Data Protection & OSINT (Open Source Intelligence)

Environment: Windows 11 — [Link] (user Admin, password Pa$$w0rd)

Environment: Kali Linux — [Link] (user attacker, password toor)
Mode: Self‑paced via RDP.

Pre‑installation & Tool Setup (Windows 11 and Kali)

Connect via RDP
1. On your workstation: Start → type Remote Desktop Connection → Enter.
2. Windows 11 VM: click Show Options → Computer: [Link] → User name:
Admin → Connect → when prompted, enter password Pa$$w0rd → OK.
3. Kali VM: Show Options → Computer: [Link] → User name: attacker →
Connect → password toor → OK.

Windows 11 — Browser setup and extensions

1. Start → type Microsoft Edge → Enter.
2. Edge top‑right ⋯ → Settings → left menu Privacy, search, and services → under
Tracking prevention select Basic (extensions sometimes need relaxed blocking for
lab steps). You can switch to Strict later in Counter‑OSINT.
3. In a new tab open:
o [Link]
o [Link]
o [Link]
4. (Optional) Install helper extensions (Edge Add‑ons: ⋯ → Extensions → Manage
extensions → Get extensions for Microsoft Edge):
o Search Shodan → Get → Add extension.
o Search [Link] → Get → Add extension (account may be needed).

Kali Linux — Install OSINT toolset

1. Activities → Terminal (or Ctrl+Alt+T).
2. Update and install tools:
sudo apt update && sudo apt upgrade -y
sudo apt install -y recon-ng theharvester maltego netdiscover nmap whois
dnsenum curl jq git python3-pip exiftool
pip install --break-system-packages holehe sherlock emailrep

3. Verify:
recon-ng --version
theHarvester -h | head -n 2
sherlock -h | head -n 2
maltego & disown

Close Maltego if it opens; you will use it later.

Exercise A — OSINT Framework Navigation (Windows)

Goal: Learn the structure and categories of OSINT Framework and identify tools by input
type (email/username/domain/IP).

Steps (click‑by‑click) 1. Edge → address bar → type [Link] →

Enter. 2. The left tree shows categories. Click + next to People Search → browse sub‑nodes
like Email Search and Username. 3. Click + next to Usernames → click node Sherlock to
open its site in a new tab. Return to OSINT Framework tab with Alt+Tab. 4. Click + next to
Domain/IP → expand WHOIS and DNS nodes → hover each item and read the URL in the
status bar. 5. In Notepad create C:\Users\Admin\Desktop\osint_notes.txt: Start → type
Notepad → Enter → File → Save As… → Desktop → File name osint_notes.txt → Save. Add
three headings: EMAIL TOOLS, USERNAME TOOLS, DOMAIN/IP TOOLS. Under each, type 3 tools
you saw and what input they need.
What happened: You mapped the index of OSINT tools and matched each tool to the data
you must supply.
Verify: osint_notes.txt contains at least 3 tools per category with their required input
type.

Exercise B — Email Enumeration & Breach Discovery (Kali)

Goal: Collect emails for a public company domain and check exposure in public breach
sources.
Steps (terminal + browser) 1. Terminal:
mkdir -p ~/osint_lab && cd ~/osint_lab
theHarvester -d [Link] -b google -f tesla_harvest

2. View results:
cat tesla_harvest.json | jq '.emails'

3. Open Firefox (Kali menu Applications → Web Browser) → go to

[Link]
4. For a sample email you found (or your own test email), click Pwned? search box →
paste the email → press Enter.
 o If an API key notice appears, use the web form only (no API needed for
manual checks).
5. Terminal — run holehe for the same email:
holehe elon@[Link] | tee holehe_tesla.txt

6. Add findings to ~/osint_lab/[Link]:

echo "Emails found (theHarvester):" >> [Link]
jq -r '.emails[]?.value' tesla_harvest.json >> [Link]
echo "\nHolehe results saved to holehe_tesla.txt" >> [Link]

What happened: theHarvester scraped public sources for [Link] emails; HIBP and
holehe indicated where accounts or breaches exist.
Verify: [Link] lists at least one email; holehe_tesla.txt contains site existence
checks.

Exercise C — Username & Social Media Tracing (Kali + browser)

Goal: Correlate a public username across platforms and capture visible metadata.
Steps 1. Terminal:
cd ~/osint_lab
sherlock elonmusk --timeout 10 --print-found | tee sherlock_elonmusk.txt

2. Open matches in browser: from sherlock_elonmusk.txt, select any 3 URLs (e.g.,

Twitter, Reddit, GitHub). In Firefox Ctrl+L paste each URL → Enter.
3. In a new file profile_notes.txt record for each platform: join date, follower count,
profile bio; in Terminal:
echo "Twitter: <notes>\nReddit: <notes>\nGitHub: <notes>" > profile_notes.txt

What happened: sherlock automated username presence checks; browser review

provided public metadata.
Verify: sherlock_elonmusk.txt contains ≥3 valid URLs; profile_notes.txt has captured
metadata.

