OSINT challenges are the friendliest way into CTFs. You get a photo, a username or a domain, and a question: where was this taken, who is behind this account, which company owns this server? No exploit, no Linux privilege escalation, just patient searching through information anyone can see. If you want the techniques explained before you start, HackerDNA's OSINT for Hackers course covers image, email, social media and code investigations, one chapter at a time.
This guide lists seven places to practice OSINT challenges in 2026, from guided daily puzzles to a live competition where your flags help find real missing people. It also covers the five techniques that solve most beginner OSINT CTFs and a one-week plan to get you from zero to your first real event.
TL;DR: OSINT challenges ask you to answer a question using only public information: photos, profiles, DNS records, archives. Beginners should start with guided puzzles (HackerDNA's Daily Hack, OSINT Dojo, TryHackMe's OhSINT room), move to open-ended exercises (Gralhix, Sourcing.Games, the OSINT Industries CTF), then join a Trace Labs Search Party once the basics feel easy. Most of what you need is EXIF data, reverse image search, username pivots and the Wayback Machine.
What Are OSINT Challenges?
OSINT challenges are puzzles where you answer an investigative question using open source intelligence: information that is publicly available, such as social media posts, image metadata, DNS and WHOIS records, code repositories and archived web pages. The answer is the flag, usually a place, a name, an email address or a date.
They come in three shapes, and knowing which one you are facing saves a lot of frustration:
- CTF-style challenges have a flag box and a scoreboard. Someone built a fictional persona or planted the clues, and there is exactly one accepted answer. This is what you meet in the OSINT category of most CTF competitions.
- Open exercises give you a task and a write-up, but no answer box. You decide when you are confident, then compare your reasoning with the author's. This is closer to real investigative work.
- Live investigations point you at a real case. The best known is Trace Labs' Search Party, where flags are leads about real missing persons that judges validate and pass on to law enforcement.
OSINT is a natural first category for beginners. Our guide on how to start CTFs as a beginner recommends picking one category and getting good at it before spreading out, and OSINT has the lowest setup cost of all of them: a browser, a notepad and curiosity.
It is also the skill attackers use first. MITRE ATT&CK's Reconnaissance tactic (TA0043) describes how real adversaries gather victim identity information, search open websites and scan public technical databases before touching a target. Every OSINT challenge you solve trains that same reflex, from the defender's side.
The 7 Best Places to Practice OSINT Challenges
The list runs from most guided to most open-ended. Do not jump straight to the bottom: a live investigation with no foundations is four hours of scrolling and zero flags.
| Platform | Format | Answer box | Best for |
|---|---|---|---|
| HackerDNA Daily Hack | Daily guided puzzle, in the browser | Yes | Absolute beginners |
| OSINT Dojo | Learning path, badges, curated challenges | Varies | Building a roadmap |
| TryHackMe OSINT rooms | Guided rooms with questions | Yes | First full CTF-style case |
| Gralhix OSINT exercises | Open exercises with walkthroughs | No | Geolocation and verification |
| Sourcing.Games | Multi-level puzzle games | Yes | People-search and lateral thinking |
| OSINT Industries CTF | CTFd platform, new challenges weekly | Yes | Steady practice with a leaderboard |
| Trace Labs Search Party | Live team event on real cases | Judged | Real-world impact |
1. HackerDNA Daily Hack: Guided OSINT Boards
The HackerDNA Daily Hack is one short, self-contained challenge a day, free and in the browser. Many of them are OSINT boards: you open a set of sources (an email, a WHOIS record, a commit history, a forum profile), correlate them and submit one answer.
Past OSINT days asked players to name the city a holiday photo was taken in from its EXIF GPS and a tram line in the background, unmask an anonymous handle that reused the same username across a code repo, a social account and a forum, and find the real registrant of a domain hidden behind WHOIS privacy by reading the author emails in the company's public commits. Each one is built to take minutes, not hours, and past puzzles stay in the archive with a full write-up explaining the solve.
Why start here: OSINT CTFs punish beginners who do not know which pivot to try next. A board shows you the pivot exists, so you learn the pattern before you need to find it on your own.
2. OSINT Dojo: A Free Roadmap With Badges
OSINT Dojo describes itself as a project to "guide those new to Open Source Intelligence (OSINT) through the first steps of their journey." It offers a simple roadmap, free resources, "simple challenges that build on one another", and badges you can earn and display.
Its resources page is the most useful single bookmark in this guide. It sorts challenges into CTFs (Kase Scenarios, Trace Labs CTFs and several TryHackMe rooms including OhSINT, Sakura, SearchLight and Geolocating Images) and quizzes (Quiztime Crew, Sector035's OSINT Quiz, SEINT_pl). The same page lists tools by job: Sherlock, Maigret and WhatsMyName for usernames, the Wayback Machine and Archive.is for deleted pages, Overpass Turbo for map searches.
