Producción beta La plataforma está en fase de pruebas y transformación continua. Puedes subir cursos y usar el campus con normalidad; disculpa cualquier ajuste temporal mientras consolidamos la experiencia.
VULNHUNTERS ACADEMY
ES RU
OSINT

OSINT Defensive Intelligence

Learn to turn open sources into useful intelligence without crossing legal or privacy boundaries. The focus is protection, verification, and responsible communication.

Direct purchase Access tools Talk to admissions
6 weeks Beginner to intermediate 12 August 2026 Pablo C. - CTI analyst 490 USD
Imagen of the curso OSINT Defensive Intelligence
OSINT OSINT Defensive Intelligence

Program outcome

You will be able to create a defensive OSINT report, verify findings, and recommend exposure-reduction measures.

Learning objectives

  • Understand the professional objective of the course and its ethical boundaries.
  • Apply an ordered methodology before running tools.
  • Work with safe labs and reproducible evidence.
  • Separate noise, valid findings, impact, and recommendation.
  • Prepare clear and defensible technical deliverables.
  • Communicate results to technical and non-technical audiences.

High-level syllabus

  • Ethics, privacy, and source traceability.
  • Mapping public presence and digital assets.
  • Verification of identity, domains, and public leaks.
  • Brand protection and impersonation detection.
  • Risk matrices and finding prioritization.
  • Defensive report and remediation plan.

Included labs

  • OSINT audit of a fictional brand.
  • Detection of lookalike domains and fake profiles.
  • Personal exposure reduction plan.

Guided path for inexperienced students

The course is prepared so a student without professional experience can progress through short exercises, guided examples, and evidence reviews.

Week 0 - Arranque guided

Prepare the environment, vocabulary, and expectations without initial friction.

  • Validate campus access.
  • Create the note structure.
  • Review ethical rules and scope.
  • Complete the orientation practice.

Expected result: The student knows how to study and how to submit evidence.

Bloque 1 - Foundations aplicados

Turn minimum theory into observable actions.

  • Read short examples.
  • Complete guided checklists.
  • Compare good and poor evidence.

Expected result: The student understands what to do before using tools.

Bloque 2 - Practice supervisada

Run labs with judgment and traceability.

  • Record steps.
  • Explain decisions.
  • Request review on specific questions.

Expected result: The student can repeat the lab without copying mechanically.

Bloque 3 - Entrega professional

Turn results into a clear report.

  • Prioritize findings.
  • Write impact.
  • Defend recommendations.

Expected result: The student presents a useful and defensible deliverable.

Step-by-step study method

An operational guide to study with less friction and better retention.

Weekly learning playbook

Before each session

  • Read the weekly objective.
  • Prepare notes and evidence.
  • Check the lab and tools.

During practice

  • Note the step, result, and conclusion.
  • Avoid skipping hypotheses.
  • Save only relevant evidence.

After practice

  • Summarize the learning.
  • Mark questions.
  • Correct the deliverable before submitting it.

Weekly close

  • Compare against the rubric.
  • Review common mistakes.
  • Plan the next block.

Micro-exercises to start with confidence

Short practices to master foundations before entering longer scenarios.

Micro-practice

Micro 1 - Scenario reading

Understand context, scope, and objective before acting.

Duration: 20 min

  • Read the case.
  • Identify relevant assets or data.
  • Write three possible risks.

Mastery signal: You can explain the scenario without looking at the guide.

Micro-practice

Micro 2 - Minimum evidence

Document a test in a reproducible way.

Duration: 25 min

  • Record date and context.
  • Capture the result.
  • Write a short conclusion.

Mastery signal: Another student can repeat your steps.

Micro-practice

Micro 3 - Prioritization

Sort findings by impact and urgency.

Duration: 30 min

  • List three findings.
  • Assign impact.
  • Justify the order.

Mastery signal: The priority is understandable without jargon.

Micro-practice

Micro 4 - Communication

Turn a technical result into a recommendation.

Duration: 30 min

  • Separate cause, impact, and action.
  • Remove unnecessary jargon.
  • Close with the next step.

Mastery signal: The message supports a decision.

Essential glossary for beginners

Simple definitions so technical language does not slow your progress.

Scope

Exact limits of what may be analyzed or executed.

Example: Only lab assets or assets from the authorized case.

