Open Source Intelligence (OSINT)

OSINT is the process of collecting information from publicly available sources — DNS records, domain registrations, image metadata, HTTP headers, and vulnerability databases. In the National Cyber League, OSINT challenges typically appear first and account for a significant portion of total points.

This page covers the six OSINT skill areas tested in NCL, with the exact tools and commands you need. Each section defines its terms, shows the tool in action, and includes practice questions.

Prerequisites: You should be comfortable with basic shell commands (grep, awk, cut, piping) from Weeks 1-2.

1. Image Metadata with exiftool

Digital photos contain embedded metadata in a format called EXIF (Exchangeable Image File Format) — a standard that stores camera settings, timestamps, GPS coordinates, and other technical data inside the image file itself. Most cameras and phones write EXIF automatically.

exiftool is the standard command-line tool for reading this metadata.

Basic usage

# Dump all metadata from a file
exiftool photo.jpg

This produces dozens of fields. In NCL, you typically need specific values. Use targeted extraction:

# Extract specific fields (-s3 outputs only the value, no label)
exiftool -s3 -CreateDate photo.jpg        # When was it taken
exiftool -s3 -Make photo.jpg              # Camera manufacturer
exiftool -s3 -Model photo.jpg             # Camera model
exiftool -s3 -ImageSize photo.jpg         # Width x Height
exiftool -s3 -ExposureTime photo.jpg      # Shutter speed (e.g., 1/200)
exiftool -s3 -GPSPosition photo.jpg       # GPS coordinates

The -s3 flag suppresses the tag name, outputting only the raw value. This matters in NCL because you can copy-paste the output directly into the answer field.

GPS coordinate conversion

EXIF stores GPS in DMS format (Degrees, Minutes, Seconds): 47 deg 39' 23.40" N. NCL sometimes expects decimal degrees instead. The conversion formula:

Decimal = Degrees + Minutes/60 + Seconds/3600
47 + 39/60 + 23.4/3600 = 47.6565

For West longitudes and South latitudes, the decimal result is negative.

What else stores metadata

exiftool works on more than images. It reads metadata from PDFs (exiftool document.pdf), Office documents, audio files, and video files. The pdfinfo command is an alternative for PDF-specific metadata. The file command identifies the true file type regardless of extension — it reads the file’s magic bytes (the first few bytes that identify the format, like 89 50 4E 47 for PNG).

2. DNS Records with dig

DNS (Domain Name System) translates domain names like example.com into IP addresses and other records. The command-line tool dig (Domain Information Groper) queries DNS servers and returns structured results.

Record types

DNS stores several types of records. NCL frequently asks you to identify the correct type for a given purpose:

Useful dig flags

dig example.com +short          # Concise output (just the answer)
dig example.com +trace          # Follow the full resolution chain from root
dig @8.8.8.8 example.com       # Query a specific DNS server (here, Google's)
dig example.com +noall +answer  # Machine-parseable output (good for scripting)

+short is the most useful flag for NCL — it returns only the answer value, which you can paste directly.

3. Domain Registration with WHOIS

WHOIS is a protocol for querying databases of registered domain names. It returns the registrar (company the domain was purchased through), registration and expiration dates, nameservers, and sometimes the registrant’s contact information (though this is increasingly redacted for privacy under GDPR).

Basic usage

whois example.com

The output format varies by registrar. Key fields to extract:

whois example.com | grep -i "registrar:"      # Who sold the domain
whois example.com | grep -i "creation date"    # When it was registered
whois example.com | grep -i "registry domain"  # Unique domain ID
whois example.com | grep -i "name server"      # DNS servers

Use grep -i (case-insensitive) because different registrars capitalize field names differently.

TLD types

NCL sometimes asks about top-level domain categories:

4. HTTP Headers

When a browser or curl requests a web page, the server sends back HTTP headers — metadata about the response including the server software, content type, caching policy, and security configuration.

Inspecting headers

curl -I https://example.com        # HEAD request (headers only, no body)
curl -i https://example.com        # Full response with headers
curl -v https://example.com        # Verbose (request AND response headers)

Headers NCL tests

Note: Referer is intentionally misspelled in the HTTP specification — a typo from RFC 2616 that was never corrected.

5. PGP Key Lookup

PGP (Pretty Good Privacy) uses public/private key pairs for encryption and signing. Organizations publish public keys on key servers so others can send encrypted messages or verify signatures. NCL tests your ability to search key servers and extract key details.

# Search by email
gpg --keyserver hkps://keyserver.ubuntu.com --search-keys security@example.com

# Download a key by ID
gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys ABCD1234

# Show fingerprint (40-character hex identifier)
gpg --fingerprint security@example.com

NCL asks about fingerprints (the 40-hex-character unique ID), creation/expiration dates, and key algorithm (RSA, DSA, ECDSA with key size in bits).

6. Threat Intelligence

NCL includes knowledge questions about famous vulnerabilities and security history. The primary resources:

• NVD — National Vulnerability Database. Search by CVE ID (CVE-YYYY-NNNNN) or software name.
• Exploit-DB — public exploit code. CLI: searchsploit [software].

SSL/TLS certificate analysis

# Display a server's certificate
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -text -noout

# Extract issuer and dates
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -issuer -dates

# Show full certificate chain
echo | openssl s_client -showcerts -connect example.com:443 2>/dev/null

NCL asks about the certificate issuer (which CA signed it), key size (in bits), and chain length (number of certificates from server to root).

Commonly tested facts

Resources

Practice: picoCTF (free, with learning guides) · TryHackMe OSINT rooms · OSINT Framework (tool directory)

Reference: CyberChef (encoding/decoding) · Exploit-DB · Shodan (device search)

Video: John Hammond — OSINT CTF walkthroughs · David Bombal — DNS