OSINT Roadmap & Open Source Intelligence 🎯🧠
├── 0. Fundamentals
│ ├── OSINT Concepts & Use Cases
│ │ ├── Definition: Gathering publicly available data from online sources
│ │ ├── Applications: Cybersecurity, investigative journalism, law enforcement
│ │ └── Comparison with HUMINT (human sources) & SIGINT (signals intelligence)
│ ├── Ethics, Legal Boundaries & Privacy
│ │ ├── Respecting laws and personal privacy during data collection
│ │ └── Ethical frameworks: responsible disclosure, safe research
│ └── Types of Open Sources
│ ├── Websites, social media, public datasets
│ └── Historical archives: Archive.org, Wayback Machine

├── 1. Domain & Infrastructure Recon
│ ├── Domain & DNS Analysis
│ │ ├── Tools: whois, dig, nslookup, crt.sh
│ │ └── SSL certificate inspection, domain structure mapping
│ ├── Subdomain Enumeration
│ │ ├── Tools: Sublist3r, Amass, Subfinder, AssetFinder
│ │ └── Techniques: passive vs active reconnaissance
│ └── Website Structure & Technologies
│ ├── Key files: robots.txt, sitemap.xml
│ ├── Tech fingerprinting: Wappalyzer, BuiltWith
│ └── Historical pages via Wayback Machine

├── 2. Social Media Intelligence
│ ├── User Profiling & Behavioral Analysis
│ │ ├── Tools: Sherlock, Maigret, Social Analyzer
│ │ └── Discover usernames, emails, photos, locations
│ ├── Image Intelligence
│ │ ├── Tools: Yandex, Google Reverse Image, InVID
│ │ └── Geolocation, timestamps, environmental clues
│ └── Relationship Mapping
│ ├── Followers, likes, comments analysis
│ └── Identify networks, suspicious patterns

├── 3. Deep Web Searching & Dorking
│ ├── Google Dorks & Search Operators
│ │ ├── Query templates for exposed files, passwords, admin pages
│ │ └── Targeted searches for emails, tokens, config files
│ ├── Forum & Pastebin Monitoring
│ │ ├── Platforms: Pastebin, Reddit, StackOverflow
│ │ └── Analyze leaked credentials & public data dumps
│ └── Hidden Content Analysis
│ ├── Review JavaScript files for hidden endpoints
│ └── Discover URLs, APIs, embedded secrets

├── 4. Document & File Analysis
│ ├── Metadata Extraction
│ │ ├── Tools: ExifTool, Metadata2Go, PDF Parser
│ │ └── Process docs, images, videos for hidden data
│ ├── Public Document Search
│ │ ├── Government, education, and corporate domains
│ │ └── Mine for contact info, organizational data
│ └── Media File Analysis
│ ├── Visual/audio inspection for hidden clues
│ └── Timestamp and location inference

├── 5. People & Organization Profiling
│ ├── Personal Data Discovery
│ │ ├── Tools: Pipl, Spokeo, That’sThem
│ │ └── Face, phone, email, address linking
│ ├── Corporate Analysis
│ │ ├── Platforms: OpenCorporates, Crunchbase, LinkedIn
│ │ └── Organization hierarchy, staff, domains, locations
│ └── Digital Footprint Mapping
│ ├── Public records, posts, online presence
│ └── Relationship graphs & linkages

├── 6. Automation & Productivity
│ ├── OSINT Frameworks & Toolkits
│ │ ├── Tools: Maltego, SpiderFoot, Recon-ng
│ │ └── Define targets, run modules, collect results
│ ├── Custom Scripting
│ │ ├── Languages: Python (requests, BeautifulSoup, selenium)
│ │ └── Build crawlers & page scrapers
│ └── Data Management
│ ├── Note-taking & mapping: Obsidian, Draw.io
│ └── Reporting, diagramming, source documentation

├── 7. Training, Community & Practice
│ ├── Practice Labs & OSINT CTFs
│ │ ├── Platforms: TraceLabs, SANS DFIR Netwars
│ │ └── Real-world challenges & missing persons investigations
│ ├── Learning Resources
│ │ ├── Blogs: Bellingcat, OSINT Techniques, Sector035
│ │ └── Courses: Udemy, GitHub, YouTube
│ └── Community Engagement
│ ├── Twitter/X, Discord, Reddit
│ └── Collaborative research, sharing insights

نقشه راه اوسینت 🚨