Evidence

Data that proves a technical or risk observation.

Example: Screenshot, log, command, query, or document with context.

Traceability

Ability to reconstruct what was done, when, and why.

Example: Logbook ordered by date and lab.

Indicator

Observable signal that helps investigate or validate a case.

Example: Domain, hash, IP, event, policy, or permission.

Playbook

Repeatable procedure for acting on a case.

Example: Triage, containment, documentation, and closure steps.

Remediation

Action to reduce or remove risk.

Example: Patch, policy change, hardening, or training.

Common mistakes by new students (and how to correct them)

Real blocking patterns and the immediate corrective action.

Starting with tools without understanding the objective.

Cause: Impatience or lack of method.

Correction: Read the scenario, scope, and success criteria before acting.

Saving evidence without context.

Cause: Confusing a screenshot with proof.

Correction: Note step, result, conclusion, and date.

Prioritizing by intuition.

Cause: Not connecting technique with impact.

Correction: Use impact, likelihood, and urgency as criteria.

Copying commands or templates without understanding.

Cause: Mechanical learning.

Correction: Rewrite in your own words and validate with the mentor.

FAQ for students without offensive experience

Direct answers to typical questions from the first month.

Can I join if I am a beginner?

Yes. The course file includes leveling material, a weekly routine, and micro-practices so you can start in an organized way.

What happens if I get stuck?

You must document what you tried, write a specific question, and review the rubric before asking for help.

Do I need paid tools?

Not for the base path. Community tools, internal labs, and internal templates are prioritized.

How is it assessed?

Through evidence, deliverables, quality criteria, and final project defense.

Complete path for students without experience

A progress path with concrete criteria to advance without jumps or frustration.

Level-by-level progress ladder

Level 1 - Understanding

Window: First third of the course

What you will already be able to do:

  • Explain core concepts.
  • Prepare the environment.
  • Follow the guided checklist.

Mentor support:

  • Review of initial evidence.
  • Correction of vocabulary questions.

Exit criterion: You can explain a simple lab in your own words.

Level 2 - Practice

Window: Central block

What you will already be able to do:

  • Run labs.
  • Record results.
  • Distinguish noise from findings.

Mentor support:

  • Feedback on prioritization.
  • Deliverable review.

Exit criterion: Your evidence allows the exercise to be repeated.

Level 3 - Autonomy

Window: Course closing stage

What you will already be able to do:

  • Solve the full case.
  • Write the report.
  • Defend recommendations.

Mentor support:

  • Defense simulation.
  • Final report correction.

Exit criterion: You present a professional and coherent deliverable.

Step-by-step guided cases

Educational scenarios to practice technical decisions, evidence, and professional communication.

Initial

Case 1 - Operational preparation

Configure environment, scope, and logbook.

Case steps

  • Read the briefing.
  • Prepare the folder structure.
  • Define evidence criteria.

Case deliverable: Initial logbook and environment checklist.

Intermediate

Case 2 - Guided analysis

Apply methodology to a controlled case.

Case steps

  • Observe signals.
  • Run the permitted practice.
  • Record findings.

Case deliverable: Short report with evidence and recommendations.

Closing stage

Case 3 - Professional presentation

Communicate the result to a mixed audience.

Case steps

  • Prioritize risks.
  • Prepare the executive summary.
  • Defend decisions.

Case deliverable: Final presentation and technical appendix.

Complete weekly plan

Professional schedule with sessions, weekly focus, and required deliverables.

Week 1

Ethics, privacy, and source traceability.

  • Guided class: concepts, common mistakes, and module examples.
  • Lab: OSINT audit of a fictional brand.
  • Trabajo with herramienta o template: Maltego CE
  • Review of questions, evidence, and delivery criteria.

Deliverable: Weekly logbook with evidence, conclusion, and recommended action.

Week 2

Mapping public presence and digital assets.

  • Guided class: concepts, common mistakes, and module examples.
  • Lab: Detection of lookalike domains and fake profiles.
  • Trabajo with herramienta o template: Have I Been Pwned
  • Review of questions, evidence, and delivery criteria.

Deliverable: Weekly logbook with evidence, conclusion, and recommended action.

Week 3

Verification of identity, domains, and public leaks.

  • Guided class: concepts, common mistakes, and module examples.
  • Lab: Personal exposure reduction plan.
  • Trabajo with herramienta o template: crt.sh
  • Review of questions, evidence, and delivery criteria.

