHub	Free
OSRFramework	Combines OSINT sources — web, API & CLI output	GitHub	Free
GasMask	Search-engine-based target info gathering	GitHub	Free

5.1

theHarvester — Automated Email & Domain Recon

⏱ 45 min ▼

ℹ️

theHarvester is a Python tool that automates gathering emails, subdomains, hosts, and employee names from public sources. It comes pre-installed on Kali Linux.

Install (if not on Kali):

pip install theHarvester
# OR clone from GitHub:
git clone https://github.com/laramies/theHarvester
cd theHarvester
pip install -r requirements/base.txt

Basic usage — search a domain:

# Search for emails/subdomains using multiple sources
theHarvester -d example.com -l 500 -b all

# Use specific source only
theHarvester -d example.com -l 100 -b google

# Save output to HTML report
theHarvester -d example.com -l 500 -b all -f report

Run theHarvester against example.com or your own domain. Document all findings: email addresses found, subdomains discovered, IP ranges.

Compare theHarvester results with your manual DNSDumpster results from Module 3. Which found more? What did each miss?

📝 theHarvester Output Summary

Installed theHarvester
Ran a scan against a domain and documented results
Compared results against manual DNSDumpster findings (Module 3)

5.2

Maltego CE — Visual Link Analysis

⏱ 50 min ▼

🗺️

Why Maltego is different: Instead of a list of search results, Maltego builds a visual graph. You start with one "entity" (a domain, email, person) and run "transforms" that pull in related entities, drawing lines between everything that connects. This is how professional investigators map relationships at scale.

Download Maltego Community Edition (free). Registration is required — use your investigation email.

Start a new graph and drag a Domain entity onto the canvas. Type in a domain you've already researched (e.g. example.com or your own).

Right-click the entity and run the "To DNS Name" and "To IP Address" transforms. Watch new connected nodes appear automatically.

Add an Email Address entity for an address you control, and run available transforms on it too. Notice how Maltego starts drawing lines between previously separate nodes if they share infrastructure.

Compare this graph to your text-based notes from Lab 3.1 (WHOIS/DNS). Which format made the relationships easier to spot — the spreadsheet-style notes or the visual graph?

📝 Maltego Graph — Observations

Installed Maltego CE and created a graph
Ran at least 2 transforms on a domain entity
Added a second entity type and observed new links

5.3

SpiderFoot — Automated OSINT Collection

⏱ 40 min ▼

🕸️

About SpiderFoot: A self-hosted automation engine — point it at a domain, IP, or email and it queries 100+ data sources for you, then visualises how everything connects. Think of it as automating everything you did manually in Modules 2 and 3.

Install SpiderFoot:

git clone https://github.com/smicallef/spiderfoot.git
cd spiderfoot
pip install -r requirements.txt
python3 sf.py -l 127.0.0.1:5001

Then open http://127.0.0.1:5001 in your browser.

Create a new scan against a domain you've already researched. Choose the "Footprint" scan template for a balanced, non-intrusive scan.

Let the scan run, then explore the results tabs: Browse (raw findings), Graph (visual map), and Correlations (SpiderFoot's automatic risk flags).

Compare total findings against your manual Module 3 work (WHOIS, DNSDumpster, theHarvester). How much time did automation save? What did it find that you missed manually?

📝 SpiderFoot Scan Summary

Installed SpiderFoot and ran a Footprint scan
Reviewed the Graph and Correlations tabs
Compared automated results to earlier manual labs

5.4

Recon-ng — CLI Modular Reconnaissance

⏱ 35 min ▼

⌨️

About Recon-ng: A modular CLI framework with a Metasploit-style workflow — you load "modules" into a "workspace" and chain them together. Good for building genuine command-line comfort before tackling pentesting tools later in your career.

