OSINT Self Lab
OSINT literacy uses domains and personas YOU control — not classmates, neighbors, or stranger infrastructure.
Visual · pentest_osint_self_lab
OSINT self/lab only. $LAB_HOST only. Original Cyberlium.
OSINT homework is not an excuse to research strangers.
Open-source intelligence gathers public data: WHOIS, DNS, certificate logs, public posts, and breach archives — when legally and ethically appropriate. Cyberlium limits OSINT to assets you own: your lab domain, your test email, your $LAB_HOST hostname in notes. Researching classmates, café owners, or random Shodan hosts crosses from literacy into harm. You will NOT dox neighbors for 'OSCP recon' or scrape social profiles of strangers. Next: Host Discovery.
1. Self OSINT: your lab persona
Practice on domains you registered, lab email aliases you created, or intentional test pages on $LAB_HOST. Document sources: WHOIS for your domain, DNS A record pointing to YOUR lab IP, crt.sh entries for certs you issued.
Self OSINT teaches workflow without victimizing anyone. chmod 600 notes; redact unrelated third parties.
Command guide
Try these commands — Self OSINT: your lab persona
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Port scanning — https://nmap.org/book/man-port-scanning-basics.html Top ports — faster recon on lab
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t19-lab.env" nmap -Pn -sS -T4 --top-ports 100 "$LAB_HOST"
Primary tools to practice this lesson: nmap. Reference sites: Port scanning (https://nmap.org/book/man-port-scanning-basics.html); Top ports. Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Lab domain boundary
If your lab uses a fake corp name (e.g., cyberlium-lab.local or a domain you own), OSINT stays within that fiction on hardware you control. Do not pivot to real companies, classmates' employers, or café brands.
Breach archive lookups for emails you do not own can violate privacy and policy — stick to throwaway lab accounts you created.
3. What OSINT is not here
Not scraping neighbor social media. Not Shodan tours of stranger ICS. Not 'finding dirt' on classmates. Those are misuse — not methodology.
Ship: three OSINT sources you checked on YOUR lab domain only. Next: Host Discovery.
4. What you ship: OSINT sources on self/lab domain
List three sources on domains/personas YOU control. $LAB_HOST referenced. NEVER stranger OSINT. chmod 600.
5. What you record before the next lesson
Date. Three OSINT sources on own lab domain. $LAB_HOST named. File t19-m03-l02-osint-self-lab.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Shodan stranger IPs for 'OSINT practice.' Scrape classmate LinkedIn for lab report.
- Right: Document OSINT on YOUR lab domain only. Next: Host Discovery.
Mission: OSINT on assets YOU own
1) List three OSINT sources (WHOIS, DNS, crt.sh, etc.). 2) Apply each to YOUR lab domain or persona only. 3) chmod 600. Never OSINT strangers or classmates.
Stuck? Ask Cyberlium AI Mentor
If OSINT target is not yours, stop — methodology does not need victims.
APPLY: Cyberlium OSINT practice uses:
APPLY: True or False: OSINT on neighbors is acceptable OSCP prep.
APPLY: Breach archive lookup in lab should use: