OSINT exercises: 14 drills and challenges to build investigative skills

OSINT exercises are structured practice scenarios that turn open source intelligence theory into casework skill, and demand for that skill is climbing: the OSINT market is projected to grow from USD 18.20 billion in 2025 to USD 21.06 billion in 2026, according to Mordor Intelligence (2026). Each exercise below trains one core skill, from geolocation and social media analysis to source verification.

This guide covers 14 drills, ranked by difficulty, plus the free OSINT challenges and practice platforms where you can test each skill: Gralhix, OSINT Dojo, TryHackMe and Trace Labs.

The drills simulate the real messiness of digital investigations, where facts are scattered, identities are layered and certainty is rare. Whether you need to geolocate a photo, trace a social media trail or sharpen the pattern recognition that catches fraud, there is a drill below built for it.

Work through it in a controlled environment before the stakes get real.

OSINT training often relies on more than theory. OSINT exercises are structured investigative scenarios that give professionals a controlled space to build practical skills, but without the high stakes of a live investigation.

These exercises are built to feel real. They push people to go beyond basic searches and work through complex, layered information, just like they would in an actual investigation.

Participants might find themselves digging into metadata, mapping out image locations, analyzing how people behave on social media, or connecting scattered data across different platforms.

Each scenario pulls from the kinds of challenges professionals actually deal with, whether they’re in cybersecurity, law enforcement, journalism, or corporate research.

Doing these OSINT drills helps people get sharper at spotting patterns, tracking digital clues, and judging which information can be trusted. Over time, it builds both technical skills and investigative instinct.

Every OSINT exercise begins with a clear objective, such as identifying an individual, verifying the authenticity of an image, or mapping out a subject’s online activity. These exercises simulate real-world demands that professionals in cybersecurity, law enforcement, journalism, and intelligence routinely face.

Investigators gather information from public sources, such as search engine results, social media posts, domain records, court documents, metadata, and accessible parts of the deep web. They don’t hack or bypass protections but work strictly within legal and ethical boundaries, using only what’s openly available.

Gathering data is just the starting point. Success depends on the investigator’s ability to read between the lines.

The value lies in connecting the data, spotting patterns, and ruling out red herrings. That’s where critical thinking and methodical approaches come in, such as filtering noise, verifying sources, and knowing when a lead is worth chasing.

That judgment is the whole game, as this guide’s author put it in a 2025 podcast interview:

“Tools can do a lot, but if you don’t know how to ask the right question, you will not get the most out of a tool.”
– Nico Dekens, Director of Intelligence and Collection Innovation, ShadowDragon®. Blackdot Solutions podcast, July 2025

Every exercise on this page is built to sharpen exactly that questioning instinct before a live case tests it.

OSINT is a disciplined practice that requires a targeted, deliberate, and analytical approach. The best OSINT practitioners develop a set of core skills that turn raw data into actionable insight. Here’s a breakdown of what matters most.

Research and information gathering

The backbone of any OSINT operation is the ability to hunt, intentionally and methodically. Skilled OSINT investigators know how to pull data from both the obvious and the obscure.

Commonly used sources include social media feeds, news archives, court records, open forums, and breach databases.

Commonly used tools include:

• Google Dorking
• Specialized search operators
• Specialized search engines (e.g., Shodan, Pipl)

Critical thinking and analysis

Finding information isn’t the hard part. Anyone can do a quick search. The real challenge is making sense of what you find. OSINT isn’t just about grabbing facts; it’s about thinking clearly, asking smart questions, and noticing when something feels off.

You need a sharp eye to catch bias, call out propaganda and disinformation, and decide what’s actually worth paying attention to. The goal isn’t just to gather data, but to see through the noise and get to what really matters.

Commonly used tools include:

• Fact-checking platforms
• Metadata viewers (e.g. EXIF.tools)
• Lateral thinking

Data verification and validation

Verifying information is a critical part of any investigation. Just because something’s online doesn’t mean it’s real. A photo, video, or social media post might look legit but could actually be doctored, misleading, or presented completely out of context.

Skilled investigators check metadata, compare visuals across different sources, and use forensic tools to spot anything suspicious. That can involve checking when a file was created, where it came from, or whether it’s been edited along the way.

Commonly used tools include:

• TinEye
• Google Reverse Image Search
• InVID
• ExifTool

Social media intelligence (SOCMINT)

Social media platforms can be goldmines, but only if you know where to dig. SOCMINT specialists track usernames, decode activity patterns, and map interactions across accounts. Keep in mind that the internet is forever. What’s deleted isn’t necessarily gone.

Typical responsibilities involve assessing profile behavior, monitoring influence, and tracking mentions across platforms.

