Step 170. Introduction to OSINT — Social Media Collection and Digital Footprints

Level 2 — Introduction to Security and Attack Skill Basics | Difficulty ★★☆☆☆ | Estimated time: 2 hours 30 minutes

Prerequisites: the web basics from Step 73 (HTTP), the pattern sense from Step 48 (regular expressions). You can read files with Python.

What you need: Python 3, a text editor, and a list of your own usernames (the collection target is you and only you).
⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime.
Ethics notice: the target of OSINT is you and only you. Investigating other people can become stalking, and even public information can break the law depending on the purpose and method of collection.

OSINT (Open Source Intelligence) is "the skill of finding out without breaking in." Without a single login, using only search and public pages, a person’s interests, region, and active hours take shape. The secret is that people have a habit of using the same username across sites — with one username you find accounts on dozens of sites, and joining the pieces produces a picture close to an identity. Today we learn the principle of this technique, but the target is strictly you yourself. Knowing how exposed your own information is — that’s where privacy defense begins.

1. Learning Objectives

By the end of this chapter, you will be able to:

Explain the definition of OSINT and the boundary of legality (public information, purpose, consent)
Demonstrate the principle of username correlation with a simulation
Distinguish the uses of search operators (quotes, site:, filetype:)
Verify by measurement why file metadata is an information-exposure path
Write a map of your own digital footprint and an exposure-reduction plan

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

Category	Details
Language/environment	Python 3 (standard library), a web browser (for search-operator practice)
Today’s tools	`os.stat()` (metadata), search operators, sherlock (concept introduction)
Concepts needed	OSINT, username correlation, digital footprint, metadata, false positives
Today’s artifact	`my-footprint-map.md` + 3 exposure-reduction plans

2-1. The Three Collection Principles of OSINT

Attacker or defender, the rules of OSINT are the same.

① Look only at what's public — don't break logins, don't bypass privacy settings
② Leave records — write down when, where, and what you saw, with sources
③ Have a purpose — not "because I'm curious" but "what am I trying to confirm" comes first

"Public" doesn’t mean "anything goes." Even collecting public information gets sorted by the law according to purpose and target. That’s why this chapter’s target is exactly one person — you. Self-investigation has a clear purpose too: defense (reducing exposure).

2-2. Username Correlation — One Username, Dozens of Faces

People can only remember a few usernames, so they often reuse the same one even as sites change. To a collector, a username is a thread connecting many sites. Once you obtain a username on one site, you check whether the same username exists on other sites and bundle the profiles into one person.

The tool that automates this process is sherlock — feed it one username and it checks existence against the profile-URL rules of hundreds of sites. The principle is simple: each site has a profile URL of the form site-address/username, and it just asks whether that page exists (whether it’s HTTP 200). Today, with no external access, you experience this principle through a local simulation.

2-3. Digital Footprints — Unintended Traces

A digital footprint is the sum of traces left by online activity. It divides into two kinds.

Active footprint: posts, photos, and profile bios you uploaded yourself
Passive footprint: what remains unintentionally — a photo’s shooting location, a file’s author name, old posts caught by search

The representative passive footprint is metadata — "data attached to data." A photo file’s shooting time, device model, GPS coordinates (Exif); a document file’s author and modification time — things like that. There have actually been multiple incidents where the body was scrubbed but leftover metadata exposed an identity.

2-4. Search Operators — Turning the Search Box into an Investigation Tool

A search engine is not a simple keyword box. With operators, it becomes a collection tool.

Operator	Meaning	Example
`"exact phrase"`	Only this string verbatim	`"my_nick_2024"`
`site:domain`	Only inside that site	`site:github.com my_nick`
`filetype:extension`	Only files of that format	`Kim Minseo filetype:pdf`
`-word`	Exclude that word	`my_nick -shopping`

Using these operators to search your own name and username is today’s core activity. What gets caught is exactly "you as others see you."

3. Follow Along

3-1. Seeing Metadata Directly — What a File Tells You

Let’s read the information attached to a file, beyond its body, with Python.

Input:

import os, datetime

p = "note.txt"
with open(p, "w", encoding="utf-8") as f:
    f.write("Today's lab notesn")

st = os.stat(p)
print("File size:", st.st_size, "bytes")
print("Modified time:", datetime.datetime.fromtimestamp(st.st_mtime))
print("Created time:", datetime.datetime.fromtimestamp(st.st_ctime), "(on Windows)")

Output (measured 2026-09-09):

File size: 25 bytes
Modified time: 2026-09-09 16:50:38.790924
Created time: 2026-09-09 16:50:38.790924 (on Windows)

How to read it: the content is one line, yet the file already tells you three things — when it was made, when it was changed, and how big it is. With a photo, the shooting device and GPS coordinates (Exif) ride along on top of that. When you upload a document online, its metadata goes up with it — this is the substance of the passive footprint.

Why do this: this experiment drills into your body the sense that it’s not "delete and it’s over" but "you must manage the attached information too, and then it’s over."