Install and launch:

pip install recon-ng
recon-ng

Create a workspace and load a domain module:

[recon-ng][default] > workspaces create mywork
[recon-ng][mywork] > marketplace install recon/domains-hosts/hackertarget
[recon-ng][mywork] > modules load recon/domains-hosts/hackertarget
[recon-ng][mywork][hackertarget] > options set SOURCE example.com
[recon-ng][mywork][hackertarget] > run

View what was collected: show hosts. Try loading one more module from the marketplace (e.g. a contacts or companies module) and chain it onto the same workspace.

Reflect: how does Recon-ng's "load module → set options → run" pattern compare to the menu-driven SpiderFoot interface from Lab 5.3? Which would you reach for in a script vs. an exploratory scan?

📝 Recon-ng Session Log

Installed Recon-ng and created a workspace
Loaded and ran at least one module
Chained a second module into the same workspace

5.5

DataSploit — Multi-Target Aggregated Recon

⏱ 30 min ▼

⚠️

Note: DataSploit is an older project with less active maintenance than SpiderFoot or Recon-ng. Expect to troubleshoot Python dependency issues — that's a normal part of working with community open-source tools, and good practice for your career.

Clone and set up in a virtual environment to avoid dependency conflicts:

git clone https://github.com/DataSploit/datasploit.git
cd datasploit
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Run a domain-focused scan against a domain you've already profiled in earlier modules, and let it aggregate results from multiple sources in one pass.

Review the output format options (JSON / text). Note one advantage of getting JSON output if you wanted to feed results into another tool or script.

Document any setup problems you hit and how you solved them — this troubleshooting log is itself a useful skill record.

📝 DataSploit — Setup & Findings

Successfully installed DataSploit in a virtual environment
Ran a scan and reviewed aggregated output

5.6

OSRFramework — Combined Username & Email Search

⏱ 25 min ▼

🔗

About OSRFramework: Bundles several small OSINT utilities (username checking, DNS lookups, metadata extraction) behind one consistent CLI/API/web interface — useful once you've outgrown one-off tools like Namechk and want scriptable output.

Install via pip:

pip install osrframework

Run a username search across its supported platform list:

usufy -n yourusername -o csv -f results.csv

Open the generated CSV. Compare the platform list and hit-rate against Sherlock (Lab 2.1) — OSRFramework and Sherlock check overlapping but not identical platform lists.

Try the mailfy module on a domain to enumerate likely email address formats. Note: this only checks plausible addresses, it does not confirm they're active.

📝 OSRFramework — Results Log

Installed OSRFramework and ran usufy
Compared results against Sherlock from Lab 2.1

5.7

GasMask — Search-Engine-Powered Target Profiling

⏱ 25 min ▼

🔎

About GasMask: Automates the kind of search-engine-based discovery you did manually in Lab 3.3 (Google Dorking) — but runs it across Bing, Google, and Yandex simultaneously, plus pulls from GitHub, YouTube, and Twitter/X.

Clone and install:

git clone https://github.com/twelvesec/gasmask.git
cd gasmask
pip install -r requirements.txt
python3 gasmask.py

Inside the GasMask shell, target a domain you've researched before:

set DOMAIN example.com
search

Review what came back from each search engine. Note which engine (Google, Bing, or Yandex) surfaced results the others didn't — Yandex in particular often indexes differently from Western search engines.

Try the GitHub search feature against your domain or organisation name — exposed API keys and internal config files in public repos are a real, common finding in professional engagements.

📝 GasMask — Multi-Engine Results

Installed GasMask and ran a domain search
Compared results across at least 2 search engines
Ran the GitHub search module

5.8

PhoneInfoga — Phone Number OSINT

⏱ 30 min ▼

📱

About PhoneInfoga: An open-source CLI tool that footprints a phone number. It uses number-formatting libraries to identify carrier, line type (mobile/VoIP/landline), and country, then aggregates search-engine and OSINT-API results to surface where that number appears publicly online. It has no database of its own — everything is looked up live.