Deliverable: Weekly logbook with evidence, conclusion, and recommended action.

Week 4

Brand protection and impersonation detection.

  • Guided class: concepts, common mistakes, and module examples.
  • Lab: OSINT audit of a fictional brand.
  • Trabajo with herramienta o template: Wayback Machine
  • Review of questions, evidence, and delivery criteria.

Deliverable: Weekly logbook with evidence, conclusion, and recommended action.

Week 5

Risk matrices and finding prioritization.

  • Guided class: concepts, common mistakes, and module examples.
  • Lab: Detection of lookalike domains and fake profiles.
  • Trabajo with herramienta o template: SpiderFoot
  • Review of questions, evidence, and delivery criteria.

Deliverable: Weekly logbook with evidence, conclusion, and recommended action.

Week 6

Defensive report and remediation plan.

  • Guided class: concepts, common mistakes, and module examples.
  • Lab: Personal exposure reduction plan.
  • Trabajo with herramienta o template: Maltego CE
  • Review of questions, evidence, and delivery criteria.

Deliverable: Weekly logbook with evidence, conclusion, and recommended action.

Detailed curriculum by module

Internal lessons, practices, and quality deliverables for every module.

M01

Ethics, privacy, and source traceability.

7h

Master this block with practice, evidence, and professional judgment.

Concepts and operational vocabulary

  • Module objective.
  • Key terms.
  • Ethical and technical limits.

Practice: Concept map applied to the course case.

Deliverable: One-page operational summary.

Step-by-step procedure

  • Preparation.
  • Controlled execution.
  • Result recording.

Practice: Ejercicio guiado usando Maltego CE.

Deliverable: Logbook with reproducible evidence.

Closing and communication

  • Validation.
  • Prioritization.
  • Professional recommendation.

Practice: Writing a finding or decision.

Deliverable: Rubric-reviewable submission.

M02

Mapping public presence and digital assets.

7h

Master this block with practice, evidence, and professional judgment.

Concepts and operational vocabulary

  • Module objective.
  • Key terms.
  • Ethical and technical limits.

Practice: Concept map applied to the course case.

Deliverable: One-page operational summary.

Step-by-step procedure

  • Preparation.
  • Controlled execution.
  • Result recording.

Practice: Ejercicio guiado usando Have I Been Pwned.

Deliverable: Logbook with reproducible evidence.

Closing and communication

  • Validation.
  • Prioritization.
  • Professional recommendation.

Practice: Writing a finding or decision.

Deliverable: Rubric-reviewable submission.

M03

Verification of identity, domains, and public leaks.

7h

Master this block with practice, evidence, and professional judgment.

Concepts and operational vocabulary

  • Module objective.
  • Key terms.
  • Ethical and technical limits.

Practice: Concept map applied to the course case.

Deliverable: One-page operational summary.

Step-by-step procedure

  • Preparation.
  • Controlled execution.
  • Result recording.

Practice: Ejercicio guiado usando crt.sh.

Deliverable: Logbook with reproducible evidence.

Closing and communication

  • Validation.
  • Prioritization.
  • Professional recommendation.

Practice: Writing a finding or decision.

Deliverable: Rubric-reviewable submission.

M04

Brand protection and impersonation detection.

7h

Master this block with practice, evidence, and professional judgment.

Concepts and operational vocabulary

  • Module objective.
  • Key terms.
  • Ethical and technical limits.

Practice: Concept map applied to the course case.

Deliverable: One-page operational summary.

Step-by-step procedure

  • Preparation.
  • Controlled execution.
  • Result recording.

Practice: Ejercicio guiado usando Wayback Machine.

Deliverable: Logbook with reproducible evidence.

Closing and communication

  • Validation.
  • Prioritization.
  • Professional recommendation.

Practice: Writing a finding or decision.

Deliverable: Rubric-reviewable submission.

M05

Risk matrices and finding prioritization.

7h

Master this block with practice, evidence, and professional judgment.

Concepts and operational vocabulary

  • Module objective.
  • Key terms.
  • Ethical and technical limits.

Practice: Concept map applied to the course case.

Deliverable: One-page operational summary.

Step-by-step procedure

  • Preparation.
  • Controlled execution.
  • Result recording.

