Defensive OSINT lab
Practice OSINT, source validation, and incident analysis with safe fictionalized cases.
This lab uses fictionalized/sanitized data. Do not use it to target people, expose identities, or test live systems.
Campaign · 12 linked stages
One incident file split across four acts. It opens on mail headers, runs through deleted Git history and TLS records, and closes with an evidence-led incident report.
Pick a case, review the evidence, write your defensive report.
Reconstruct the timeline and analyze public indicators of compromise (IOCs) from the SolarWinds Orion supply-chain attack.
Core skill: Timeline & IOC Analysis
Map the exploitation timeline of CVE-2023-34362 in MOVEit Transfer and assess the extortion campaign behavior.
Core skill: CVE & Impact Assessment
Trace the cascading supply-chain compromise of the 3CX DesktopApp and identify attacker infrastructure.
Core skill: Software Dependency & Process Analysis
Analyze the public communications, threat actor claims, and official reports of the Colonial Pipeline ransomware incident.
Core skill: Public Narrative & Source Comparison
Analyze the support-system breach at Okta, evaluating HTTP Archive (HAR) file security risks and token hijacking vectors.
Core skill: Support Logs & HAR File Risk
Unravel a fake job-offer phishing chain built around a lookalike company domain and a bogus meeting-verification host, without ever clicking a live link.
Core skill: Domain & Source Verification
Decide whether a viral 'live protest' video really shows the claimed event by cross-checking reverse-search results, visual clues, and official statements.
Core skill: Reverse Search & Timeline
Test whether a Telegram channel claiming a 'full database dump' of a hospital breach is genuine, by comparing post timing, file hashes, and the official disclosure record.
Core skill: Source Timing & Authenticity
Cluster two fake disaster-donation domains through shared registration metadata and a reused payment wallet, and separate them from the legitimate relief foundation they impersonate.
Core skill: Domain Cluster & Wallet Pivoting
Audit a wire photo whose caption says 'last night's factory fire' against its EXIF summary and archive matches, then draft an ethical correction for the newsroom.
Core skill: EXIF & Archive Cross-check
Follow a convincing handover message through its raw headers and find the point where trust breaks.
Core skill: Header reconstruction
Pull a removed handover detail back out of repository history instead of searching only the current files.
Core skill: Deleted Git history
Tie a certificate observation to the mirror before the public DNS change shows up anywhere.
Core skill: TLS and passive DNS correlation
Measure the real exposure window by lining the DNS collectors up against the isolated redirect captures.
Core skill: DNS and redirect timeline
Normalize one CCTV frame using what is visible in it, the camera inventory, the clock drift and the weather record.
Core skill: Chronolocation and metadata
Assess three fictional sources without mixing up trust in a source with trust in a claim.
Core skill: Source reliability grading
Separate an early technical cluster from a later copycat without trying to identify a real operator.
Core skill: Provenance-led clustering
Test a public accusation against account, badge, camera and service records without claiming an alibi you can't prove.
Core skill: Account and physical-evidence separation
Compare approval, branch history, workflow permissions and provenance to find where the release source stops matching.
Core skill: Workflow provenance
Find the machine-like cadence in harmless synthetic telemetry and stop short of a malware or exfiltration claim.
Core skill: Interval and limitation analysis
Test four explanations with inconsistency rather than by counting supporting evidence.
Core skill: Analysis of competing hypotheses
Deliver the final timeline, the scope, the attribution boundary, the containment plan and what stays uncertain.
Core skill: Evidence-led incident reporting
Jump to the evidence log or the report builder.
