OSINT and passive recon: whois, dig, theHarvester
Gathering information from open sources without touching the target.
Level 201 · 17 lessons · 18 practice labs
Lessons
Foundations and ethics
- What OSINT is and your organisation's external footprint: You will understand what open-source intelligence (OSINT) is and what makes up the external footprint an organisation shows on the internet.
- The limits of open-source research: personal data, ethics and law
- Judging how reliable a source is
- Short task: build a list of reliable sources for your organisation
Domains and DNS
- whois and domain registration records: You learn to see what organisation details are public in whois and domain records and how to reduce the ones that need not be.
- DNS records: A, MX, TXT, NS: You learn what A, MX, TXT and NS records reveal and how to review the records of your own domain.
- Auditing SPF, DKIM and DMARC records
- Subdomain inventory and certificate transparency: You learn to build an inventory of your own subdomains from certificate transparency records and to find forgotten or unowned ones.
- Zone-transfer misconfiguration and how to close it: You will understand why leaving zone transfers wrongly open leaks information and learn how to close it on your own DNS server.
- Short task: report on the DNS and e-mail security records of a domain
People and documents
- Email addresses and staff details exposed outside: You will understand the risks of staff email addresses and details visible online and how to reduce them.
- Auditing the metadata of published documents
- Secrets forgotten in public code repositories
- Information left on archived old pages
- Short task: find the fictional organisation’s leaks and write a removal request
Putting it together
- Putting the external footprint together: You combine scattered open-source details into one picture to see how the organisation looks from outside and what should be narrowed.
- Capstone: the organisation's external exposure report: You collect what a fictional company exposes in open sources and write a short report showing what should be closed.
Practice labs
- List and explain a domain's DNS records: Query the A, MX, TXT and NS records of mavikaya.lab and write what each record is for in a table.
- Compare domain registration data with the inventory: Extract the registration and expiry dates of Ayçiçeği Gıda's lab domains and report the one about to expire and the wrong contact entry.
- Clean up DNS records pointing at retired servers: Find records in Kuzeyyıldızı Kargo's zone pointing at addresses no longer in use, prepare the removal list and update the zone.
- Audit the domain's SPF record: Read the SPF record for turnali.lab, list the permitted sending servers and flag what is missing or excessive.
- Move the DMARC policy from monitoring to enforcement: Assess Lavinya Klinikleri's monitor-only DMARC record using its reports and write the record that moves it to quarantine.
- Close three gaps in the email authentication records: Find a broken SPF, a missing DKIM key and a lax DMARC on a lab domain, fix all three and re-query to verify.
- Build a subdomain list from certificate logs: Extract the goktasi.lab subdomains from the lab's certificate transparency log dump and produce a deduplicated list.
- Find the subdomain missing from the inventory: Compare subdomains collected from passive sources with the organisation's registered list and assign the undocumented one to an owner.
- Report a forgotten test subdomain and plan its removal: Find Mercanköşk Otelcilik's old test subdomain that still answers, explain the risk and write the DNS and server-side removal steps.
- Check whether the DNS server allows zone transfers: Send a zone transfer request to the lab DNS server, record the result and flag it as a finding if allowed.
- Restrict an open zone transfer to the secondary server: Fix Yelkovan Bankası's lab DNS so zone transfers are allowed only to the secondary server, then retry from outside.
- Align transfer settings on two name servers and report: Audit two name servers where one is locked and one is open, remove the inconsistency and write a short report verifying both.
- Find information in published documents' metadata: Extract author names, software versions and internal paths from the metadata of lab documents taken from the company site.
- Add a publishing step that strips document metadata: Strip metadata from Karaçam Mobilya's documents, verify the cleaned copies and write the check to add to the publishing process.
- Find a secret left in a repository's history and rotate it: Find the access key buried in past commits of the lab's fictional public repository, revoke it and write the history-cleanup plan.
- Build a reliable source list for your organisation: Score the sources you will use for open-source research by reliability, freshness and legal suitability.
- Collect and reduce leaked staff email addresses: List the email addresses visible on Pusulaya Sigorta's lab pages and archived copies and write the takedown request text.
- Write the organisation's external attack surface report: Merge Bakırdere Madencilik's DNS, subdomain, document and repository findings into one table and report them with ranked recommendations.
About this course
Gathering information from open sources without touching the target.
What you will learn
- Foundations and ethics
- Domains and DNS
- People and documents
- Putting it together
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.