Commonly used tools include:

• Advanced search on major social media platforms
• Reverse image search to detect duplicate or sockpuppet accounts
• ShadowDragon® SocialNet®

Geolocation and mapping

Geolocation and mapping involve reconstructing context from visual clues in photos and videos. Shadows, terrain, and architectural features can all help determine where, and sometimes when, an image was captured.

Key activities often involve pinpointing locations, matching imagery to geographic features, and estimating the time an image or video was taken.

Commonly used tools include:

• Google Earth
• SunCalc
• Mapillary
• Street View
• GeoGuessr

Technical proficiency

Knowing how to use the many tools at your disposal effectively is a critical skill for OSINT investigators. OSINT work often involves network graphing, metadata analysis, and sometimes automating repetitive tasks through scripts.

Investigators often extract metadata, automate searches, and filter large volumes of data to isolate relevant information.

Commonly used tools include:

• Python
• Bash
• Wireshark
• Command-line utilities

Digital footprint analysis

People leave trails of breadcrumbs such as usernames, old email addresses, and profile pictures reused across sites. Digital footprint analysis connects those dots to reveal identity and behavior over time. By correlating aliases across sites, investigators can uncover compromised accounts, verify exposure through services like Have I Been Pwned and map user activity to build a clearer, more complete picture of an individual’s online presence.

Investigators link aliases across platforms, uncover compromised accounts, and map user activity to build a clearer picture of identity and behavior over time.

Commonly used tools include:

• Sherlock
• Have I Been Pwned
• Hunter.io

Open data and public records search

Some of the most valuable intel is buried in public view. Government filings, corporate disclosures, and court documents are all rich sources of information if you know how to parse them.

Investigators navigate databases, extract case details, and build timelines to support their findings.

Commonly used tools include:

• PACER
• OpenCorporates
• Data.gov

Network and relationship mapping

Connections matter. Understanding who’s linked to whom (and how) can surface a wealth of hidden information behind public-facing personas.

By visualizing these relationships, investigators can highlight key influencers and detect anomalies or hidden links within a network.

Commonly used tools include:

• SocialNet®
• ShadowDragon® Horizon®
• Gephi
• NodeXL

Communication and reporting

An investigation is a wasted effort if the findings don’t make sense to the people looking for answers. Investigators build reports, charts, and presentations to turn complex data into clear, useful findings. That requires breaking down technical details, highlighting what really matters, and using visuals to help tell the story.

Commonly used tools include:

• PowerPoint
• Tableau
• Canva
• Word
• Obsidian

Adaptability and continuous learning

OSINT is constantly evolving as technology advances and trends change. Tools are updated, platforms change, and new OSINT techniques emerge all the time. Investigators need to follow updates, stay active in the community, and experiment with new methods through hands-on practice and challenges to stay on top of their game.

Commonly used resources include:

• OSINT Framework
• TryHackMe
• Blog posts
• Discord communities
• Trace Labs Search Party

Time management and organization

The scope of investigations can expand quickly, and effective OSINT work requires a high level of organization. Investigators must keep data structured and accessible by categorizing information, managing leads efficiently, and maintaining focus on the most relevant threads.

Commonly used tools include:

• Notion
• Trello
• Evernote

Problem-solving and creativity

Not every answer is obvious. Sometimes you have to piece things together from different sources to see the full picture.

Say someone shares a photo in a social media post from a café. If you spot a geotagged photo taken nearby around the same time, you can connect the dots and place that person in a specific location at a specific moment.

Attention to detail

Attention to detail is critical in OSINT. A small element in an image, like a reflection or file name, can provide key information such as a location or time. Overlooking these details can lead to incomplete or inaccurate conclusions.

For example, you might spot the serial number on a laptop reflection in a photo and link it to an eBay listing.

To practice OSINT, run one exercise at a time with a timer and a written deliverable. Pick a drill below, set a 60 minute limit and record findings as if a case officer will read them. Each drill carries a difficulty label, so you can build from Beginner to Advanced without guessing.

Set your sources up first. Hunting for a tool mid-exercise costs you the same time it costs in a live case. The OSINT Bookmark Stack from OSINT Combine is a ready-made starting point, grouped by person of interest search, corporate profiling, mapping and verification. Pair it with the free OSINT tools library and a repeatable OSINT checklist so every run starts from the same baseline.

The 14 drills run from quick Beginner reps to Advanced tradecraft. The difficulty split: five Beginner, five Intermediate, four Advanced.

1. Social media analysis

Difficulty: beginner

Social media analysis teaches you how to extract actionable intelligence from noise, understanding sentiment and trends across different platforms.

1. Pick a trending topic, anything from a political event to a viral product. Then track how it spreads and mutates across social media platforms.
2. Monitor hashtags, keywords, and key influencers, and use dashboards like AgoraPulse or Hootsuite to view real-time mentions side by side.
3. Instead of just counting posts, analyze tone, geography, language shifts, and engagement. Who’s amplifying the message? What narratives are gaining traction? Are any accounts likely bots or coordinated networks?