Install PhoneInfoga:

# Via pip
pip install phoneinfoga

# OR via Docker (no local Python setup needed)
docker pull sundowndev/phoneinfoga:latest

Run a basic scan on your own number (E.164 format, e.g. +234...):

# CLI mode
phoneinfoga scan -n "+15555555555"

# OR launch the web UI for an interactive view
docker run --rm -p 8080:8080 sundowndev/phoneinfoga:latest serve -p 8080 --bind 0.0.0.0

Review the output: carrier name, line type, country/region, and any OSINT footprint results (search engine hits, social media matches). Note which fields came from number-formatting logic vs. which came from live web lookups.

Compare this against a lookup on a service like Truecaller (no account needed to compare concepts). Reflect: Truecaller's data comes from crowdsourced contact books, while PhoneInfoga's comes from live public search — which is more current? Which is more invasive?

📝 PhoneInfoga — Scan Results

Installed PhoneInfoga (pip or Docker)
Ran a scan against your own number
Documented carrier/line-type/OSINT footprint results
Compared crowdsourced (Truecaller-style) vs. live-search (PhoneInfoga) approaches

5.9

TryHackMe — OSINT CTF Rooms

⏱ 2 hours ▼

🏆

TryHackMe offers guided, legal CTF challenges in a browser-based environment. The following rooms are free and perfect for OSINT practice.

Recommended Rooms (in order)

Room	Focus	Difficulty	Link
OhSINT	Classic intro OSINT room — find info hidden in a photo	🟢 Easy	Link →
Searchlight — OSINT	Social media, username, image OSINT	🟢 Easy	Link →
Google Dorking	Practical Google dork challenges	🟢 Easy	Link →
OSINT Fundamentals	Framework, tools, methodology	🟡 Medium	Link →
WebOSINT	Domain, hosting, historical data	🟡 Medium	Link →
Sakura Room	Full investigation — username, email, crypto, geolocation	🟡 Medium	Link →

📝 CTF Progress Tracker

Created TryHackMe account
Completed OhSINT room
Completed Searchlight room
Completed at least 3 rooms total
Attempted Sakura Room (the hardest)

5.10

Capstone — Write a Full OSINT Report

⏱ 90 min ▼

🏁

Final Challenge: Choose a large public company (e.g. a public telecom, bank, or university). Using only passive techniques, write a professional OSINT report. This simulates what a red team would produce before a penetration test.

Report Template

OSINT REPORT
============
Target Organisation:
Report Date:
Investigator:

1. EXECUTIVE SUMMARY
   Brief overview of what was found and the overall risk level.

2. DOMAIN & INFRASTRUCTURE
   - Domain registrar and registration date
   - IP addresses and hosting provider
   - Subdomains discovered
   - Open ports (Shodan findings)
   - Technologies in use (Wappalyzer, BuiltWith)

3. EMPLOYEE INTELLIGENCE
   - Key personnel identified (IT/Security roles)
   - Email format discovered (e.g. firstname@company.com)
   - LinkedIn profiles found
   - Breach exposure (HaveIBeenPwned)

4. SOCIAL MEDIA FOOTPRINT
   - Official accounts and follower count
   - Third-party mentions
   - Employee social accounts

5. HISTORICAL DATA
   - Wayback Machine observations
   - Old technology stacks
   - Past incidents (Google: "company name" data breach)

6. RISK ASSESSMENT
   - Critical findings (HIGH)
   - Notable findings (MEDIUM)
   - Informational findings (LOW)

7. RECOMMENDATIONS
   - Specific defensive actions the organisation should take

📝 Your OSINT Report

Selected a public organisation and confirmed passive-only scope
Completed Domain & Infrastructure and Employee Intelligence sections
Completed Social Media Footprint and Historical Data sections
Finished Risk Assessment with HIGH/MEDIUM/LOW findings and actionable Recommendations

📚

Appendix

Tools, Resources & Certifications

Everything you need to continue learning after this workbook

✅

Updated: This table now includes all newly discovered free and freemium platforms. Every tool here can be used with no payment required (freemium = free tier available). Paid-only platforms are listed separately below.