Exercise D — Domain & Infrastructure Reconnaissance (Kali)

Goal: Extract WHOIS contacts, subdomains, and services for a public domain.
Steps 1. WHOIS fields:
whois [Link] | grep -Ei 'Registrant|Admin Email|Org|Organization|Tech
Email' | tee whois_tesla.txt
 2. DNS enumeration:
dnsenum [Link] | tee dns_tesla.txt

3. Quick service scan (top ports):

nmap -Pn -F [Link] | tee nmap_tesla.txt

4. Structured with recon-ng:

recon-ng <<'EOF'
workspaces create tesla
modules load recon/domains-contacts/whois_pocs
set SOURCE [Link]
run
show contacts
exit
EOF

5. Export recon-ng table:

recon-cli --workspace tesla --command 'show contacts' > recon_contacts.txt

What happened: WHOIS/DNS revealed contacts and hosts; nmap showed reachable
services; recon-ng stored results.
Verify: recon_contacts.txt lists at least one contact or email; dns_tesla.txt shows
subdomain findings.

Exercise E — Metadata & File Leakage (Kali + browser)

Goal: Pull public documents and read identifying metadata.
Steps 1. Firefox → open Google → search:
site:[Link] filetype:pdf OR filetype:docx OR filetype:pptx

2. Download one accessible file to ~/osint_lab (Right‑click link → Save Link As… →
choose folder).
3. Terminal:
cd ~/osint_lab
exiftool *.pdf *.docx *.pptx 2>/dev/null | grep -E
'Author|Creator|Producer|Company|LastModifiedBy' | tee doc_metadata.txt

4. Review for personal names or internal systems.

What happened: File metadata exposed author names, software, or company structures.
Verify: doc_metadata.txt contains at least one author/creator/company field.
Exercise F — Internet Exposure via Shodan (Windows or Kali)
Goal: Identify exposed services and banners.
Steps (Windows Edge) 1. Open [Link] 2. Search box → type [Link]
→ Enter. 3. In the left filters, click Ports → choose 80 or 443. Click a result. 4. On the host
page, read the Banner section (server type, SSL info). In osint_notes.txt add the IP and
service.
What happened: Shodan indexed Internet‑facing hosts; banners reveal software and
versions.
Verify: Your notes include at least one IP with service and port.

Exercise G — Visual Mapping with Maltego (Kali)

Goal: Build a relationship graph from prior findings.
Steps (GUI exact paths)
1. Applications → Information Gathering → Maltego CE → launch.
2. Start screen → New graph.

3. Left Entities panel → drag Domain to canvas → double‑click it → set value to [Link] →
Enter.
4. Right‑click the domain on canvas → Run Transform → choose To DNS Name, To Email
Address (run transforms that are available in CE).

5. After nodes appear, right‑click any new node → Run Transform → To Linked Entities.
6. Top toolbar → Export → Image (PNG) → save to ~/osint_lab/maltego_map.png.
What happened: Maltego visualized links (domain ↔ DNS ↔ emails).
Verify: maltego_map.png exists and shows multiple nodes/edges.

Exercise H — Counter‑OSINT & Browser Privacy (Windows + Kali)

Goal: Reduce data exposure and test anonymity.
Steps

1. Windows Edge strict mode: ⋯ → Settings → Privacy, search, and services → Tracking
prevention: Strict → Clear browsing data → Choose what to clear → Time range: All time
→ Cookies + Cached files → Clear now.
2. Disable autofill: Settings → Profiles → Passwords → Offer to save passwords: Off;
Profiles → Personal info → Save and fill personal info: Off.
3. Kali Tor quick test:
sudo apt install -y tor torsocks
sudo systemctl enable --now tor
curl -s [Link] > /tmp/ip_direct.txt
torsocks curl -s [Link] > /tmp/ip_tor.txt

4. Compare IPs:
diff /tmp/ip_direct.txt /tmp/ip_tor.txt || echo "IPs differ (Tor works)"

What happened: Privacy settings shrink tracking surface; Tor routes traffic via exit nodes.
Verify: IPs differ; Edge shows Strict enabled.

Exercise I — Data Leak Correlation (Kali + browser)

Goal: Pivot from domain to leak databases and note exposure patterns.
Steps
1. Firefox → open [Link] (or [Link]
2. Search for [Link] in site search box → Enter.
3. Review result categories (pastes, breaches, files). Open one result.
4. Record any referenced emails or hashes into [Link] with a prefix LEAK:.
5. Terminal (optional web scrape header only):
curl -I [Link] | tee intelx_headers.txt

What happened: Leak aggregators index exposed datasets that can be pivoted to emails
or domains.
Verify: [Link] contains at least one LEAK: line.

