The OSINT (Open-Source Intelligence) Handbook: Mastering Open-Source Intelligence

Lesson 1 • Defining OSINT and Its Scope

Covers the formal definition of OSINT, its distinction from other intelligence disciplines, and the types of open sources available. Anchors all subsequent techniques to a shared vocabulary.

Lesson 2 • History and Evolution of OSINT

Traces OSINT from Cold War media monitoring to modern digital collection. Provides historical context that explains current methodologies and tool design.

Lesson 3 • The OSINT Analyst Mindset

Develops critical thinking habits, source scepticism, and structured analytical reasoning essential for OSINT work. Connects cognitive discipline to accurate, defensible intelligence products.

Lesson 4 • Building a Secure Research Environment

Introduces operational security principles for protecting analyst identity and research integrity from the outset. Establishes safe practices before any active collection begins.

Lesson 1 • Alternative Search Engines and Aggregators

Surveys Bing, DuckDuckGo, Yandex, Baidu, and meta-search aggregators for coverage beyond Google. Diversifying search engines reduces blind spots in collection.

Lesson 2 • Google Dorking Techniques

Applies specialised operator combinations to uncover exposed documents, login pages, and sensitive data indexed unintentionally. Directly supports vulnerability research and competitive intelligence.

Lesson 3 • Search Engine Architecture and Indexing

Explains how crawlers, indexes, and ranking algorithms determine what is findable. Understanding indexing mechanics enables analysts to predict and exploit search engine behaviour.

Lesson 4 • Automating and Documenting Searches

Introduces search automation scripts, query logging, and result archiving for repeatable, auditable research. Automation scales collection while maintaining evidentiary integrity.

Lesson 1 • Social Media as an Intelligence Source

Maps the intelligence value of major platforms, their data structures, and the behavioural patterns users exhibit. Establishes why social media is a primary OSINT collection environment.

Lesson 2 • Platform-Specific Collection Techniques

Delivers hands-on collection methods for major platforms including Twitter/X, Facebook, Instagram, LinkedIn, and TikTok. Each platform's unique data exposure points are systematically exploited.

Lesson 3 • Preserving and Verifying Social Media Evidence

Covers screenshot tools, metadata preservation, and chain-of-custody documentation for social media artefacts. Proper preservation ensures evidence remains admissible and defensible.

Lesson 4 • Monitoring and Alerting Workflows

Establishes continuous monitoring pipelines using keyword alerts, RSS feeds, and social listening tools. Persistent monitoring converts one-time collection into ongoing intelligence streams.

Lesson 1 • Corporate and Organisational Profiling

Maps corporate structures, beneficial ownership, subsidiaries, and key personnel using regulatory filings and open databases. Organisational profiling reveals hidden relationships and risk indicators.

Lesson 2 • Email and Username Investigation

Teaches reverse email lookup, username enumeration across platforms, and breach data correlation to expand subject profiles. Email and usernames are high-value pivot points in people research.

Lesson 3 • Synthesising Subject Profiles

Integrates data from multiple sources into a structured, verified subject profile with confidence ratings. Profile synthesis is the deliverable that converts raw collection into actionable intelligence.

Lesson 4 • Phone Number and Address Research

Covers reverse phone lookup, carrier identification, address history tracing, and geolocation from contact data. Contact data anchors digital identities to physical locations.

Lesson 1 • Satellite and Aerial Imagery Analysis

Teaches use of satellite imagery platforms to monitor facilities, track changes over time, and corroborate ground-level reporting. Satellite imagery provides independent verification of physical events.

Lesson 2 • Video Intelligence Analysis

Applies frame-by-frame analysis, audio cue extraction, and background detail examination to video content. Video analysis extends geolocation and verification skills to moving-image sources.

Lesson 3 • Geolocation Fundamentals

Introduces coordinate systems, mapping platforms, and landmark-based geolocation techniques for placing images and events in physical space. Geolocation underpins verification of visual claims.

Lesson 4 • Mapping and Visualization Tools

Covers GIS platforms, custom map creation, and geospatial data visualisation for communicating location-based findings. Effective mapping transforms raw coordinates into comprehensible intelligence products.

Lesson 1 • Shodan and Internet-of-Things Intelligence

Uses Shodan and similar scanning platforms to identify exposed devices, services, and vulnerabilities across the internet. IoT intelligence reveals attack surface and operational security failures of target organisations.

Lesson 2 • SSL/TLS Certificate Intelligence

Extracts intelligence from certificate transparency logs, certificate metadata, and issuer relationships to map infrastructure. Certificate data exposes subdomains and organisational relationships not visible in DNS.

Lesson 3 • Code Repository and Paste Site Analysis

Mines GitHub, GitLab, and paste sites for exposed credentials, internal documentation, and developer attribution data. Code repositories are frequently overlooked sources of high-value intelligence.

Lesson 4 • IP Address and Network Analysis

Teaches IP geolocation, ASN mapping, BGP routing analysis, and network block ownership identification. Network analysis connects infrastructure to organisations and geographic locations.

Lesson 1 • Deep Web vs. Dark Web Defined

Clarifies the distinction between the deep web, dark web, and surface web, and identifies the intelligence value of each layer. Accurate terminology prevents operational and analytical errors.

Lesson 2 • Operational Security for Dark Web Research

Applies advanced OPSEC measures including air-gapped systems, dedicated hardware, and traffic isolation for dark web operations. Elevated OPSEC protects both the analyst and the investigation.

Lesson 3 • Dark Web Marketplace and Forum Monitoring

Covers systematic monitoring of dark web markets, forums, and paste sites for threat intelligence and illicit activity indicators. Forum monitoring surfaces early warning signals unavailable on the surface web.

Lesson 4 • Credential and Data Leak Intelligence

Teaches identification and analysis of leaked credentials, databases, and sensitive documents circulating on dark web sources. Leak intelligence directly supports threat assessment and incident response.

Lesson 1 • Data Visualization for Intelligence

Covers link charts, timelines, heat maps, and network graphs for communicating complex relationships visually. Visualisation accelerates decision-maker comprehension of dense analytical findings.

Lesson 2 • Managing the Intelligence Cycle

Applies the full intelligence cycle—direction, collection, processing, analysis, dissemination—to OSINT workflows. Cycle management ensures collection remains tasked, timely, and aligned with consumer needs.

Lesson 3 • Analytic Frameworks for OSINT

Applies structured analytic techniques including ACH, link analysis, and timeline reconstruction to OSINT data. Frameworks impose rigour and reduce bias in the transition from data to conclusions.

Lesson 4 • Writing Finished Intelligence Products

Develops skills for writing intelligence assessments, situation reports, and executive summaries in professional formats. Clear, concise writing ensures findings are acted upon by non-analyst audiences.