OSINT › Module 1 › Lesson 1
What OSINT Is and Is Not
Public facts you are allowed to read — then map YOUR shadow on
Visual · osint_what_is_and_is_not
OSINT is published-source literacy on assets YOU own. Original Cyberlium.
Opening
OSINT is not a hunt. It is a reading list — and this course only reads the pages that are yours.
Open-source intelligence, in Cyberlium wording, is the craft of noticing what is already published: a username on a profile, an email in a git commit YOU made, a WHOIS row for a domain YOU registered, a photo YOU uploaded. It is not password-guessing, not buying a dump, not sliding into a stranger’s DMs, and not a warrant to inventory a classmate. The skill you want is defensive: see YOUR digital shadow before someone else does, then shrink it. This is ORIGINAL Cyberlium Topic 12 teaching — not a cert dump, not a stalking kit, not IntelTechniques-as-a-weapon.
1. Published source, not a break-in: name the verb
If you needed a stolen cookie, a guessed password, or a dark-web cart, you left OSINT. The verb here is read: pages, registries, caches, and files the publisher chose to put in public. Self-OSINT means the publisher is you — YOUR handle, YOUR email, YOUR domain, YOUR photos, YOUR lab. That constraint is the whole ethics wall, not a footnote.
MITRE ATT&CK Reconnaissance (TA0043) is a defender’s vocabulary for “how an adversary looks before they touch.” Cyberlium uses it as a concept only. You do not emulate adversary looking against classmates, employers, or random hosts. You emulate a careful owner looking in a mirror.
2. What this course will never call “OSINT practice”
Sherlock or Maigret on a roommate. Google dorks aimed at a classmate’s full name. theHarvester against a company you do not own. Shodan queries for webcams and default passwords. Buying a “combo list.” Those are harassment, fraud-adjacent shopping, or unauthorized recon — not homework.
If a blog says the only way to learn OSINT is to “build a target pack on a real person,” close the tab. Real investigators work under law, policy, and written scope. You are learning to inventory yourself. Keep hydra, LAN nmap, dump sites, and 0.0.0.0 binds out of muscle memory.
3. Maps first, collection later — and collection means you
OSINT Framework is a tree of tool names. Bellingcat’s Online Investigation Toolkit is a journalist’s shelf of methods. IntelTechniques is a map of where public records live. None of those sites authorize you to collect a human who did not consent. Bookmark them. Do not scrape them into a “dossier factory.”
The deliverable of this lesson is a sentence you can defend: I will only inventory identifiers I own, on systems I own, with notes chmod 600 under $HOME/cyberlium-lab. Next lesson writes that sentence as Rules of Engagement.
Command guide
Maps first, collection later — and collection means you
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ COMMANDS ═══
Command — copy this
curl -sS -m 8 -I "https://osintframework.com/" | head -n 8
curl -sS -m 8 -o /dev/null -w "bellingcat_resources http=%{http_code}
" "https://www.bellingcat.com/resources/"
curl -sS -m 8 -o /dev/null -w "inteltechniques http=%{http_code}
" "https://inteltechniques.com/"4. What you ship: a definition that excludes strangers and dumps
Write OSINT = read published sources you may read. Self-OSINT = YOUR identifiers only. Bookmark OSINT Framework, Bellingcat resources, IntelTechniques. Treat ATT&CK Reconnaissance as a concept, not a hunt. or STOP if router. Notes chmod 600. No Sherlock of people. No nmap /24.
5. What you record before the next lesson
Date (UTC). OSINT vs not-OSINT. DEMO identified or STOPPED. SAFE Maps bookmarked. NEVER classmates/dumps/hydra/LAN. Path: $HOME/cyberlium-lab/t12-m01-l01-what-osint.txt chmod 600. Legal: original Cyberlium — not an OSINT cert.
6. Wrong vs right: strangers vs identifiers YOU own
Worked failure — same OSINT word, opposite target. Right never needs a classmate or a dump site.
Wrong
Build a “target pack” on a classmate because the Framework listed Sherlock. nmap 192.168.0.0/24 to “find OSINT hosts.” Buy a dump “to learn breaches.” Hydra the TP-Link because 192.168.0.1 answered.
Right
with curl. Write the published-source definition and the NEVER list. Bookmark the three maps. Next: Rules of Engagement and Written Scope.
Mission: define OSINT as a mirror, not a hunt
1) curl http://192.168.0.1/ and decide lab-app vs router (STOP if router). 2) Write OSINT vs not-OSINT plus a NEVER list in $HOME/cyberlium-lab. 3) Bookmark OSINT Framework, Bellingcat resources, IntelTechniques. Never collect classmates. Never scan the LAN.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Hint only: what is self-OSINT vs people-search on strangers?” — not how to Sherlock a roommate.
Knowledge Check
APPLY: curl http://192.168.0.1/ shows a TP-Link “Router Admin” page during an OSINT intro. What do you do?
Multiple choice
Knowledge Check
APPLY: True or False: OSINT in this course includes buying a breach dump so you can “see real data.”
True or False
Knowledge Check
APPLY: MITRE ATT&CK Reconnaissance is in the lesson. How do you use it?
Multiple choice