SKILL: OSINT Methodology

Metadata

• Skill Name: osint-methodology
• Folder: offensive-osint-methodology
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/osint-method.md

Description

Structured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.

Trigger Phrases

Use this skill when the conversation involves any of: OSINT methodology, open source intelligence, target profiling, data correlation, OSINT workflow, intelligence collection, OSINT campaign, recon methodology

Instructions for Claude

When this skill is active:

1. Load and apply the full methodology below as your operational checklist
2. Follow steps in order unless the user specifies otherwise
3. For each technique, consider applicability to the current target/context
4. Track which checklist items have been completed
5. Suggest next steps based on findings

---

Full Methodology

OSINT Methodology

OpSec

Create a Sock Puppet

• Fake account that cannot be linked to you
• Build a posting history (post stuff, etc.)
• Resources
  • Effective Sock Puppets
  • Ultimate Guide to Sock Puppets
  • Fake Name Generator
  • This Person does not Exist
  • Use separate browser profiles or isolation tools (e.g., Firefox Multi‑Account Containers) for any sock‑puppet activity.
  • Acquire disposable VoIP/SMS numbers (e.g., Burner, Silent Link) to satisfy platform verification without exposing real phone numbers.
  • Audit every browser extension before installation; supply‑chain attacks on popular add‑ons have targeted investigators since 2024.
  • Use dedicated browser profiles/containers per case and persona; avoid logging into personal accounts.
  • Prefer hardware‑backed passkeys for critical accounts; store recovery codes offline.
  • Maintain a minimal chain‑of‑custody: timestamp actions, hash key artifacts, and record tool versions per case.

Cryptocurrency Investigation

Transaction Analysis

• Track transaction flows between wallets
• Identify clusters of related addresses
• Monitor large transfers and whale activity
• Use block explorers to trace fund movements
• Tools:
  • Cielo: Multi-chain wallet tracking (EVM, Bitcoin, Solana, Tron)
  • TRM: Create relationship graphs for addresses/transactions
  • Arkham: Multichain explorer with entity labels, graph creation, and alerts
  • MetaSleuth: Transaction visualization for retail users
  • Range: CCTP bridge explorer
  • Socketscan: EVM bridge explorer
  • Pulsy: Bridge explorer aggregator
  • Chainalysis: Horizon 2.0 cross‑chain tracing suite (paid)
  • Elliptic: Lens visual link explorer (launched Dec 2024)
  • Most compliance suites now provide real‑time bridge‑risk scoring dashboards (e.g., TRM, Chainalysis)

Layer 2 / Rollup Analysis

• zkSync Era / Polygon zkEVM: Zero-knowledge proofs hide transaction details on L2; only deposit/withdrawal bridge events visible on L1. Use zkSync Era Block Explorer and PolygonScan zkEVM.
• Arbitrum / Optimism: Transactions batched and compressed; L2 state reconstructed from L1 calldata. Use Arbiscan and Optimistic Etherscan. Check L2Beat for risk framework and technology stack.
• StarkNet: Cairo VM with STARK proofs; different address derivation. Use Voyager or StarkScan.
• Base / Blast / Scroll: OP Stack or ZK-rollups; similar challenges to above.
• Privacy protocols on L2:
  • Aztec Network: Programmable privacy with noir circuits; limited block explorer visibility.
  • Railgun: Privacy system for DeFi on Ethereum/Polygon/BSC; shielded pools obscure sender/receiver/amount.
  • Privacy Pools: Proposed Tornado Cash successor with association sets; not yet deployed at scale.
• Challenges:
  • Bridge mixers (Hop Protocol, Across, Stargate) create synthetic liquidity pools that break direct tracing; funds enter/exit via pool swaps.
  • Cross-rollup transfers further obfuscate trails; requires tracking via bridge contracts and relayer infrastructure.
  • Many L2s lack mature analytics tools; explorers show transactions but relationship graphs are sparse.
• Methodology:
  • Start with L1 bridge events (deposits/withdrawals); these anchor L2 activity to known addresses.
  • Use L2-specific explorers to trace activity within the rollup.
  • For privacy protocols, focus on timing analysis, deposit/withdrawal clustering, and off-chain metadata (transaction memos, Tornado Cash-style notes).

Cautions (bridges and heuristics)

• Bridges/mixers/wrappers introduce mint/burn semantics; avoid assuming 1:1 flows without on‑chain proofs.
• MEV/sandwich and aggregator paths can create false "direct" trails; validate with multiple datasets.
• Cross‑label sanity: vendor labels can disagree; treat labels as hypotheses, not ground truth.
• L2 finality: Optimistic rollups have 7-day challenge periods; zkRollups finalize faster but proofs can be batched/delayed.