🔧 Complete Free Tool Reference

Category	Tool	What It Does	URL	Cost
Directories & Frameworks
Directory	OSINT Framework	Visual tree of 500+ free OSINT tools by category	osintframework.com	Free
Directory	IntelTechniques	Aggregated search forms by Michael Bazzell (ex-FBI)	inteltechniques.com	Free
Directory	Bellingcat Toolkit ⭐ NEW	500+ tools for journalism, geolocation & verification — Google Sheet	Google Sheet	Free
Username & Identity
Username	Sherlock	CLI tool — hunts username across 300+ social networks	GitHub	Free
Username	Namechk	Username availability across 100+ platforms	namechk.com	Free
Username	WhatsMyName	Username search with verification links — more detailed than Namechk	whatsmyname.app	Free
Email & Breach Data
Email	HaveIBeenPwned	Check email address against known data breaches	haveibeenpwned.com	Free
Email	Hunter.io	Find email addresses tied to a domain	hunter.io	Freemium
Email / Identity	OSINT Industries ⭐ NEW	Real-time lookup — maps email/phone/username to connected accounts across Instagram, Telegram, CashApp & more	osint.industries	Freemium
Domain, DNS & Network
Domain	WHOIS Lookup	Domain registration info — registrar, owner, dates	domaintools.com	Free
Domain	DNSDumpster	DNS records, subdomains, and visual domain mapping	dnsdumpster.com	Free
Domain	Sublist3r	CLI subdomain enumeration tool using multiple sources	GitHub	Free
IP / Devices	Shodan	Search engine for internet-connected devices — ports, services, CVEs	shodan.io	Freemium
IP / Devices	Censys	Internet-wide scan data, TLS certificates, attack surface mapping	censys.io	Freemium
Search Engines & Archives
Web History	Wayback Machine	Historical snapshots of any website going back decades	web.archive.org	Free
Deep Search	Intelligence X ⭐ NEW	Searches leaked databases, dark web archives, and historical records using email/domain/IP/crypto identifiers	intelx.io	Freemium
Vulnerability DB	Google Hacking DB	Public repository of Google dorks for security research	exploit-db.com	Free
Images, Metadata & Geolocation
Images	TinEye	Reverse image search — finds older instances than Google	tineye.com	Freemium
Images	ExifTool	Extract GPS, camera, and timestamp metadata from any file	exiftool.org	Free
Geolocation	GeoGuessr	Game that builds visual geolocation skills (Street View)	geoguessr.com	Freemium
Geolocation	GeoSpy AI	AI-powered image geolocation — upload photo to get location estimate	geospy.ai	Freemium
OSINT Suites (Free / Open Source)
OSINT Suite	Maltego CE	Visual link analysis — maps relationships between people, domains, IPs	maltego.com	Freemium
OSINT Suite	SpiderFoot ⭐ NEW	Automated OSINT collection — scans IPs, domains, emails, usernames from 100+ sources	GitHub	Free
OSINT Suite	Recon-ng ⭐ NEW	Modular CLI recon framework — like Metasploit but for OSINT	GitHub	Free
OSINT Suite	DataSploit ⭐ NEW	Aggregates OSINT on companies, people, phone numbers, and crypto — outputs multiple formats	GitHub	Free
OSINT Suite	OSRFramework ⭐ NEW	Combines multiple OSINT sources — web interface, API, and CLI output	GitHub	Free
OSINT Suite	GasMask ⭐ NEW	Gathers target info from Google, Bing, Yandex, GitHub, YouTube, and Twitter	GitHub	Free
URL, File & Threat Analysis
Threat	VirusTotal	Scan URLs, IPs, domains, and files against 70+ antivirus engines	virustotal.com	Free
Automation	theHarvester	CLI — automates email, subdomain, and employee discovery	GitHub	Free

💳 Paid Platforms — For Later Consultation

These platforms are enterprise-grade or require paid subscriptions. Not needed as a student, but worth knowing for career progression — especially if you move into threat intelligence, law enforcement, or corporate security roles.