2. Geolocation investigation

Difficulty: intermediate

Geolocation work starts with a single image and ends with a pin on the map.

1. Find a public social media post with a photo, ideally one with visible landmarks, signage, or natural features.
2. Strip out any available metadata first, but don’t rely on EXIF data alone.
3. Focus on visual clues: terrain, architecture, shadows, street signs, vegetation. Use Google Earth, Street View, and reverse image search tools like TinEye to triangulate where the photo was taken.

This exercise sharpens your eye for detail and your ability to cross-reference environments. The goal isn’t just to locate an image, but to learn how to match visual evidence with real-world geography.

3. Public records exploration

Difficulty: beginner

Public records are a goldmine hiding in plain sight. Start with your local government’s website (city, county, or state). Look for databases offering access to birth, death, marriage, or property records.

1. Explore how information is structured: searchable fields, required identifiers, and access limitations.
2. Take note of how much you can learn without creating an account or submitting a formal request.
3. Expand your scope by choosing another jurisdiction, such as out of state or overseas, and repeating the process.

You’ll quickly notice the differences in transparency, structure, and usability. This isn’t just a lesson in data retrieval; it’s about understanding how legal and bureaucratic systems impact access to information.

4. Domain and WHOIS lookups

Difficulty: beginner

Every domain leaves a trail. A WHOIS lookup pulls back the curtain on a website’s registration, revealing information such as who owns it, when it was created, and where it points.

1. Visit a site you don’t recognize or one that’s part of an unfolding news story.
2. Use WHOIS tools to identify the registrar, creation date, and ownership details.
3. Pay attention to changes (e.g., names that don’t match the brand, masked identities, or recently registered domains pushing controversial content).
4. Pair that with the Wayback Machine to see how the site has evolved. What did it look like a year ago? Has the content changed radically? Is it part of a broader network of clone sites or a rebranded operation?

This kind of exercise reveals patterns in deception, legitimacy, and digital footprints, giving you a story behind the site, rather than just a name.

5. Dark web exploration

Difficulty: advanced

This exercise will expose you to a parallel ecosystem: the dark web, where anonymity thrives and traceability fades.

1. Start by downloading the Tor browser.
2. Access indexed directories like Hidden Wiki to locate forums, marketplaces, or whistleblower platforms.
3. Stick to legal, open-access spaces.
4. Watch how users communicate (e.g., handles instead of names, encryption in everyday conversation, and marketplaces built on trust scores, not branding).

You’re learning how threat actors share breached data, how disinformation networks operate, and how anonymity alters behavior. Done right, it sharpens your ability to track narratives that never surface on the open web.

6. Boolean searches practice

Difficulty: beginner

Boolean searches are about thinking in logic. This exercise will help you master advanced search techniques.

1. Pick a subject with noise around it.
2. Craft a search string using operators like AND, OR, NOT, or site-specific filters.
3. Want PDF documents from a government source? Try site:.gov filetype:pdf “climate policy” in Google.
4. Searching social media? Use platform-specific syntax to narrow scope, exclude spam, or isolate exact phrases.

This exercise builds discipline in how you ask questions online and teaches you how to sift through irrelevant results to surface the most important details.

To build strings faster, the free Google Dork Assistant generates tested operator combinations you can adapt to any target.

7. Image metadata analysis

Difficulty: beginner

This exercise isn’t just about a photo, but about what information it reveals without saying it. Metadata turns a photo into a timestamped, geotagged record.

1. Start by downloading a digital image from a social platform or open source site.
2. Run it through a tool like ExifTool or Jimpl.
3. Look for GPS coordinates, device models, timestamps, and software signatures.
4. Even if location data is missing, clues often remain in the form of time zones, editing apps, or camera serial numbers.

Metadata can confirm or challenge a story, tie a user to a location, or reveal patterns in how content is created and shared.

For error level analysis and manipulation checks in the browser, run the same image through the free Image Forensics tool.

8. Email header analysis

Difficulty: intermediate

This exercise demonstrates how digital communication moves. You’re tracking the chain of custody, revealing the infrastructure behind a message, and spotting signs of spoofing or obfuscation.

1. Start by opening the raw header data of an email. Most providers offer a way to view it directly.
2. Feed that header into a tool like MXToolbox or DNS Checker’s Email Header Analyzer.
3. Look for the “Received” lines to trace the mail’s path through servers.
4. Identify the originating IP address, sending domain, and whether the message passed SPF, DKIM, and DMARC checks.

9. News verification

Difficulty: intermediate

News verification is about traceability. Your job is to separate reporting from repetition. Who’s sourcing the story? Are outlets citing each other in a loop? Are images or videos miscaptioned or reused?

