All personnel assigned to Operation: Ludicrous Speed must complete this orientation before accessing restricted operational sectors. The Druidian planetary shield will not protect itself. Analysts who skip this training will be vacuumed reassigned.
You are being trained to conduct Open Source Intelligence (OSINT) operations against Spaceball Industries. Everything in this module uses publicly available information. No hacking. No unauthorized access. Just knowing where to look.
// MODULE 01 — NETWORK INTELLIGENCE // DNS RECONNAISSANCE
Every domain registered on the internet has associated DNS records — publicly queryable by anyone. These records can reveal IP addresses, mail servers, ownership hints, and custom TXT records that administrators sometimes use to store... sensitive information.
Key record types to query: A (IP address), MX (mail),
TXT (free text — often revealing), CNAME (aliases),
NS (nameservers).
_hint, _secret,
_dmarc — administrators hide things in prefixed TXT records thinking nobody will look.// MODULE 02 — INFRASTRUCTURE SURVEILLANCE // SHODAN & CERTIFICATES
Shodan is a search engine for internet-connected devices. Unlike Google, it indexes banners, headers, and metadata from servers, cameras, routers, and industrial control systems. A poorly configured server broadcasting a custom banner is a beacon.
Certificate Transparency (CT) logs are a public record of every SSL/TLS certificate ever issued by a trusted Certificate Authority. Every subdomain an organization certifies — including internal tools, staging environments, and secret projects — gets permanently logged. Corporations forget this. Analysts do not.
ssl.cert.subject.cn:target.com on Shodan to enumerate
subdomains via certificate SANs — often reveals infrastructure not listed in DNS.// MODULE 03 — IDENTITY OPERATIONS // SOCIAL MEDIA OSINT
Individuals leave digital exhaust across social platforms. Usernames, post histories, image metadata, follower graphs, and even alt-text can contain intelligence. A subject who believes they are anonymous often links their personas through behavioral patterns.
Key techniques: reverse image search, username enumeration across platforms,
image EXIF metadata extraction, advanced search operators (from:, since:,
until: on X/Twitter), and LinkedIn profile reconstruction.
// MODULE 04 — FINANCIAL INTELLIGENCE // BLOCKCHAIN ANALYSIS
Public blockchain networks record every transaction permanently and immutably. Wallet addresses, transaction values, timestamps, and encoded input data are all visible to anyone with a block explorer. Subjects who use cryptocurrency believing it is private leave a complete, permanent, publicly indexed financial trail.
Input data fields in transactions can contain arbitrary hex-encoded content — including messages, flags, and intelligence. Always decode transaction input data when investigating on-chain activity.
// MODULE 05 — GEOSPATIAL INTELLIGENCE // GEOLOCATION
Images, documents, and metadata frequently contain embedded location data. EXIF metadata in photographs can contain GPS coordinates recorded at the time of capture. Document metadata (Author, Subject, GPS fields) tells a story about where a file was created and by whom.
What3Words divides the world into 3m × 3m squares and assigns each a unique three-word address. A single what3words address can pinpoint an exact physical location — including a specific spot within a building, not just the building itself.
exiftool on any document or image you recover during
an investigation. GPS, Author, Subject, and Comment fields are frequently populated.// MODULE 06 — ARCHIVAL INTELLIGENCE // HISTORICAL RECORDS
The internet does not forget. Web archives capture snapshots of pages before they are deleted, modified, or taken offline. WHOIS records (even with privacy enabled) retain historical registrant data. Past DNS configurations are often archived by passive DNS databases.
Even a page with no content can be revealing — a robots.txt file lists paths
the owner explicitly does not want crawled. A 404 response to a known path confirms the
path was once valid. Absence of information is itself information.
robots.txt is always worth reading. Administrators list their
most sensitive directories there, then assume crawlers will obey.Your analyst credentials were issued with this training packet.
Restricted access:
/███████████/