How to : 21 OSINT tasks, step by step

Each sheet answers one operational question by naming the tools in the order you actually use them, what each one contributes, and the mistake that ruins the result. For vocabulary, see the glossary ; for the questions that come first, the OSINT questions. Version française

• Find someone's email addressFree tools to find a professional address or verify that it exists.4 tools
• Find all accounts linked to a usernameEnumerate the platforms where a username is used, then rule out name collisions.5 tools
• Check whether an email address has leakedCheck for free whether an address appears in known data breaches.4 tools
• Geolocate a photoDetermine where an image was taken, from metadata then from the scenery.6 tools
• Identify a phone numberFind the carrier, line type and sometimes a name, without calling.5 tools
• Find a website's subdomainsDiscover staging environments, admin panels and forgotten services.6 tools
• Find out who owns a domainFind the registrant, creation date and history of a domain name.5 tools
• Check whether a website is dangerousAssess a URL's reputation and see what it does, without visiting it.4 tools
• Recover a deleted web pageView old versions of a site, and freeze a page before it disappears.4 tools
• Investigate a companyFind officers, accounts, ownership links and any sanctions.6 tools
• Trace a crypto addressRead a wallet's activity and look for who it is attached to.5 tools
• Check whether a photo is fakeDetect a montage, an out-of-context reuse or a generated image.5 tools
• Monitor your company's data leaksDetect exposed employee credentials and the visible attack surface.5 tools
• Check whether a profile is fakeThe checks that expose a fabricated account, ordered from cheapest to most costly.5 tools
• Track an aircraft or a shipFind the position, route and history of an aircraft or vessel from its identifier.5 tools
• Verify where a video came fromEstablish whether a video is old, re-edited or fabricated, before looking at its content.5 tools
• Identify the real owner of a shell companyClimb an ownership chain across jurisdictions, and know where it stops.5 tools
• Map an organisation's infrastructureList the domains, hosts and services an entity exposes, without contacting it.6 tools
• Monitor a subject over timeSet up monitoring that warns you of a change, instead of rerunning the same search.5 tools
• Analyse a suspicious file without opening itLearn what a received file does, and what sending it reveals, without running it on your machine.5 tools
• Analyse an email's headersRead a message's real route to learn where it actually came from, and whether the sender is spoofed.5 tools