Practice: Ejercicio guiado usando SpiderFoot.

Deliverable: Logbook with reproducible evidence.

Closing and communication

  • Validation.
  • Prioritization.
  • Professional recommendation.

Practice: Writing a finding or decision.

Deliverable: Rubric-reviewable submission.

M06

Defensive report and remediation plan.

7h

Master this block with practice, evidence, and professional judgment.

Concepts and operational vocabulary

  • Module objective.
  • Key terms.
  • Ethical and technical limits.

Practice: Concept map applied to the course case.

Deliverable: One-page operational summary.

Step-by-step procedure

  • Preparation.
  • Controlled execution.
  • Result recording.

Practice: Ejercicio guiado usando Maltego CE.

Deliverable: Logbook with reproducible evidence.

Closing and communication

  • Validation.
  • Prioritization.
  • Professional recommendation.

Practice: Writing a finding or decision.

Deliverable: Rubric-reviewable submission.

Lab catalog

Realistic practice with measurable objectives and auditable evidence.

LAB-01

OSINT audit of a fictional brand.

Escenario academico aislado para practicar investigacion abierta defensiva, privacidad y verificacion.

Estimated duration: 5h

Objectives

  • Prepare a safe environment.
  • Run the practice with traceability.
  • Extract evidence and conclusions.

Required evidence

  • Technical logbook.
  • Relevant screenshots or records.
  • Prioritized recommendations.
LAB-02

Detection of lookalike domains and fake profiles.

Escenario academico aislado para practicar investigacion abierta defensiva, privacidad y verificacion.

Estimated duration: 5h

Objectives

  • Prepare a safe environment.
  • Run the practice with traceability.
  • Extract evidence and conclusions.

Required evidence

  • Technical logbook.
  • Relevant screenshots or records.
  • Prioritized recommendations.
LAB-03

Personal exposure reduction plan.

Escenario academico aislado para practicar investigacion abierta defensiva, privacidad y verificacion.

Estimated duration: 5h

Objectives

  • Prepare a safe environment.
  • Run the practice with traceability.
  • Extract evidence and conclusions.

Required evidence

  • Technical logbook.
  • Relevant screenshots or records.
  • Prioritized recommendations.

Assessment system

  • Comprehension quizzes (10%): They validate vocabulary, limits, and baseline judgment.
  • Lab deliverables (35%): Evidence, order, reproducibility, and conclusions are reviewed.
  • Intermediate report (15%): Assesses technical clarity, prioritization, and recommendations.
  • Final capstone (30%): Full project with defense and professional rubric.
  • Technical participation (10%): Questions, peer reviews, and continuous improvement.

Final project: verifiable defensive OSINT report

The student collects public signals, verifies sources, avoids sensitive data, and delivers an exposure-reduction report.

Project phases

  • Briefing and scope.
  • Case execution.
  • Evidence record.
  • Final report.
  • Oral or written defense.

Complete course documentation

Academic documentation pack to run the course at professional standard, without depending on a demo.

Document

D1 - Official syllabus

Defines objectives, schedule, and assessment criteria.

  • Competencies by module.
  • Weekly calendar.
  • Academic rules.
  • Summarized rubric.
Document

D2 - Manual of lab

Explica preparacion, ejecucion segura y cierre de practicas.

  • Requisitos tecnicos.
  • Flujo de snapshot o respaldo.
  • Checklist antes/despues.
  • Canal de soporte.
Document

D3 - Guia of evidence

Estandariza bitacoras, capturas y conclusiones.

  • Formato de evidencia.
  • Trazabilidad.
  • Control de versiones.
  • Errores frecuentes.
Document

D4 - Plantilla of report

Convierte practica tecnica en entrega profesional.

  • Resumen ejecutivo.
  • Detalle tecnico.
  • Riesgo y prioridad.
  • Plan de accion.
Document

D5 - Guia of certification

Describe evaluacion, recuperacion y verificacion.

  • Blueprint.
  • Criterios de aprobacion.
  • Recuperaciones.
  • Emision de certificado.

Academic and ethical policies

  • All practices are performed only in environments authorized by the academy.
  • Course techniques may not be used against third parties without explicit permission.
  • Every submission must include evidence and sources used.
  • Plagiarism of reports or evidence results in academic suspension.
  • Certification requires passing deliverables and the final project.