Intro to Cybersecurity · How hackers think and act · Day 4 of 4
OSINT Investigation and Wrap-up
A full mini investigation on a fictional target, how scammers choose who to target, and how to make yourself a harder one. Then the CTF winners, recognition, and where to go next.
By the end of today you can
- Run a small OSINT investigation end to end on a fictional case
- Explain how attackers pick and research their targets
- Take practical steps to shrink your own digital footprint
- Know your next steps for learning cybersecurity after this course
You can read a single message now. Today you join the dots across several, the way a real investigation does, and then you turn the whole skill around to protect yourself.
The target is fictional, created for this session. The goal is to see how separate public pieces combine into a picture, so that you understand how a scammer builds one about a real person, and how to give them less to work with.
1. An Investigation Is Connecting Public Dots
Definition
An OSINT investigation is gathering public pieces about one subject and connecting them into a picture that answers a question. One piece is a dot. The value is in the lines you draw between them.
Real-Life Scenario
A fictional company, NovaCrest Ltd, posts a job ad naming its "IT lead, Sade". A public profile for a Sade at NovaCrest lists the exact software she manages. A third public post shows the office reopening Monday. On their own, three harmless facts. Connected, they tell a scammer exactly who to impersonate, what to mention to sound real, and the best day to strike. No secret was leaked. The danger was in the combination.
2. How Scammers Choose a Target
Attackers are not mysterious. They are practical, and they follow a pattern you can learn to interrupt.
| Step | What the attacker does | What gives it away |
|---|---|---|
| Pick | Look for someone reachable with something worth taking | A public role plus public contact details |
| Research | Gather public details to sound convincing | Personal facts scattered across many public posts |
| Pretext | Invent a believable reason to make contact | A story that uses a true detail to earn trust |
| Pressure | Add urgency so you skip checking | Deadlines, threats, "do not tell anyone" |
| Pounce | Ask for the money, the code, or the access | A sudden request that breaks normal process |
Read that table as a defender. Every "what gives it away" is a thing you can watch for. The attack needs all five steps; break any one and it falls apart.
3. Shrink Your Own Footprint
Definition
Your digital footprint is everything about you that is publicly findable. You cannot erase it, but you can make it smaller and less useful to someone building a pretext.
- Separate your worlds. Do not reuse the same username everywhere; it links your accounts into one trail.
- Lock down what need not be public. Set personal profiles to private and review who can see your posts.
- Starve the pretext. The small personal facts you share freely are the exact material a convincing lie is built from.
- Turn on two-factor authentication. A stolen password alone then gets nobody in.
- Search yourself. Look yourself up the way a stranger would, and clean up what surprises you.
Everything you learned to do to a fictional target, do to your own public self once. It is the fastest way to see what a scammer would find, and the most useful hour of security work most people never do.
4. The Mini Investigation
On AquilaCyber, the final case gives you a fictional person or organisation and a question to answer. Work the method you have built over four days.
- State the question. What exactly are you trying to find out?
- Gather dots. Collect only public pieces the case provides. Note where each came from.
- Connect them. Which pieces agree? Which contradict? What picture forms?
- Answer with evidence. Give the conclusion and the dots that support it.
- Capture the flag the case hides for the right answer.
Open Day 4: Final Investigation on AquilaCyber.
Write the question at the top of a fresh note before you gather anything.
Work the five steps, keeping a short trail of where each fact came from.
Submit your conclusion and capture the final flag. Expected: a solved case and a tidy trail you could hand to someone else.
Four days in, you can see weaknesses in systems and build a picture of a person from public scraps. That is real power. Use it only with permission and only to defend: on your own systems, on AquilaCyber, and on your own safety. The skill is neutral. You are not.
You look yourself up the way a stranger would. A few scattered posts, an old username reused in three places, a workplace, a hometown. Nothing secret. Then you see how they line up, and you understand, finally and for yourself, why this course was never really about computers. It was about attention.
Practise
- Connect the dots. Given three harmless public facts about a fictional person, write the one risky conclusion a scammer could draw by combining them.
- Break the chain. Pick one of the five attacker steps and describe one concrete thing a target could do to break it.
- Audit yourself. List three things about you that are publicly findable, and one change you will make to each.
- Finish the game. Complete Day 4: Final Investigation and submit your conclusion with the evidence that supports it.
Checkpoint
What makes an investigation more than a pile of facts?
The connections. A single public detail is harmless. The skill, and the danger, is in the lines you draw between separate public pieces until they answer a question.
If attackers only use public information, how do you defend against them?
By giving them less to connect and fewer ways in: separate usernames, private personal profiles, fewer personal facts scattered publicly, and two-factor authentication so a password alone is not enough.
Where can I legally keep practising after this course?
On training platforms built for it, like AquilaCyber, and public CTFs. On your own machines and accounts. Never on systems or people you do not have permission to test.
Tick Before You Move On
- ☐ I ran a mini investigation end to end on a fictional case
- ☐ I can explain how scammers pick and research a target
- ☐ I audited my own footprint and made at least one change
- ☐ I completed Day 4: Final Investigation on AquilaCyber
Wrap-up
That is the course. Over four days you learned to ask what a system assumes, why a check only counts when the server makes it, how to trace a suspicious message, and how a handful of public facts become a picture of a person.
Now we close the way a CTF should: we read the final leaderboard, we recognise the top solvers, and everyone who finished the challenges earns their recognition for the work.
- CTF winners: the top of the AquilaCyber leaderboard, announced live.
- Recognition: certificates or badges for everyone who completed the challenges.
- Next steps: keep playing CTFs, keep a learning log, and pick one path to go deeper, whether that is web security, OSINT, or defending systems.
You came in seeing locked doors. You leave seeing the questions behind them. That is how hackers think, and now it is how you think too. Use it to build and to protect.
Quick Recap
An investigation connects public dots into a picture that answers a question. Scammers pick, research, pretext, pressure and pounce; break any step and the attack fails. Shrink your footprint: separate usernames, private profiles, fewer public facts, two-factor on. The skill is neutral and powerful. Permission and defence are the whole point.
That is the end of Intro to Cybersecurity. Keep your AquilaCyber account, keep playing, and come back for the next course when you are ready to go deeper.