3-2. A Username Correlation Simulation

Experience sherlock’s principle with no external access. Search for one username in a fictional site registry (all fabricated data).

Input:

registry = {
    "devhub.example":    ["minseo_dev", "bluefox"],
    "photo.site.example":["bluefox", "camera_jin"],
    "game.pizza.example":["minseo_dev", "bluefox", "nightowl"],
    "music.note.example":["bluefox7"],   # similar but a different username
}
target = "bluefox"
hits = [site for site, users in registry.items() if target in users]
print("Username correlation lookup:", target)
for h in hits:
    print("  found:", h)
print("Similar-username caution:", [u for us in registry.values() for u in us
                                    if u.startswith(target) and u != target])

Output (measured 2026-09-09):

Username correlation lookup: bluefox
  found: devhub.example
  found: photo.site.example
  found: game.pizza.example
Similar-username caution: ['bluefox7']

How to read it: one username connected three sites. In real collection, interests (photos, games) and activity patterns are read from profiles bundled this way. And the last line matters — bluefox7 is similar but may be a different person. The output of automated collection tools must always be verified by eye.

3-3. What Sherlock Looks Like — Screen Example

Real sherlock runs the same check automatically across hundreds of sites. Since external lookups are required, we learn its shape through a screen example.

Screen example (what running sherlock on a username looks like):
[*] Checking username bluefox on:
[+] GitHub: https://github.com/bluefox
[+] Reddit: https://www.reddit.com/user/bluefox
[-] Instagram: Not found!
[+] Steam: https://steamcommunity.com/id/bluefox
...
[*] Search completed with 47 results

How to read it: [+] only means "a page at that address exists" — it does not mean it’s that person’s account. Someone else may have claimed it first (the 3-2 bluefox7 problem), and sites sometimes lie about existence (false positives). A tool’s output is a "list of candidates to confirm," not a "conclusion" — you must visit each one and cross-check whether the profile picture and activity match.

3-4. Self-Investigation with Search Operators — Screen Example

This is an activity you do yourself in the browser’s search box. Search the following with your own username and name, and record what gets caught.

"my_username"                ← wrap in quotes to match exactly that username
site:github.com my_username  ← traces inside a specific site
my_name filetype:pdf         ← whether your real name appears in public documents
my_username -shopping        ← excluding noise

Screen example (what a search-results record looks like):
Query: "bluefox"
  - 3 community posts from 5 years ago (nickname & interests exposed)
  - 1 GitHub repository (email address exposed in commits)
Query: real name filetype:pdf
  - 1 school event roster PDF (real name & affiliation exposed)

How to read it: each caught result is "something others can know." In particular, emails in GitHub commits, old community posts, and roster PDFs — search engines remember them even if you’ve forgotten. The names and sites in the example are fabricated; filling in your results with real searches is the mission.

3-5. Drawing Your Footprint Map

Weave what you collected into a single document. The template looks like this.

# My Digital Footprint Map (date: ____)

### What's exposed
| Item | Where found | Who can see it | Risk |
|------|--------|----------------|--------|
| (e.g.) username–real-name link | community post | everyone | high |

### Exposure-reduction plan
1. (e.g.) delete the old community account or change the nickname
2. (e.g.) separate usernames per site — so they can't be bundled into one
3. (e.g.) for public documents exposing my real name, request removal from the poster

How to read it: the criterion for risk is "does this piece connect to other pieces?" One username is weak, but username + real name + region connecting becomes an identity picture. Write the reduction plan in the direction of "cutting the connecting threads."

4. Missions & Exercises

Mission — One-Part Footprint Map + Executing a Reduction Measure

Actually run the four 3-4 search operators on your own username and name, and record the results
Write my-footprint-map.md using the 3-5 template — at least 3 exposed items
Execute one of the exposure-reduction plans today (switching to private, deleting old posts, etc.)
Attach to every exposed item its source (the query) — "where was it found"
Even if other people’s information appears on screen, don’t record it — the target is you alone

Exercises

Exercise 1. Explain why OSINT’s principle of "looking only at public information" connects to a legal boundary.

Exercise 2. Give two reasons why sherlock’s [+] doesn’t mean "that person’s account."

Exercise 3. Explain the difference between active and passive footprints with a metadata example.

Exercise 4. Explain why a reduction plan should center on "cutting the threads connecting the pieces" rather than "erasing the pieces."

5. Model Answers & Completion Criteria

Mission Model Answer

An example paragraph of a completed map (contents are a fabricated example — fill yours with real search results):

### What's exposed
| Item | Where found | Who can see it | Risk |
|------|--------|----------------|--------|
| GitHub account identified via username | "my_username" search | everyone | medium |
| Personal email exposed in commits | site:github.com my_username | everyone | high |
| Location hints in 5-year-old community posts | "my_username" | everyone | medium |

### Exposure-reduction plan
1. Change the GitHub commit email to a noreply address — done today
2. Switch the community account to private — within this week
3. Use separate usernames per site from now on

How to verify: ① does every item have its source (query)? ② did you actually execute one of the plans? ③ is there no one else’s information in the record? ④ can a third party reading the map understand "what this person is trying to erase and why"? All being "yes" means complete.