Exercise J — Social Network Footprinting (Kali + browser)

Goal: Investigate public profiles and understand correlation scope.
Steps 1. Firefox tabs: - [Link] -
[Link] - [Link]
2. For each page, read visible fields: join date, location (if present), follower count, linked
sites.
3. Terminal correlate again:
sherlock elonmusk --timeout 10 --print-found | tee sherlock_refresh.txt

4. Append notes with any new platforms to profile_notes.txt.

What happened: Cross‑platform reuse reveals consistent identity traits.

Verify: profile_notes.txt updated with at least three public data points.

Exercise K — Corporate Document Exposure via Search Engines

(Windows + Kali)
Goal: Detect sensitive org information in public files.
Steps
1. Edge (Windows) → Google search:
site:[Link] filetype:xls OR filetype:pdf OR filetype:docx

2. Right‑click a result → Open link in new tab → if downloadable, save to Desktop.

3. Kali Terminal analyze metadata:
cd ~/osint_lab
exiftool *.pdf *.docx *.xlsx 2>/dev/null | grep -E
'Author|LastModifiedBy|Company|Producer' | tee exposure_metadata.txt

What happened: Metadata often discloses names and tooling footprints.

Verify: exposure_metadata.txt includes at least one identifier field.

Exercise L — Maltego Mapping (Deepen Graph) (Kali)

Goal: Build a richer entity map including IPs and web infrastructure.
Steps
1. Open Maltego CE.
2. Add entities: IP Address, Website, Person. Set values from earlier files
(dns_tesla.txt, recon_contacts.txt).
3. Right‑click each entity → Run Transform → To Linked Entities. Iterate until no new links
appear.
4. Export: File → Export → CSV → save as ~/osint_lab/maltego_entities.csv.
What happened: You combined multiple data sources to expand the graph.
Verify: maltego_entities.csv created with multiple entity rows.

Exercise M — Counter‑OSINT Practices (Windows + Kali) — FULLY

DETAILED
Goal: Apply data minimization and anonymization with explicit research & verification.
Steps

1. Edge hardening (Windows) — ⋯ → Settings → Privacy, search, and services →

Tracking prevention: Strict; Clear browsing data → Choose what to clear → All time →
Cookies + Cache → Clear now; Profiles → Passwords → Offer to save passwords: Off;
Profiles → Personal info → Save and fill personal info: Off.
2. Install Tor on Kali:
sudo apt update && sudo apt install -y tor torsocks
sudo systemctl enable --now tor

3. Verify Tor:
curl -s [Link] > /tmp/ip_direct.txt
torsocks curl -s [Link] > /tmp/ip_tor.txt
cat /tmp/ip_direct.txt && echo && cat /tmp/ip_tor.txt

Expected: IPs are different.

4. ProtonMail account (Windows) — Edge → [Link] → Free
→ Select Free → create username/password → complete CAPTCHA → Settings → Security →
Two‑factor authentication → Enable 2FA (scan QR in authenticator) → send a test email to
another account.
5. Signal Desktop (Windows) — Edge → [Link] → Download for
Windows (64‑bit) → run installer → open Signal → on phone app Settings → Linked devices
→ Link New Device → scan desktop QR → send a test message to verify.
6. Tails OS (Windows + Rufus) — Edge → [Link] → Get Tails →
Download → download .iso and .sig → on Kali import Tails signing key and verify with gpg
--verify → on Windows run Rufus ([Link] → select USB (≥8 GB) → SELECT
ISO → START (erases USB) → boot test if possible.
7. Research workflow (documented) — create notes file:
echo "Research Notes" > C:\Users\Admin\Desktop\privacy_research_notes.txt
Open official sites ([Link], [Link], [Link]) and one reputable
independent review for each; paste URLs and a one‑sentence summary per tool. Add
When to use and Limitations bullet points for each.
8. Verification checklist — append to notes: - Tor IP differs from direct IP (paste both).
- ProtonMail: email sent/received (write “OK”).
- Signal: paired and message delivered (write “OK” or “Pending”).
- Tails: signature verified / USB created (write outcome).
What happened: You hardened the browser, routed traffic via Tor, set up encrypted
communications, and documented research and verification so results are reproducible.
Verify: Notes file contains the checklist with outcomes; Tor IPs differ; ProtonMail and
Signal tests succeed; Tails ISO verified.

Summary of Possible Evidence to Save

• ~/osint_lab/[Link], sherlock_elonmusk.txt, whois_tesla.txt,
dns_tesla.txt, nmap_tesla.txt, doc_metadata.txt, maltego_map.png,
maltego_entities.csv (Kali).
• C:\Users\Admin\Desktop\osint_notes.txt, privacy_research_notes.txt
(Windows).