Ohhhhh sint.
This will not be my only post about OSINT, so it very much fundamentals. I got into it via two paths, Trace Labs (which I will mention below) and romance scammers in terms of business email compromises.
Below are a mixture of resources that I've used to solidify OSINT Fundamentals as a multimodal learner.
A read through of this blog can be found at the bottom of this page.
Visual:
The OSINT Framework for starts, a literal map of many things OSINT.Next, a tool called YOGA via Micah Hoffman. His DEFCON talk is below (yes we're blending with Aural already, I know) & I really respect it, especially the idea that people sometimes get in the weeds on the findings and forget to make a great recipe instead. He says that YOGA is supposed to help OSINTers figure out what is next, which is pretty cool.
I do consider the 2 resources above as fundamental stuff. The OSINT Framework is well known in the industry so if you understand the logical collection of data shown there, you'll be far ahead. Then, knowing how to organize and report on data is also something that is a fundamental skill, if you could benefit from YOGA, use it!
Aural:
Listen, Heath Adams (TCM Security) put the whole OSINT course on YouTube for free, it's a banger. TADAAAA
Go through that, if you don't have the fundamentals down hit me up.
Read/Write:
There are MANY places to read about OSINT methodologies. You could read blogs from big name players like SentinelOne or keep up with OSINT Curious (OSINT Curious Project).
Then, as you begin to use tools, don't forget to read the notes in the help section of the tools you are using. <- toP 25 OsInt ProJects!.!
I'm intentionally leaving this section pretty simple. If you read through these links above and get the tools installed and read through them (while taking some notes or blogging on them) you will be in a really good spot on understanding the fundamentals.
Kinesthetic:
A creative mind can find very many ways to practice OSINT. I'm just going to provide 4 but I would love to hear your ideas too.
1. OSINT Yourself
Seriously, go to town & build out a profile on yourself. Hey, while you are at it, take that stuff down! The lovely Yael Grauer keeps the Big Ass Data Broker Opt-Out List updated, refer to that to make the job quick(er) (Grab a beverage for a several hour event, just heads up).
I've judged and done a number of these, they can be very rewarding and can be devastating, please research and have caution if you are triggered easily.
3. #OSINTChallenge on Twitter.
3. #OSINTChallenge on Twitter.
This hashtag will not only let you practice your OSINT geolocation skills but will show you exactly who to connect with in the community if you are looking to follow more OSINT content.
4. TryHackMe
4. TryHackMe
THM by far has the most interactive training on OSINT that I have found. Check out the screenshot from today of OSINT modules.
That's it for this post, please shoot any comments or thoughts out to me on the LinkedIn post!
Thank you for stopping by, please come again!
Audio of this blog post:
Disclaimer: Understanding that this industry is already filled with educational content, the writer of this blog intends for this series to be utilized by professionals who are looking to find resources for said topics. The content within these resources should be learned and used with caution and common sense, taking note to understand the applicable laws of the reader's location. This is a personal blog of which any opinions or ideas expressed are of the owner/writer and not of any association they are affiliated with. To reach the writer of this blog, please find them on LinkedIn. When sharing this content with your own community it is requested that credit be given.