Exercise Answers

Answer 1. The law looks not only at the nature of information but at the purpose and method of collection. Even public information can become stalking if collected repeatedly with the purpose of tracking a specific person, and the moment you bypass a privacy setting, that information is no longer "public." So OSINT’s first rule is confirming the legality of target, purpose, and method — and this chapter limits the target to yourself so you can learn that boundary safely.

Answer 2. First, someone else may already be using the same username — a username isn’t one-of-a-kind in the world (see 3-2’s bluefox7). Second, there are false positives where a site’s response style shows existence for nonexistent accounts — the tool only sees "the page opened." So tool output is a candidate to confirm, and collection includes the visiting and cross-checking.

Answer 3. An active footprint is what remains from the act of uploading itself — posts, photos, bios. A passive footprint is what rides along regardless of intent. Uploading a photo is active, but the shooting location, device model, and time attached to that photo file’s Exif are passive. As you confirmed in 3-1, a file is already speaking information beyond its body.

Answer 4. Each piece is often harmless on its own — hard to erase them all, and no need to. Danger arises when pieces connect into an identity picture. Since the same username is that connector, separating usernames and cutting the username–real-name link is the way to block picture formation with little effort. Defense just thinks the reverse of attack — what the attacker "connects," the defender "cuts."

Completion Criteria Checklist

[ ] I can state OSINT’s three collection principles
[ ] I read file metadata with os.stat()
[ ] I ran the username correlation simulation
[ ] I can distinguish the uses of the 4 search operators
[ ] I understand that sherlock’s [+] is a candidate, not a conclusion
[ ] I completed a footprint map with myself as the target
[ ] I executed at least one exposure-reduction measure

6. Common Pitfalls & Fixes

Wall 1. I get FileNotFoundError

Symptom (measured 2026-09-09, running os.stat() on a nonexistent file):

FileNotFoundError: [WinError 2] The system cannot find the file specified: 'nofile.txt'

Cause: you read the file before creating it, or the name is wrong.
Fix: as in 3-1, create the file first with with open(p, "w") and then read it. The habit of copying filenames instead of typing them prevents typos.

Wall 2. I hear that sherlock results come out all [+]

Symptom: you fed it a username and even sites where it can’t possibly exist show found.
Cause: when a site shows a "sign up" page with status 200 even for nonexistent usernames, the tool misjudges it as existing — a false positive.
Fix: doubt the tool and have a human confirm. Visiting each output line and cross-checking whether the profile content matches the target — that, too, is part of collection.

Wall 3. Concluding "no exposure" because search returned 0 results

Symptom: searching "my_username" shows an empty screen.
Cause: what search engines don’t know and what doesn’t exist are different — private groups and sites that block search aren’t caught.
Fix: write only up to "not caught by search." And change the operators (drop the quotes, specify site:) to look again from other angles. More angles make a more accurate picture.

Wall 4. While writing the map, I’m recording someone else’s information

Symptom: you’re recording the profile of a different person who uses the same username.
Cause: the 3-2 similar-username problem — the same username can belong to a different person.
Fix: delete it immediately. This chapter’s target is you alone, and others’ information is neither collected nor recorded. This one rule is what separates a hobby from a crime.

Wall 5. The reduction plan ends at "delete everything"

Symptom: the plan is one line — "delete all accounts."
Cause: a plan without priorities never gets executed.
Fix: assign risk levels as in 3-5 and cut the "connecting threads" first. Start with what you can execute today, like changing your GitHub email — one small execution beats ten grand plans.

7. Summary

Today’s Concepts

Concept	One-line explanation
OSINT	An investigation technique that draws a picture from public sources alone
Collection principles	Public only · leave records · purpose first
Username correlation	A technique connecting accounts across sites via the same username
Digital footprint	Traces of online activity — active (what you posted) + passive (what rode along)
Metadata	Data attached to data — Exif, author, timestamps
False positive	A tool’s misjudgment saying something exists when it doesn’t — filtered by visiting to confirm
sherlock	The representative collection tool checking one username against hundreds of sites

Today’s Commands & Tools

Tool	What it does
`os.stat("file")`	Reading file metadata — size, timestamps
`datetime.fromtimestamp()`	Converting a timestamp to human time
`"username"` (quotes)	Searching exactly that string
`site:domain keyword`	Searching only inside a specific site
`filetype:pdf keyword`	Searching only public document files
`sherlock username`	(concept experience) checking account existence across many sites

An Instinct More Important Than Commands

Today you looked at yourself through an attacker’s eyes. Frighteningly, all it took was a search box and a few rules. This perspective shift is this chapter’s gift — defense begins with knowing "how others see me." And for the same reason, this skill’s trigger lies not in technique but in ethics. Carry today’s rule — target limited to yourself — as a lifelong rule. Skill is the ability to investigate; character is the ability to choose not to.

Once every box is checked, Step 170 is complete.