3. TryHackMe OSINT Rooms: OhSINT and Sakura
If you want your first OSINT case to feel like a classic CTF, TryHackMe's OhSINT room is the usual starting point. It is rated easy with a 60-minute estimate, and it starts from a single image: every answer comes from following the clues hidden in that picture outward, one free tool at a time.
The Sakura room is a popular follow-up, a longer investigation that OSINT Dojo lists right next to OhSINT. Check each room's tier when you open it, since some TryHackMe rooms are reserved for subscribers.
4. Gralhix OSINT Exercises: Real Verification Work
Sofia Santos started her list of OSINT exercises in December 2022, and it now holds 32 of them. Each exercise has one to four tasks and a separate difficulty rating for novices and experts.
The defining rule is in the description: "No answer boxes, just like in the real world." Every exercise has a full walkthrough you read after you commit to an answer. That format is uncomfortable at first, and that is the point. Real investigators never get a green tick. They get a conclusion they have to defend.
Start with the newer exercises at the bottom of the list. The author notes they are harder but have fewer spoilers floating around online, so you are more likely to solve them honestly.
5. Sourcing.Games: OSINT Puzzles From the Recruiting World
Sourcing.Games is a collection of 43 numbered puzzle games built by Jan Tegze, originally for recruiters and sourcers, the people whose job is finding hard-to-find candidates online. Many were written for SourceCon hackathons and Grandmaster competitions. Game #15 is billed as the first OSINT Sourcing.Game.
The FAQ is clear on two things. Anyone can play ("Games I created are open for everybody"), and sign-up is free, with some levels requiring an account and others none. It is equally clear that you get no hints: "If you are stuck, that's life." Expect URL manipulation, source-code reading, cipher puzzles and people searches. Some old levels break when a third-party site changes, which is itself a lesson in how fragile online evidence is.
6. OSINT Industries CTF: Weekly Challenges and a Leaderboard
The OSINT Industries CTF platform is run by the company behind the OSINT Industries search tool and built on CTFd, the same open-source engine many CTF competitions use. It promises "weekly OSINT challenges, progressive difficulty, realistic investigations, and a public leaderboard," aimed at everyone "whether you are a beginner or a professional."
You register to see the challenges, and there is a Discord server for discussion. The steady weekly rhythm is what makes it valuable: a new challenge every week builds the habit far better than one marathon weekend a year.
7. Trace Labs Search Party: OSINT for Real Missing Persons
Trace Labs is a nonprofit that runs the Search Party CTF, the most meaningful OSINT challenge you can enter. Teams of up to four investigate the online footprint of real missing persons cases. Every flag is a potential lead, submitted with its source so that volunteer judges can validate it, and Trace Labs compiles the results into intelligence reports for law enforcement.
Points reflect how useful a lead is. According to Trace Labs' published scoring system:
- Friends and Family: 10 points
- Employment, Romantic Partners, Basic Subject Info: 50 points
- Advanced Subject Info, Day Last Seen: 250 points
- Advancing the Timeline (evidence of activity after the disappearance): 1,000 points
- Location: 5,000 points
The November 15, 2025 virtual event ran for four hours, was capped at 200 tickets, ended with 73 active teams and was won with 28,300 points. Trace Labs also runs in-person Search Parties at conferences such as DEF CON. Check their site for the next date, because tickets go fast.
Do not make this your first OSINT challenge. Show up once you can pivot from a username to three platforms in under ten minutes, and read the rules twice (more on them below).
Five Techniques That Solve Most Beginner OSINT CTFs
Beginner OSINT challenges are built from a small set of moves. Learn these five and you will recognize the pattern behind most of them. Our full guide to OSINT tools goes deeper on each tool mentioned here.
1. Read the Metadata First
Photos often carry EXIF data: camera model, timestamps and sometimes GPS coordinates. Always check before you start squinting at street signs:
exiftool -a -G1 photo.jpg | grep -iE "gps|date|model"Challenge authors know this trick, so a clean result is common, and most major social networks strip EXIF from photos on upload anyway. But when the coordinates are there, the challenge is half solved in five seconds.
2. Reverse Image Search on More Than One Engine
Google Lens, Bing Visual Search, Yandex Images and TinEye each index different parts of the web and match differently. Crop the image to the distinctive part (a building, a logo, a shop front) instead of searching the whole frame. In practice, cropping does more for your hit rate than switching engines.
3. Pivot on Usernames
People reuse handles. One username found in a challenge usually leads to more accounts. WhatsMyName (in the browser) and Sherlock (on the command line) check hundreds of sites at once:
sherlock m_bianchiTreat each hit as a lead, not proof. Open the profile, compare the avatar, writing style and dates, and only then connect it to your target.
4. Go Back in Time With Archives
The page you need was often edited or deleted, and that is deliberate in many challenges. The Wayback Machine keeps old snapshots, and its CDX API lists every capture of a site in one request:
curl "https://web.archive.org/cdx/search/cdx?url=nimbus-labs.example/*&output=json&limit=20"The same instinct applies to code: a commit history keeps author names and emails long after a README has been cleaned up. git log --format='%an <%ae>' | sort -u on a cloned repository lists every identity that ever committed to it.
