SEC587: Advanced Open-Source Intelligence (OSINT) Gathering and Analysis™

Overview

We live in an information age where disinformation is becoming more and more common.

In the first section of day 1 students will learn what disinformation is by understanding how disinformation campaigns are set up and deployed.

Standard intelligence information analysis techniques and processes for assessing the reliability of information are a key element of intelligence, and application of these techniques to OSINT are discussed.

We have a section on how to analyze gathered OSINT information using several reliability rating and analytic assessment techniques such as Admiralty code, Analysis of Competing Hypothesis and CRAAP analysis. These techniques will help students to make their overall analysis outcome become more solid.

Many of the targets of OSINT work may be individuals who like to identify themselves within a group or as part of a group, so we'll cover how to analyze sensitive groups and individuals who identify with groups online.

There's an all-new section on Russian OSINT covering social media and other popular sites, Russian focused facial recognition searches and finding foreign ties to U.S. owned businesses.

There's also an all-new section on Chinese OSINT covering topics including translation options and overcoming difficulties with creating accounts including methods for acquiring +86 Chinese phone numbers and accessing websites only available in China, without relying on western VPNs.

Exercises

• Analyzing the Macron video
• (Optional) Checking Disinformation
• Russian Facial Recognition
• U.S. Foreign Agents Registration Act (FARA)
• Accessing Chinese Websites

Topics

• Detecting and analyzing disinformation and fake news
• Understanding reliability rating models for OSINT
• Rating the reliability of information
• US Army OSINT and the Admiralty/NATO system
• Currency, Relevance, Authority, Accuracy & Purpose (CRAAP)
• Standard intelligence assessment techniques
• Analysis of Competing Hypotheses (ACH) and other methods
• Use of Unique Identifying Labels (UILs)
• Identifying Sensitive Groups using UIL techniques
• Russian OSINT including facial recognition and creating accounts
• Identifying Russian businesses with licenses to do classified work
• Identifying foreign ties to U.S. businesses
• Accessing Chinese websites which only allow domestic visitors
• Dealing with account creation challenges on Chinese apps

Overview

This content is all new, includes seven new hands-on labs and requires no previous experience! We start off with the building blocks of Python that are most important for OSINT and keep increasing the functionality to perform such tasks as web scraping, all while managing our attribution.

We use Python to build an automated intelligence dashboard that updates in real time and can be customized in endless ways. We cover out to utilize third-party APIs including those belonging to AI providers to help us automatically evaluate programs and perform other tasks.

Finally, we end the section by covering persistent monitoring of sites like Telegram and Discord, and how we can move our Python code to the cloud using serverless infrastructure like AWS Lamba.

Exercises

• Python Level 1
• Python Level 2
• Python Level 3
• Python Level 4
• Python Level 5
• Python Level 6
• Python Level 7

Topics

• Python fundamentals for OSINT
• Web requests and parsing web pages
• Managing attribution with Python
• Intermediate web scraping
• Creating an automated intelligence dashboard
• Interacting with APIs, including AI
• Persistent Monitoring
• Automating your Python code in the cloud

Overview

This section starts off with practical and advanced image and video verification techniques and then shifts into an all new section on steganography including a lab on using, and detecting steganography.

There's an all new section on AI for audio analysis including transcription, translation, speaker diarization (identifying which speaker said which words) and speaker recognition.

We will then discuss practical ways to incorporate artificial intelligence into their OSINT research as both a means for increasing our efficiency and effectiveness, but also in detecting AI being used by others to generate content.

We will discuss some advanced enumeration techniques where we cover methods to find domains related to your target, to discover difficult to find infrastructure on websites and in the cloud, and perform 100% passive enumeration on a target website.

Finally, we end with an all new section on gaming OSINT discussing why it's important and key sites for searching and monitoring the space.

Exercises

• Image Verification
• Video Verification
• Steganography
• Speaker Diarization
• Advanced Enumeration
• Gaming

Topics

• Image analysis and reverse image searches
• Video analysis
• AI for Audio analysis
• AI for OSINT
• AI for automating social media accounts
• Detecting AI generated content
• Automated scans of a website for sensitive files
• Discovering cloud-based assets
• 100% passive enumeration of a website
• Gaming OSINT

Overview

This day starts off with instruction on useful concepts for creating and maintaining fictitious identities (sock puppets), particularly those used to interact with others, and how to maintain Operations Security (OPSEC).

Within SEC587, students will get a more advanced understanding of how OSINT techniques can be applied on the Dark Web by learning about the criminal underground including the initial access marketplaces fed by data stealer logs. Students will learn advanced techniques for finding the true location of servers hosting sites on the dark web as well as automated methods for dark web monitoring.

We will discuss the fundamentals of cryptocurrency, techniques for tracking public cryptocurrency transactions, and how to identify transactions involving sanctioned entities. These topics are also covered in an all-new cryptocurrency lab.

Understanding wireless capabilities is becoming more important to OSINT practitioners so we finish with a brief overview of wireless technologies such as Wi-Fi, Bluetooth and software defined radios (SDRs) as well as a lab where demonstrate how to detect modern drones and research their identifiers.

Exercises

• Network OPSEC Analysis
• Dark Web De-Anonymization
• Dark Web Search
• Cryptocurrency
• Detecting Modern Drones

Topics

• Creating and maintaining false personas
• Communicating with targets and other sources of information
• Operational security (OPSEC)
• Searching for dark web content
• Essential cybercrime underground concepts
• Technical methods to de-anonymize dark websites
• Understanding cryptocurrency and the blockchain
• Identifying cryptocurrency addresses tied to sanctioned entities
• An overview of the wireless spectrum and widely used technologies
• Detecting modern drones including the newest DJIs

Overview

Day five will start with tools and techniques that will aid OSINT analysts in using and building their own monitoring and online searching tools. This section will teach students how to utilize third party web-based monitoring tools as well as how to monitor various topics of interest. We'll also have an all new lab where we use a workflow automation framework which can be locally hosted to mitigate budget and/or OPSEC issues.

We'll cover technical methods to access information in password-protected files encountered online and will also learn how to find, gather, and analyze information that is related to vehicles (cars, boats, planes, etc.) using open-source information.

We'll end the day by using automated methods to identify sensitive credentials in various offline and online sources.

Exercises

• N8n
• SearxNG
• Dealing with Password Protected Files
• Aviation OSINT
• Maritime OSINT
• Secrets

Topics

• Practical OSINT monitoring using web services
• Automated internet monitoring using third-party tools
• Utilizing a self-hosted workflow automation framework
• Visualization of data sets to support network analysis
• Collection and analysis of open-source vehicle tracking information
• Methods to access information in password-protected files
• Methods to identify sensitive credentials in both offline and online repositories

Overview

This will be the capstone for SEC587 that brings together everything that students have learned throughout the course. This will be a team effort where groups compete against each other by collecting OSINT data about live online subjects. The output from this capstone event will be turned in as a deliverable to the client (the instructor and fellow classmates). This hands-on event reinforces what students have practiced during labs and adds the complexity of performing OSINT using Python code and various advanced OSINT techniques under time pressure as a group.