Find, verify and report public information responsibly: search, image geolocation, domain research and exposure assessment
Put this course to work on real challenges and in-browser labs. Each CTF category is a trek through the Himalaya, climbed one stop at a time. Free to play.
Open-source intelligence (OSINT) is the craft of answering questions from publicly available information: search engines, archives, public records, domain registrations, photos and maps. Journalists use it to verify news, security teams use it to see their organisation the way an attacker would, and fact-checkers use it to expose fakes.
This course teaches OSINT the responsible way. You will learn a structured method and the ethical and legal limits, search far more precisely than most people ever do, verify where and when a photo was really taken, research domains and internet infrastructure, assess how much your own organisation exposes to attackers, and shrink your personal digital footprint. Every finding goes into a clear report with sources and confidence levels.
You will practise on the Upper Mustang (OSINT) trek on NepSec CTF, on public verification exercises and, above all, on yourself and organisations you are authorised to assess.
3 sections, 8 lessons, 14m total
Incident response engineer in Kathmandu and builder of NepSec
I'm an incident response engineer at Stellar Computer Systems (SCS) in Kathmandu, where I lead incident response, analyse threats and advise clients on their security posture. My work spans security operations, threat detection, threat intelligence, security engineering and vulnerability assessment. I'm listed in Apple's Security Hall of Fame for responsibly disclosing vulnerabilities in Apple's infrastructure, and I hold certifications from Microsoft, Fortinet, Cisco, Google, CrowdStrike and The SecOps Group. When the tools I need don't exist, I build them. That's how NepSec Intel, NepSec Academy and NepSec CTF came to be. My courses teach the same practical skills I use at work, and NepSec CTF is where you put them to the test.
5 published courses
No reviews yet. Enrolled students can leave the first one.
This course practises on yourself, on organisations you are authorised to assess, on infrastructure and on public events. Researching private individuals without a lawful purpose is unethical and often illegal, and the course explains why.
No. Almost everything uses free websites and search engines. A few optional examples use command-line tools such as dig and exiftool.
Yes. Complete every lesson, pass the quiz and submit the assignment to earn a certificate of completion.