OSINT Data Collection Tools and Techniques 3 — Questions and Answers
Question 1: What distinguishes 'active' OSINT collection from 'passive' OSINT collection?
- Active collection involves direct interaction with the target's systems; passive does not (Correct answer)
- Active collection uses automated tools; passive is manual
- Active collection is legal; passive collection is not
- Active collection requires a court order; passive does not
Correct answer: Active collection involves direct interaction with the target's systems; passive does not
Active OSINT involves direct interaction with the target (e.g., DNS queries, port scans), which may leave traces, whereas passive relies solely on third-party or cached data.
Question 2: Which Wayback Machine URL parameter retrieves the most recent available snapshot of a given page?
- web.archive.org/web/*/example.com (Correct answer)
- web.archive.org/web/latest/example.com
- archive.org/snapshot?url=example.com
- web.archive.org/retrieve/now/example.com
Correct answer: web.archive.org/web/*/example.com
Using a wildcard (*) in the Wayback Machine URL path displays all available snapshots, from which the most recent can be selected.
Question 3: An analyst uses Recon-ng to collect data. What type of architecture does Recon-ng use to extend its capabilities?
- A modular framework where individual modules handle specific data sources (Correct answer)
- A monolithic binary that queries all sources simultaneously
- A plugin system requiring manual compilation
- A cloud-only SaaS model with API subscriptions
Correct answer: A modular framework where individual modules handle specific data sources
Recon-ng is a modular framework similar to Metasploit where individual modules are loaded to query specific data sources.
Question 4: What is the primary purpose of using a VPN or Tor when performing OSINT data collection?
- To mask the analyst's IP address and reduce the risk of detection or attribution (Correct answer)
- To increase data collection speed through load balancing
- To decrypt HTTPS traffic for deeper inspection
- To bypass CAPTCHA systems on target websites
Correct answer: To mask the analyst's IP address and reduce the risk of detection or attribution
VPNs and Tor anonymize the analyst's source IP, reducing the chance that the target or intermediaries can attribute the collection activity.
Question 5: Which metadata standard commonly embedded in JPEG images can reveal GPS coordinates, device model, and timestamp?
- EXIF (Exchangeable Image File Format) (Correct answer)
- IPTC (International Press Telecommunications Council)
- XMP (Extensible Metadata Platform)
- PNG tEXt chunks
Correct answer: EXIF (Exchangeable Image File Format)
EXIF metadata embedded in JPEG images often contains GPS coordinates, camera model, and capture timestamp useful for OSINT geolocation.
Question 6: What is 'certificate transparency' and how is it useful for OSINT?
- A public log of all issued SSL/TLS certificates that can reveal subdomains and infrastructure (Correct answer)
- A method for verifying HTTPS connections in a browser
- A government registry of approved encryption algorithms
- A tool for revoking compromised certificates
Correct answer: A public log of all issued SSL/TLS certificates that can reveal subdomains and infrastructure
Certificate transparency logs are public, append-only records of issued SSL/TLS certificates that analysts can query to enumerate subdomains and hosts.
Question 7: When collecting data from social media platforms via API, what is the most common throttling mechanism an analyst must manage?
- Rate limits that cap the number of API requests per time window (Correct answer)
- IP-based blacklists applied after first request
- Mandatory CAPTCHA challenges every 100 requests
- Geofencing that blocks requests from outside the platform's country
Correct answer: Rate limits that cap the number of API requests per time window
Social media APIs enforce rate limits — maximum request counts per minute or hour — requiring analysts to implement delays or pagination strategies.
OSINT Data Collection Tools and Techniques 3
What distinguishes 'active' OSINT collection from 'passive' OSINT collection?