# Osint Ctf

> Lab/CTF: OSINT challenges; people/usernames/email, domains/infra, images/video/geolocation, DNS/archive/social/public records.

- Skill: `aeondave/osint-ctf` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add aeondave/osint-ctf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/osint-ctf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/osint-ctf

---


# OSINT CTF

Goal: solve OSINT CTF tasks with artifact-first triage, confidence-scored pivots, and reproducible public-source evidence.

## When this skill applies

- people, usernames, emails, domains, infrastructure, images, videos, geolocation, social-media clues, DNS history, archives, public records, or public API artifacts
- research tasks requiring public-source correlation, confidence labels, and reproducible evidence trails

## Operating model

1. Classify the primary lane: media/geolocation, person/username, domain/infrastructure, social platform, archive/history, or public record.
2. State the objective and success oracle before searching.
3. Load the closest `offensive-techniques` methodology before selecting tools.
4. Load only the reference file that matches the lane; do not treat the references as a checklist to exhaust.
5. Choose the smallest tool chain that can produce an independent validation signal.
6. Record the exact proof path, confidence level, and failed pivots before moving on.

## Technique integration

Primary methodology to load:

- `osint-technique`
- `recon-technique`
- `forensic-technique` for metadata, media artifacts, timelines, and evidence preservation.
- `network-technique` for infrastructure, DNS, TLS, banners, and passive traffic artifacts.

Use these as decision engines. This skill adds challenge-oriented triage, time-boxing, and category pivots for flag-style public-source tasks.

## Tool routing

Prefer these tool families when the corresponding signal appears:

- `sherlock`
- `maigret`
- `holehe`
- `ghunt`
- `phoneinfoga`
- `spiderfoot`
- `amass`
- `theharvester`
- `dnsx`
- `httpx`
- `gau`
- `hakrawler`
- `asnmap`
- `massdns`
- `shodan`
- `subfinder`
- `wafw00f`
- `exiftool`
- `tesseract`

Tool syntax belongs in the tool skills. This skill decides when a tool family fits and what output should validate progress.

## Evidence patterns

- Favor artifact-first triage, shortest reproducible path, and explicit validation signal before pivoting.
- Record failed hypotheses with evidence so an agent does not repeat expensive dead paths.
- Prefer category-specific tools after surface classification instead of running every scanner or brute-forcer by habit.
- End with a replayable proof: recovered secret, decoded artifact, correlated evidence chain, archived source, or independently confirmed location/account/infrastructure link.

## Category-specific quick pivots

- Define target entity and objective before searching: person, media, infrastructure, event, or organization.
- Use source independence and confidence labels to avoid false pivots.
- Archive exact URL, query, timestamp, and evidence artifact for reproducibility.
- Media/geolocation: extract metadata first, then visual anchors, reverse-image crops, map/street-view checks, OSM queries, and independent confirmation from signs, terrain, weather, or public photos.
- Username/persona: enumerate handles, score reuse, check archived profiles, correlate profile images and bios, and reject matches that share only a common name.
- Domain/infrastructure: pivot through DNS, WHOIS/RDAP, CT logs, subdomains, web archives, source repositories, TLS/SSH fingerprints, and passive banners.
- Social platforms: prefer stable IDs, timestamps, public API fields, profile image history, linked bios, and archived pages over current display names.
- Public records: normalize jurisdiction, date range, and entity spelling before searching; preserve query parameters and record IDs.

## Quality gates

- No claim without a validation signal: recovered secret, replayed exploit, decoded artifact, reproduced model behavior, or corroborated evidence.
- Do not brute force before representation, constraints, and success oracle are known.
- Keep a pivot ledger: hypothesis, evidence, result, next shortest path.
- Keep challenge/platform/competition names out of notes and generated reports.
- Separate fact, inference, and guess. Mark confidence and the evidence that would disprove the pivot.

## Resources

- [references/geolocation-and-media.md](references/geolocation-and-media.md) — media triage, metadata, reverse image search, maps, coordinates, street-view, OSM, and visual-geolocation pivots.
- [references/social-media.md](references/social-media.md) — username reuse, account IDs, archived profiles, social-platform clues, gaming/fitness traces, and public API pivots.
- [references/web-and-dns.md](references/web-and-dns.md) — dorking, DNS/WHOIS/RDAP, archives, repositories, banners, CT/passive infrastructure, and public-record pivots.
- [references/image-geolocation-and-media-triage.md](references/image-geolocation-and-media-triage.md) — Load for image/video artifact challenges: metadata extraction, reverse image search, visual anchor analysis, shadow-based orientation, satellite/Street View verification workflow.