Collection Techniques — Labs & Discussion

Rules for every lab: passive techniques only unless the lab says otherwise; only approved targets (yourself, consenting classmates, instructor-provided or instructor-owned targets, purpose-built practice sites like scanme.nmap.org); don’t share findings about real people outside class. Every lab ends by tying back to Legal & Ethical Boundaries (Module 2) and OPSEC (Module 8).

Instructor Prep Checklist

• Register (or reuse) a throwaway domain the class is allowed to probe, or use a public teaching target (e.g. scanme.nmap.org, which explicitly permits scanning; note it’s for the active-recon extension only). A domain you control that has a few subdomains, TXT verification records, and some published PDFs is ideal.
• Prepare 3–5 photos you took (or have rights to): leave EXIF/GPS intact on one, strip it from the rest so students must reason visually. Include at least one with a readable sign or storefront.
• Prepare 3–5 documents (PDF/DOCX/XLSX) with realistic-but-fake metadata (author names following a convention, an internal file path, a software version). You can author these yourself so no real person is exposed.
• Confirm the lab VM (Kali) has: a browser, exiftool, dig, whois, curl, jq, and the Go/pip tools students will install (subfinder, theHarvester, sherlock/maigret, waybackurls/gau).
• Set expectations: no scanning or logging into anything; passive only unless a lab is explicitly marked active.

---

Lab 1: Dork Hunt on an Authorized Domain

• Objective: Build search dorks that surface documents, login pages, and (harmlessly) exposed paths on a domain you’re allowed to assess.
• Time: 25–35 min / Difficulty: Beginner
• Setup: Instructor provides the target domain (their own or example.com for a dry run). Students use a clean/private browser window.
• Steps:
  1. Start with site:<target> and note the rough result count.
  2. Narrow to documents: site:<target> filetype:pdf, then try docx, xlsx, pptx.
  3. Hunt structure: site:<target> intitle:"index of" and site:<target> inurl:login.
  4. Run three of the same queries on Bing; compare results to Google.
  5. Pick one GHDB dork, scope it with site:<target>, and run it.
  6. Test a retired operator (cache:<target>) and confirm it no longer works; note the Wayback Machine alternative.
• Deliverable: A list of 8–10 dorks with a one-line note on what each returned.
• Debrief questions: Which single operator narrowed results the most? If a dork had revealed something genuinely sensitive, what would Module 2 require you to do? Why run both Google and Bing?

Lab 2: Photo Geolocation & Chronolocation Challenge

• Objective: Locate where and estimate when instructor photos were taken.
• Time: 30–40 min / Difficulty: Beginner→Intermediate
• Setup: Instructor distributes the prepared photo set (one with GPS intact, the rest stripped).
• Steps:
  1. Run exiftool -G <photo> on each. On the GPS-intact one, pull coordinates: exiftool -n -gpslatitude -gpslongitude <photo> and open them on a map. Note which photos have no GPS (and why social-media photos usually don’t).
  2. For a stripped photo, inventory visual clues (signs, language, architecture, plates, vegetation).
  3. Narrow region first, then reverse-image-search a cropped distinctive element across Google Lens, Yandex, and Bing.
  4. Confirm the spot with satellite + Street View / Mapillary.
  5. Chronolocate: use SunCalc and the shadow direction/length to estimate the time; sanity-check against any visible weather/season.
  6. State a confidence level (confirmed/likely/possible) for each answer.
• Deliverable: For each photo — location (coordinates or place), the clues used, an estimated time if possible, and a confidence level.
• Debrief questions: Which clue cracked it? Where did EXIF and your visual reasoning agree or disagree? How could a wrong-but-confident geolocation cause real harm (recall the Sunil Tripathi case in Module 7)?

Lab 3: Document Metadata Mining

• Objective: Extract metadata from a set of documents and infer the organization’s username convention and software.
• Time: 25–30 min / Difficulty: Beginner
• Setup: Instructor provides the prepared document set (fake metadata, no real people).
• Steps:
  1. exiftool -G <doc> on each; then batch it: exiftool -r -csv -Author -Creator -Producer -CreateDate ./docs/ > meta.csv.
  2. Open meta.csv and look for patterns across files: author naming, software versions, any internal paths.
  3. Infer the username convention (e.g. first-initial.last) and predict two more likely usernames/emails for the fictional org.
  4. Defender step: sanitize one document — exiftool -all= -overwrite_original <doc> — then re-run exiftool to confirm the metadata is gone.
• Deliverable: The meta.csv, the inferred username convention, and a before/after of the sanitized file.
• Debrief questions: Which field was most revealing? How would an attacker use the username convention next? What one change to a publishing workflow would prevent this leak (Module 9)?

Lab 4: Passive Infrastructure Footprint

• Objective: Map an authorized domain’s external footprint without sending packets to its servers.
• Time: 35–45 min / Difficulty: Intermediate
• Setup: Instructor-owned domain (ideally with subdomains and TXT records). Kali VM with the listed tools.
• Steps:
  1. Registration: whois <target> and curl -s -L https://rdap.org/domain/<target> | jq '.events'.
  2. DNS: dig <target> A +short, then MX, NS, TXT, and dig _dmarc.<target> TXT +short. Identify the mail provider from MX and list every SaaS vendor you can infer from TXT verification tokens.
  3. Subdomains via certificates: curl -s "https://crt.sh/?q=%25.<target>&output=json" | jq -r '.[].name_value' | sort -u.
  4. Subdomains via tool: subfinder -d <target> -silent. Compare to the crt.sh list.
  5. Wayback: echo <target> | waybackurls | head -50 (or gau --subs <target>). Find one old/forgotten path.
  6. (Optional, if the instructor has Shodan access) shodan host <one-resolved-IP> to see exposed services — reading Shodan’s existing scan data, not scanning yourself.
• Deliverable: A one-page footprint: registrar + key dates, mail/DNS providers, inferred SaaS vendors, a de-duplicated subdomain list, and one interesting Wayback find.
• Debrief questions: Which step required zero contact with the target’s servers (answer: all of them)? Why is that the point? Which discovered subdomain would you flag to a defender first, and why?

Extension (Active — authorization required)

Only on scanme.nmap.org or an instructor-owned host with explicit written permission, contrast passive with active recon: run a basic nmap scan and observe that, unlike everything above, this does send packets and would appear in the target’s logs. Discuss why authorization is mandatory here (Module 2 and the passive-vs-active section of the intro script). Do not run this against any other target.

---

Discussion Questions

1. Everything in Lab 4 is “passive.” Draw the line: at what exact step would infrastructure recon become “active,” and why does that line matter legally?
2. You dork an authorized client and find an exposed spreadsheet of customer emails on their site. What do you do next, and what do you not do? (Tie to responsible disclosure in Module 2.)
3. A username tool reports the same handle on 12 platforms. How many of those would you trust without further work, and how would you confirm them?
4. Social platforms strip EXIF, yet geolocation still works constantly. What does that tell you about where the real risk in a photo lives?
5. Metadata mining reveals a software version that’s several years old. Is that a finding worth reporting? To whom, and framed how?
6. Automation frameworks can query dozens of sources in one run. What’s the danger of running one at full breadth against a client, and how does scope (Module 2) constrain it?
7. Which of today’s techniques leaves a footprint on you (OPSEC), and how would you mitigate it (Module 8)?
8. You get contradictory answers: EXIF GPS says one city, but a readable sign says another. How do you resolve it, and what confidence do you report?

References

• See the References sections of 01–06 in this module for the tool and source citations behind these labs.