1. Start with a breaking headline or viral story.
2. Strip it down: who published it, when, and what claims are being made.
3. Cross-reference those claims using primary sources, such as official press releases, eyewitness posts, raw footage, or satellite images.
4. Use verification platforms like Snopes or InVID to dig deeper.

This exercise builds the habit of challenging surface narratives and tracking facts to their origin. This is critical in OSINT investigations, where credibility isn’t a given but must be verified.

Bellingcat founder Eliot Higgins frames the stakes plainly:

“If anyone with a smartphone can publish, they should also be able to verify.”
– Eliot Higgins, Founder, Bellingcat. Reuters Institute, University of Oxford, February 2025

Verification drills turn that principle into muscle memory.

10. Social engineering awareness

Difficulty: advanced

This exercise highlights the human element in OSINT. You’ll learn how information leaks through behavior.

1. Design a simulated scenario: a phishing email posing as IT support, a phone call claiming to confirm delivery details, or a casual online message from a fake profile.
2. Observe how easily people share information when the context feels familiar or urgent, and how much information you can gather without raising suspicion.
3. Keep it ethical and legal. Test only with consenting participants or in a controlled environment.

11. Network footprint analysis

Difficulty: intermediate

Network footprint analysis is about seeing the full surface area of a target. You’re identifying what’s exposed: unsecured endpoints, outdated software, shadow domains, or excessive employee disclosure. The goal is to see what an attacker or competitor could see.

1. Start with a company’s main domain, then branch outward to linked subdomains, employee social media profiles, vendor relationships, tech stacks, and archived job posts.
2. Tools like BuiltWith reveal backend infrastructure, while Hunter.io exposes email patterns tied to roles or departments.
3. Use social platforms to identify key personnel and map their digital behavior.

12. Event monitoring

Difficulty: intermediate

Event monitoring trains you to extract clarity from chaos. Your job is to filter signal from noise, verify on the fly, and spot shifts before they hit mainstream reports. In a crisis, real-time OSINT can be faster and even more accurate than traditional reporting, but only if you know how to listen.

1. Choose a live event, such as a protest, a natural disaster, or a political development.
2. Track it in real time using tools like Google Alerts, Mention, and Reddit.
3. Build a feed that pulls from multiple angles: official channels, eyewitness posts, geotagged updates, and platform-specific threads.
4. Watch for contradictions, evolving narratives, and coordinated messaging.

13. Language and translation analysis

Difficulty: advanced

When tracking international narratives or regional sentiment, accurate translation isn’t enough. You need to understand how meaning shifts across borders. This exercise builds your ability to catch what automated tools often miss, such as subtext, cultural framing, and coded language.

1. Start with a post, article, or forum thread in a foreign language.
2. Run it through Google Translate or DeepL to get a base translation, then go beyond the literal.
3. Look at idioms, tone, slang, emojis, and regional references. What sounds neutral in one language might carry significant political weight in another.

If you’re using other OSINT investigative tools, look for options that support multiple languages, allowing investigators to analyze and interpret information in their preferred language without the need for third-party translation tools. ShadowDragon®’s Horizon® Investigate and Horizon Monitor®, for example, support Spanish, French, Italian, and German (with more languages on the way).

14. Crypto and blockchain analysis

Difficulty: advanced

Despite its reputation, cryptocurrency leaves a permanent trail. Wallets may be pseudonymous, but usage patterns, clustering, and timing can expose connections.

1. Start with a known wallet address or transaction hash and plug it into a tool like Etherscan or Blockchain.com.
2. Trace the flow, including where the funds came from, where they went, how much moved, and when.
3. Look for patterns: repeat interactions between wallets, sudden spikes in activity, or transactions that break typical timing.

The more time you spend with OSINT exercises, the more you see that results do not come from tools alone, although arming your OSINT toolbox with the best of the trade certainly helps. OSINT is also about how you think and how you approach problems.

Nico Dekens told Blackdot Solutions in 2025:

“As long as you have an internet connection, motivation and time, everybody can learn it. But it takes time. It really takes time to get under the skin of this profession.”
– Nico Dekens, Director of Intelligence and Collection Innovation, ShadowDragon®. Blackdot Solutions podcast, July 2025

Building the instinct to cross-check sources, spot patterns and follow digital threads does not happen overnight. With consistent practice, those skills become second nature, and they hold value in any field.

Whether you dig into criminal investigations, fraud, KYC, misinformation, background checks or cyber investigations, strong OSINT instincts lead to better and faster results. That is where ShadowDragon® makes a real difference.

ShadowDragon® tools are built for the people doing the actual work. They help investigators trace connections, uncover digital footprints and make sense of scattered data. Get in touch with the ShadowDragon® team to learn more.