Project 10: Recon-ng OSINT Lab

Module: Module 1: Reconnaissance, Networking & First Vulnerabilities  |  Level: Beginner  | 
Primary tool: Recon-ng  |  Estimated time: 45–75 minutes

Objective: Practice modular OSINT collection against a domain you own or are authorized to research.

Free lab environment

OSINT Framework + theHarvester + Shodan (free tier) — https://osintframework.com/ and https://www.shodan.io/

Practice OSINT techniques against your own domain, your own social media presence, or explicitly-designed OSINT training targets (e.g. TryHackMe’s free OSINT rooms). Shodan’s free tier gives limited but real query results without payment. Never aggregate data on a real private individual without their consent as a course exercise.

Lab workflow

1. Confirm your target is a domain/account you own, or an explicitly-provided training target — never aggregate data about a real private individual without consent as a course exercise.
2. Using Recon-ng, run your collection step to practice modular OSINT collection against a domain you own or are authorized to research.
3. Organize every raw finding into a simple table: what was found, where, and why it matters.
4. Rank your findings by real-world sensitivity — not every piece of public information is equally risky if combined with other data.
5. Write a one-paragraph remediation note for the single most sensitive finding.
6. Capture the screenshots specified below as your evidence trail.

Evidence & screenshot requirements

Submit the following with your report (see this module’s practical assignment for exact upload details):

• Recon-ng module output listing discovered subdomains or contacts
• your written note on which finding poses the most real-world risk and why

Expected deliverable

A concise lab-report entry containing: scope/target, exact commands or payloads used, your key
observation, the required screenshots above, and — where applicable — the specific remediation for what
you found. Vague answers (“sanitize input”, “use a firewall”) without naming the exact mechanism will not
receive full credit.

Safety & authorization

Only test the specific free lab target named above, or infrastructure you personally own. Do not target
third-party systems, real user accounts, or production services without explicit written authorization.
Never deploy anything from this project outside an isolated lab environment.