Authorised identifiers
northwind-learning.example, supplied synthetic records and RFC documentation addresses such as 192.0.2.0/24.
LAB-OSINT-201 · Cybersecurity & intelligence
OSINT reconnaissance - collect less, prove more.
Practise the analyst workflow behind Recon-ng and Shodan: define authority, select the least intrusive source, preserve provenance, correlate evidence and report only what the data supports.
Estimated time: 90 minutes · Browser-only simulation · Synthetic fixtures · No live target queries, scanning or credential testing
Lab summary
Turn public-source data into a defensible intelligence record.
- 01Define authority before collection.
Write the intelligence question, scope, exclusions and stop conditions before choosing a tool. - 02Use tools deliberately.
Select Recon-ng modules and Shodan filters by the evidence needed, not by how much data they can return. - 03Separate fact from inference.
Corroborate important leads, state confidence and record what the evidence does not prove.
Training boundary: synthetic fixtures and passive reasoning only
This lab does not authorise reconnaissance against any person, organisation or internet service. Do not convert the examples into live Shodan searches, direct requests, DNS brute forcing, port scans, credential tests or social profiling. In professional work, moving from public-source collection to direct target interaction requires explicit authority and an approved rules-of-engagement change.
Module 1
Start with the intelligence requirement - not the tool.
Northwind Learning Services has asked for an external attack-surface review. Your task is to identify public-source evidence that may indicate internet-facing services associated with the fictional organisation.
Out of scope
Employees' private lives, unrelated domains, credentials, direct service probing and any system not included in the fictional scope.
Collection objective
Determine which public-source observations are sufficiently linked to the scoped domain to justify internal ownership validation.
Stop condition
If a secret or unrelated personal data appears, do not test or expand collection. Preserve the minimum reference and escalate through the authorised security process.
Analyst rule: Public visibility is not a substitute for purpose, scope or authority. Collect the minimum information needed to answer the defined question.
Module 2
Choose a Recon-ng module by evidence flow.
Recon-ng is modular. A useful module choice starts with the input you possess and the output you need. Marketplace metadata should be reviewed before installation because modules can require dependencies or API keys and can change as upstream services change.
Synthetic marketplace view
Your input is a domain. Your desired output is hostname leads.
Path Input → Output Key recon/domains-hosts/certificate_transparency domains → hosts none recon/domains-hosts/shodan_hostname domains → hosts shodan_api recon/hosts-ports/shodan_ip hosts → ports shodan_api Requirement: Generate passive hostname leads from the authorised domain with the least additional dependency.
Selection checklist
- Does the module accept the entity you already have?
- Does it produce the entity needed for the next analytical step?
- Does it require an API key or dependency?
- Is the source passive for the authorised use case?
- What will you do if the upstream service changes or fails?
Module 3
Treat Recon-ng rows as leads, not truth.
The following table represents a fictional Recon-ng workspace after a passive domain-to-host collection step. A stored row means the framework recorded an observation; it does not automatically prove current ownership or exposure.
Synthetic Recon-ng host table
Classify what the evidence supports.
HOST IP_ADDRESS SOURCE NOTE portal.northwind-learning.example 192.0.2.24 certificate transparency current-looking name old-lab.northwind-learning.example 192.0.2.88 historical search index observed 2024 unrelated-training.example 192.0.2.31 copied analyst note no scoped domain link
Evidence assessment
- portal... is a stronger lead because the hostname itself matches the scoped domain.
- old-lab... needs timestamp-aware validation because the source is historical.
- unrelated-training... has no identity linkage to the scoped domain and should not be attributed.
Module 4
Interpret Shodan-style observations with time and identity context.
Internet service indexes can help an authorised team understand externally observed services. A record is a time-stamped observation, not proof that the service is still reachable, owned by the organisation or vulnerable.
Synthetic Shodan-style fixture
Compare identity linkage before making an attribution.
Record A ip_str: 192.0.2.24 port: 443 hostname: portal.northwind-learning.example product: nginx tls_cn: portal.northwind-learning.example timestamp: 2026-08-01T08:15:00Z Record B ip_str: 192.0.2.31 port: 22 hostname: none product: OpenSSH org: Unrelated Transit Provider timestamp: 2025-12-04T11:04:00Z
Record A
Stronger association: scoped hostname and TLS name agree with the Recon-ng lead. Internal ownership still needs confirmation.
Record B
Weak association: no scoped hostname, unrelated organisation label and older timestamp. Do not force it into the client's asset graph.
Banner caution
nginx or OpenSSH is an observed banner/product hint. It does not establish patch level or vulnerability.
Query logic
A scoped query concept could narrow by approved hostname and port, for example hostname:northwind-learning.example port:443, but this lab does not execute it.
Module 5
Build a correlation chain and calibrated finding.
OSINT becomes useful when independent evidence sources reinforce or contradict one another. Your report should retain the chain so another analyst can reproduce the reasoning.
Evidence correlation matrix
Follow the strongest synthetic lead.
SOURCE OBSERVATION STATUS Recon-ng host table portal.northwind-learning.example → 192.0.2.24 lead Certificate record TLS name includes portal.northwind-learning.example supports Approved DNS export portal.northwind-learning.example → 192.0.2.24 supports Shodan-style record 192.0.2.24:443, matching TLS CN, 2026-08-01 supports Internal asset-register stub owner: Platform Team; service: learner portal confirms ownership
Finding draft
Observation: Multiple independent synthetic sources associate portal.northwind-learning.example with 192.0.2.24:443.
Inference: The service is likely part of the scoped organisation's external attack surface.
Confidence: High for ownership because the internal asset-register stub confirms the service; no conclusion is made about vulnerability.
Module 6
Safety and analysis knowledge check
Answer all six questions. A score of five or higher completes the knowledge-check checkpoint.
Evidence of learning
Create your local completion record.
After completing the checkpoints and assessment, record your name for a printable personal learning record. This record is not permission to investigate external targets and is not a server-verified credential.
Skunkworks Academy · Labs
OSINT Reconnaissance Workbench
This confirms that the learner completed the browser-only learning activities on .
Local learning record only. It does not verify identity, professional competence, investigative authority, target ownership or a real-world security finding.