ShadowDragon

Paid

Professional OSINT platform with 600+ data sources. Used by law enforcement and intelligence agencies. Offers social media tracking, link analysis, and threat actor monitoring at scale.

shadowdragon.io →

Recorded Future

Paid

Enterprise threat intelligence platform (acquired by Mastercard in 2024). Monitors dark web, technical forums, and threat actor activity. Uses AI/ML for predictive risk scoring. Integrates with SIEMs and SOAR.

recordedfuture.com →

Lampyre

Paid

All-in-one OSINT platform integrating social media, public records, and dark web sources. User-friendly GUI. Positions itself as a faster, more visual alternative to manual investigation workflows.

lampyre.io →

Maltego Pro / Enterprise

Paid

The paid tiers of Maltego unlock full transform limits, commercial data integrations, team collaboration, and API access. The free Community Edition is sufficient for learning, but Pro is the industry standard for professional investigators.

maltego.com →

DeHashed

Paid

Search engine for breach data — billions of records covering email, usernames, IPs, physical addresses, phone numbers. More comprehensive than HaveIBeenPwned but requires a paid subscription for full access.

dehashed.com →

1 TRACE

Paid

Launched 2024. Combines social media, geospatial, cyber, and financial (cryptocurrency) OSINT in one platform. ISO 27001:2022 certified — trusted by governments and law enforcement for cross-discipline investigations.

1trace.com →

Talkwalker / Hootsuite

Paid

AI-powered social media monitoring platform scanning 150M+ websites and 30+ social networks in 187 languages. Used by brands and government agencies for threat monitoring, sentiment analysis, and crisis prediction up to 90 days ahead.

talkwalker.com →

Shodan Pro / Enterprise

Paid

Shodan's paid tiers unlock full search results (free is limited to 2 pages), continuous monitoring alerts, full historical data, and API access for automation. Essential for serious network intelligence work.

shodan.io →

💡

Student tip on paid tools: Many paid platforms offer free academic licenses or steep student discounts — always check their website for an "education" or "academic" programme. Maltego, in particular, offers free licences for academic institutions. ShadowDragon and Recorded Future sometimes offer trial access through university cybersecurity programs.

🎓 Certifications to Pursue

Google Cybersecurity Certificate

Beginner-friendly. Covers OSINT basics, security operations, Python scripting. Available on Coursera (~6 months). Good first cert.

CompTIA Security+

Industry gold standard for entry level. Covers threats, OSINT concepts, network security. Recognized globally by employers.

eJPT (eLearnSecurity)

Practical penetration testing. Includes recon phase. More affordable than OSCP. Good stepping stone.

OSCP (Offensive Security)

The premium offensive security cert. 24-hour practical exam. Recognized by top security employers. Requires strong recon skills.

CEH (Certified Ethical Hacker)

Covers OSINT, footprinting, and full hacking methodology. More theoretical but widely recognized in enterprises.

Bellingcat OSINT Training

Free online guides from the world's top open-source investigators. Focuses on journalism and conflict investigation OSINT.

📖 Recommended Books & Resources

📘
Open Source Intelligence Techniques by Michael Bazzell — The definitive OSINT textbook. Updated annually. Get the latest edition from inteltechniques.com
🎙
The Privacy, Security & OSINT Show — Michael Bazzell's podcast. Free. Episode archives go back years. Start with recent episodes.
🌐
Bellingcat's Online Investigation Toolkit — Free Google Sheet with hundreds of tools organized by category
🏫
TryHackMe — OSINT Learning Path — structured labs with guided answers. Free account available.
🏫
HackTheBox Academy — academy.hackthebox.com — includes footprinting and OSINT modules. Some free tiers.
📺
IppSec YouTube Channel — HackTheBox walkthroughs that demonstrate recon methodology on every machine.