HackBlue

Tools · Workbench

Ethical OSINT and privacy self-defense

Tutorials on open-source research done with consent and purpose, verifying images and claims, and shrinking your own public footprint.

  • 17 lessons
  • 2.5 h of reading
  • 4 topics
Start with lesson 1All workbenches

Open-source intelligence is research using public information. Done well, it verifies claims and shows organizations what they expose. Done carelessly, it becomes stalking. These tutorials pair each technique with the purpose and limits that keep it ethical, and spend as much time on protecting yourself as on looking.

Research only organizations that asked you to, or yourself. Do not research private individuals without a lawful purpose and their consent.

Method and ethics

3 lessons

  1. 01OSINT ethics and legal boundaries: what open-source research may and may not doUnderstand what counts as open-source intelligence, where legal and ethical lines fall, how privacy laws apply, and why scope and purpose matter as much as technique.9 min
  2. 02An OSINT methodology: requirements, collection, analysis, and reportingUse the intelligence cycle to keep research focused, record sources as you go, separate facts from assessments, and write findings that lead to action.9 min
  3. 03Writing and handling an OSINT exposure reportStructure findings with evidence, risk, and remediation, protect the personal data the report contains, and agree on retention so the report itself does not become a new exposure.8 min

Organization exposure

8 lessons

  1. 01Using search engine operators to find your organization’s accidental exposureCombine site:, filetype:, inurl:, and intitle: to find documents, login pages, and directory listings your own domain exposes, and get them removed or protected.9 min
  2. 02Finding your subdomains through certificate transparency logs with crt.shQuery certificate transparency logs for every certificate issued for your domain, extract subdomain names, check which still resolve, and spot forgotten or unexpected hosts.9 min
  3. 03Mapping your domain footprint with dig, WHOIS, and RDAPRead your domain’s public DNS records, registration data through RDAP, and mail and verification records, and identify stale or overly revealing entries.9 min
  4. 04Using Shodan and Censys to see your own internet-facing servicesSearch internet scan databases for your organization’s IP ranges and domains, read banners and certificates, and turn surprises into tickets, without scanning anything yourself.10 min
  5. 05Finding old exposure with the Wayback Machine and archived URLsUse the Internet Archive’s CDX API to list historical URLs on your domain, find old documents, endpoints, and configuration files that may still be live, and request removals where appropriate.8 min
  6. 06Searching public code for your organization’s leaked secrets and internal hostnamesSearch public repositories for your domains, internal hostnames, and key prefixes, triage hits without using any credentials you find, and coordinate rotation and removal.9 min
  7. 07Monitoring breach exposure for your domain with Have I Been PwnedVerify your domain with Have I Been Pwned, see which employee addresses appear in known breaches, check passwords safely with k-anonymity, and respond without handling leaked data.8 min
  8. 08Reviewing your organization’s social media exposureFind what official accounts and public employee posts reveal about technology, facilities, and processes, then turn findings into policy, training, and takedowns rather than surveillance of staff.9 min

Personal privacy

4 lessons

  1. 01Image metadata: reading and removing EXIF before you share photosSee what camera and phone photos reveal through EXIF, XMP, and IPTC fields, including GPS coordinates and device serials, and strip them reliably before publishing.8 min
  2. 02Auditing your own digital footprint: a structured self-searchSearch yourself systematically across engines, social platforms, people-search sites, and public records, then rank findings by risk and fix the most sensitive first.9 min
  3. 03Data broker opt-outs: removing your records from people-search sitesUnderstand how data brokers collect and resell personal records, run opt-out requests efficiently, track them, and use legal rights such as GDPR erasure or state privacy laws where they apply.8 min
  4. 04Username reuse: finding and separating your own linked accountsSee how a reused handle links accounts across sites, enumerate where your own usernames appear with tools like Sherlock or WhatsMyName, and decide which accounts to rename, lock down, or delete.8 min

Verification

2 lessons

  1. 01Reverse image search for verification: finding where a picture first appearedUse several reverse image engines, crops, and keyframes to trace an image to its earliest source, detect recycled photos in breaking news, and document what you found.8 min
  2. 02Geolocating a photo for verification: landmarks, shadows, and mapsConfirm or refute where a published news image was taken by matching landmarks, signage, terrain, and shadows against satellite and street-level imagery, and report confidence honestly.10 min