Find the signal. Follow the pivot. Verify the evidence.

🔎 What is this?

A practical OSINT & digital investigation playbook focused on finding, connecting and verifying publicly available intelligence.

Not just:

Tool → Command → Result

Instead:

LEAD
 ↓
DISCOVER
 ↓
PIVOT
 ↓
CORRELATE
 ↓
VERIFY
 ↓
DOCUMENT

Tools produce results. Investigators produce intelligence.

🧬 Investigation Model

             ┌──────────────┐
             │  INITIAL LEAD│
             └──────┬───────┘
                    ↓
          ┌───────────────────┐
          │     DISCOVERY     │
          └─────────┬─────────┘
                    ↓
          ┌───────────────────┐
          │       PIVOT       │
          └─────────┬─────────┘
                    ↓
          ┌───────────────────┐
          │    CORRELATION    │
          └─────────┬─────────┘
                    ↓
          ┌───────────────────┐
          │   VERIFICATION    │
          └─────────┬─────────┘
                    ↓
          ┌───────────────────┐
          │     EVIDENCE      │
          └───────────────────┘

📚 Playbook

👤 Identity & Username

01 Username OSINT · 02 Sherlock · 03 Maigret

Discover public profiles and investigate username reuse across platforms.

🌐 Search & Social

04 Search Engines · 05 Social Media OSINT · 07 Search Engines OSINT

Search smarter using operators, pivots, context and independent sources.

🖼️ Image Intelligence

06 Reverse Image OSINT

TinEye  •  Google Lens  •  Bing Visual Search

Find public matches, historical appearances and visual connections.

🌍 Infrastructure

08 Domain & DNS · 09 WHOIS/RDAP · 10 Certificate Transparency

Move from:

DOMAIN → DNS → SUBDOMAIN → CERTIFICATE → INFRASTRUCTURE

📄 Documents & Metadata

11 Public Documents · 12 Metadata

Extract useful investigative context from publicly available files and images.

📧 Email Intelligence

15 Email OSINT

Treat an email as an investigation pivot, not an endpoint.

🧪 Practical Case Study

This repository includes a real investigation workflow demonstrating how one public lead can develop into multiple pivots.

redteamerx
     ↓
public bio
     ↓
h4cker_fawad
     ↓
public links
     ↓
GitHub
     ↓
public identifiers
     ↓
email
     ↓
reverse-image research
     ↓
metadata / username correlation
     ↓
verification

Evidence

All screenshots are organized inside:

evidence/
├── 01-redteamerx.png
├── 02-h4cker-fawad.png
├── 03-public-links.png
├── 04-github.png
├── 05-github-finding.png
├── 06-facebook-email.png
├── 07-tineye.png
├── 08-google-lens.png
├── 09-bing.png
├── 10-exif.png
├── 11-maigret.png
└── 12-google-lens-metadata.png

🧠 Investigator Rules

01  A result is a lead.
02  A lead is not automatically evidence.
03  Correlation is not proof.
04  Verify important findings independently.
05  Separate FACT from INFERENCE.
06  Preserve the evidence trail.

📈 PLAYBOOK STATUS

████████████████████████████████████████
                EXPANDING
████████████████████████████████████████

New tools, methodologies, research and case studies are continuously being added.

⚖️ Responsible Use

For:

  • OSINT education
  • Security research
  • Digital investigations
  • Authorized assessments
  • Academic research

Respect privacy. Do not use these techniques for unauthorized access, harassment, credential theft or unnecessary exposure of personal information.

👤 Author

Fawad Qureshi
Offensive Security Researcher • OSINT • Red Teaming • Security Research

⭐ Star the repository if you find it useful.