Wallet Profiling

• Analyze wallet age and activity patterns
• Check for connections to known entities
• Monitor balance changes over time
• Identify associated exchange accounts

Exchange Investigation

• Track deposits/withdrawals
• Monitor trading patterns
• Identify linked accounts
• Check for regulatory compliance

NFT Investigation

• Track ownership history
• Monitor sales and transfers
• Analyze metadata and hidden content
• Identify connected wallets and marketplaces

Image Analysis

• Contextual Analysis
  • Use multiple reverse image search engines to find matches or similar images:
    • Google Images / Google Lens (note: Google Lens now requires authentication for some features; use incognito/sock-puppet account)
    • Yandex Images
    • Bing Image Match
    • TinEye
    • Copyseeker AI‑based reverse‑image search engine
    • Perplexity Pro with image upload: AI-powered contextual analysis and web search
  • Use browser extensions for quick searches:
    • RevEye Reverse Image Search
    • Search by Image (multi-engine support)
  • Change search terms and time to narrow down the possible results
  • You can leverage FakeNews Debunker Extension as well
  • Picarta might help with geolocation as well
  • Check for embedded metadata (EXIF data) that may contain geolocation or device information:
    • ExifTool
    • Jeffrey's Image Metadata Viewer
    • EXIF Viewer Pro
• Foreground
  • Signs, license plates, clothing styles, vegetation, and weather conditions.
• Background
  • Landmarks, unique buildings, mountains, bodies of water, and infrastructure.
• Map Markings
  • Flora and fauna types, which can indicate geographic regions.
  • Seasonal indicators like snow, foliage, or daylight hours.
• Trial and Error
  • Manually compare features from the image with maps and street views.
  • Use platforms like Google Street View, Bing Streetside, and Yandex Panorama to virtually explore locations.
  • Employ Overpass Turbo
  • Use Snap Map public stories for area‑based context pivots.
  • Consider Google Earth Studio for stabilized timelapse and bearing estimation.
• Pull Text from Image
  • you can use google or Yandex OCR to pull text from image
  • you can also search that text alongside your image for better results
  • Transcript extraction for video (YouTube): fetch captions to improve keyword and entity search.

Image Forensics

• Analyze images for signs of manipulation or to uncover hidden details.
• Tools
  • Forensically
  • FotoForensics
  • Bellingcat Photo Checker
  • Sensity AI Deepfake Monitor
  • Exposing.ai facial‑dataset search
  • C2PA verification: Adobe Content Credentials Verify and c2patool
• Techniques
  • Error Level Analysis (ELA)
  • Metadata examination
  • Clone detection
  • Noise analysis

Mountain Geolocation

• Use tools to identify mountain peaks and match them with the image.
• Tools
  • PeakVisor
  • Peakfinder
  • PeakLens AR mountain identifier
• Methodology
  • Align the silhouette of mountains in the image with the 3D models in the tools.
  • Adjust parameters like viewing angle and elevation.

Fire Identification

• Identify fires, deforestation, or environmental changes.
• Tools
  • NASA FIRMS
  • Sentinel Hub Playground
  • Global Forest Watch
  • Copernicus EFFIS EU wildfire monitoring portal

Track and Find Planes

• Use Apollo Hunter to find exact satellite image time
• Then use FlightRadar to track that plane that you found
• Verify the size and plane features
• ADS-B Exchange – unfiltered global flight data

Video Analysis

• Find context regarding the video
  • Signs, banners, and billboards.
  • Architectural styles and building materials.
  • Road markings and traffic signs.
  • License plates
  • Clothing styles and local customs.
  • Search for video snippets on platforms like YouTube, Twitter, or TikTok.
• Metadata Extraction
  • YouTube Data Viewer
  • ExifTool: Extract metadata from downloaded video files.
• Platform-Specific Techniques
  • TikTok and Instagram
    • APIs change often; prefer platform exports when available
    • Sample cadence: 1–4 h for fast‑moving topics; keep a fixed persona and capture logs
    • Analyze user profiles for location tags; examine comments and hashtags for clues
  • Bluesky AT Protocol
    • Resolve handles via https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=<handle> to get DID
    • Extract full identity document: https://plc.directory/<did> (returns PLC operations, handle history, PDS endpoint)
    • Real-time firehose: Use Firesky for live keyword/hashtag monitoring across entire network
    • Analytics: SkyView for follower graphs, post engagement, network analysis
    • Archive early: AT Protocol allows post deletion and handle migration; capture DIDs and post CIDs
    • Labelers and moderation: Check user's selected labelers (affects content visibility); different from centralized moderation
    • PDS (Personal Data Server): Users can self-host; identify via DID document to understa