Red Team: OSINT Camp

Reconnaissance That Actually Matters

Before any payload, before any phishing link — there’s recon.
This is where successful Red Team operations begin.
OSINT Camp takes you deep into the mindset, tooling, and workflows of professional red team reconnaissance — with a laser focus on what actually drives operational success.

🎯 What You’ll Learn

  • How to turn public data into real attack surface
  • How adversaries map organizations before they strike
  • What signals defenders miss that can be exploited
  • How to automate and structure your recon pipeline
  • How to avoid detection during passive and active recon

This is not about writing reports.
This is about finding weaknesses, patterns, and entry points before anyone knows you’re there.

🧰 Lab Format

  • Live environments to simulate real-world targets
  • Passive and active recon tools provided
  • Mix of guided modules and open recon tasks
  • Optional reporting structure to simulate client handoff
  • Realistic targets with web presence, cloud assets, employee exposure, and infrastructure footprints

🧪 OSINT Lab Modules

🌍 Lab 1: External Footprint Discovery

Goal: Map the external presence of a simulated company

  • Enumerate domains, subdomains, IPs
  • Identify hosting providers and CDN usage
  • Map linked web applications and tech stacks
  • Identify exposed dev/test/staging environments
  • Tools: Amass, Subfinder, Shodan, BuiltWith
  • Outcome: Structured map of external attack surface

🧠 Lab 2: Human Targeting & Social Graphing

Goal: Identify and profile key employees

  • LinkedIn and GitHub scraping
  • Email format discovery
  • Org chart reconstruction
  • Public code and credentials exposure
  • Tools: Spiderfoot, GitRob, custom scraping scripts
  • Outcome: Attacker profile of 2–3 high-value individuals with potential phishing angles

🕵️ Lab 3: Metadata & Document Mining

Goal: Extract hidden data from public files

  • Locate and analyze PDFs, DOCX, XLSX on public websites
  • Extract metadata (usernames, file paths, software versions)
  • Analyze naming conventions, internal structure clues
  • Tools: FOCA, ExifTool, custom PowerShell
  • Outcome: Discovery of 2–3 internal usernames or systems

🔐 Lab 4: Credential Hunting

Goal: Find real or exposed credentials

  • Search for credentials in public repos
  • Check past breaches for corporate emails
  • Discover reused credentials in forums, pastebins
  • Tools: GitHub dorking, DeHashed, HaveIBeenPwned, LeakCheck
  • Outcome: Valid (or nearly valid) credential pairs for password spray or phishing targeting

☁️ Lab 5: Cloud & SaaS Enumeration

Goal: Identify misconfigured or exposed cloud services

  • S3 bucket discovery
  • GitHub Actions, CI/CD exposure
  • Public Docker registries and artifacts
  • Tools: S3Scanner, Gitleaks, TruffleHog, public Terraform/CloudFormation searches
  • Outcome: Cloud storage or keys vulnerable to abuse

🧭 Lab 6: Recon-to-Exploitation Planning

Goal: Translate intelligence into operational opportunity

  • Build a report for phishing, credential reuse, or cloud misconfig
  • Create a threat narrative: how an attacker would strike
  • Map OSINT findings to MITRE ATT&CK pre-compromise TTPs
  • Outcome: A clear, defensible path from passive recon to active engagement

🧠 What Makes It Different

  • Red team focus — everything is built for action
  • Realism — targets are simulated orgs with layered complexity
  • Toolchain fluency — use tools like an operator, not a script kiddie
  • Operational flow — you’re not gathering for curiosity, but for exploitation

🔚 Outcomes

After completing OSINT Camp, you’ll be able to:

✅ Conduct passive recon without triggering alarms
✅ Build real human and technical profiles
✅ Discover exposed infrastructure and misconfigs
✅ Develop actionable recon that fuels phishing, credential attacks, or cloud entry
✅ Become the kind of operator that sees what defenders miss

OSINT isn’t the pre-show. It’s act one. And it sets the tone for everything that follows.