Module 2: Passive Reconnaissance & OSINT
Learn what an outsider can discover about an organisation from public sources alone: DNS, certificates, indexed documents, metadata and breach data. You work as the organisation reviewing its own exposure and recommending how to shrink it.
- Level
- Beginner
- Study time
- 6 hours
- Lessons
- 6
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Gather and organise public intelligence about an organisation and advise on exposure.
- Interpret DNS, WHOIS and certificate transparency data to find forgotten or risky assets.
- Rank exposure findings by severity and recommend a concrete fix for each.
- Explain the legal and ethical limits of OSINT and why private individuals are out of scope.
Before you start
Module 1: Foundations, Attacker Mindset & Lab Setup
Tools you will use
Course outline
6 lessons in 2 modules.
Sub-module 2.1: Passive reconnaissance
- WHOIS and DNS: what your domain reveals
- Certificate transparency and subdomain exposure
- Search engines, documents, metadata and breach data
Sub-module 2.2: OSINT tooling & footprinting
- OSINT tooling and footprinting concepts
- Mapping the attack surface: defensive OSINT
- Worked example: reviewing a council's public exposure
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Read the DNS and WHOIS exposure Beginner, 20 min
- Review certificate transparency entries Intermediate, 25 min
- Major Lab: Build the attack-surface map and report Intermediate, 40 min, final lab
2 assessments
- Module 2 knowledge check
- Module 2 final quiz
The pass mark is 70%. You can retake an assessment.
Take Module 2: Passive Reconnaissance & OSINT
Request access and your instructor will set up your account.