5. Read the Picture Like a Map
Geolocation challenges are solved by small details: the language on a sign, which side of the road cars drive on, the shape of road markings, a phone number prefix on a shop window, the angle of shadows. Narrow it to a country, then a city, then confirm on Google Street View or OpenStreetMap. Overpass Turbo lets you query OpenStreetMap for combinations like "pharmacy next to a tram stop", which turns a hunch into a short list of candidates.
How to Approach Any OSINT Challenge
Most beginners do not get stuck because they lack tools. They get stuck because they search randomly and lose track of what they already know. This workflow fixes that:
- Rewrite the question. "Where was this taken?" is vague. "Which city, and the flag format wants it in lowercase" is a target.
- List every clue before searching. Write down each name, handle, date, visible text and object. Clues you skipped are the ones the author planted.
- Pick the strongest pivot. A unique username or exact GPS beats a common first name. Start with whatever narrows the search the most.
- Log every source. Keep the URL, what it told you and when you found it. Trace Labs requires a source with every flag, and it is a good habit long before that.
- Confirm with a second, independent source. One profile saying "Lisbon" is a lead. EXIF coordinates plus a recognizable landmark is an answer.
- Stop and read the write-up when you are truly stuck. After an honest hour, a walkthrough teaches more than another hour of guessing. Note the pivot you missed.
In practice, the classic way to lose an OSINT challenge is not missing the answer. It is finding the right answer early, not verifying it, then abandoning it for a more exciting but wrong lead an hour later. Your log is what stops that.
OSINT Challenges Inside Regular CTF Competitions
Many jeopardy-style CTFs include an OSINT category next to web, crypto and forensics. These challenges are usually short: identify a location, find a deleted post, trace a fictional company employee. They are often the first points a new team scores, which makes them excellent for confidence.
A few things are different from the platforms above:
- The persona is fictional. Organizers create accounts and posts specifically for the event. If your search leads to a real person who is clearly not part of the game, you have gone off track. Stop there.
- Flag formats are strict. Read the format rules: city names, dates and coordinates are usually wanted in a specific form.
- Time pressure is real. A 48-hour event leaves no room for a three-hour rabbit hole. Timebox each challenge and move on.
To find events with an OSINT category, browse upcoming competitions on CTFtime and read their category list before registering. Our guide to CTF competitions explains how to read CTFtime, what event weight means and which events are friendly to a first-time team.
A First-Week OSINT Practice Plan
Here is a plan that takes about 30 to 60 minutes a day and gets you to your first open-ended challenge by the weekend:
- Day 1: Read the OSINT Dojo resources page and bookmark WhatsMyName, the Wayback Machine and two reverse image engines. Solve today's Daily Hack.
- Day 2: Install ExifTool and Sherlock. Run them on your own photos and your own username to see what you leak.
- Day 3: Complete TryHackMe's OhSINT room without a walkthrough. Log every source as you go.
- Day 4: Pick one Gralhix exercise. Write your answer and reasoning before you open the walkthrough, then compare.
- Day 5: Play the first level or two of a Sourcing.Games puzzle and register on the OSINT Industries CTF.
- Weekend: Solve the current OSINT Industries challenge, then find a CTF on CTFtime with an OSINT category and sign up.
Day 2 is the one people skip and the one that sticks. Seeing your own old forum account appear in a username search changes how you think about what you post.
Legal and Ethical Considerations
Critical reminder: OSINT challenges teach skills that can harm real people if misused. Only investigate the targets a challenge gives you, stay passive, and always get explicit written authorization before testing any system.
- Passive only. Looking at public information is OSINT. Logging in to someone's account, triggering a password reset to see if an email is registered, or sending a friend request is not. Trace Labs' Search Party rules ban all of these and disqualify players who break them.
- Never contact anyone connected to a case. In live investigations you do not message the subject, their family, their friends, the media or the police. Findings go through the organizers.
- Stay inside the game. If a CTF trail leads you to a real person who is clearly not the fictional persona, stop. Do not keep digging into someone who never agreed to be a puzzle.
- Do not publish personal data. Write-ups about real-world cases should never include the names, addresses or photos you uncovered. Explain the method, not the person.
- Doxing is not OSINT practice. Using these techniques on a classmate, an ex or an online opponent can be harassment and, in many countries, a crime.
Frequently Asked Questions
What is an OSINT challenge?
An OSINT challenge is a puzzle where you answer an investigative question, such as where a photo was taken or who owns an account, using only publicly available information. In CTF competitions the answer is submitted as a flag. In open exercises you compare your conclusion with a published write-up.
Where can I practice OSINT for free?
Good free starting points are HackerDNA's Daily Hack, OSINT Dojo's resources and challenges, Sofia Santos's Gralhix exercises and Sourcing.Games, which offers free sign-up. TryHackMe's OhSINT and Sakura rooms are popular too, but check each room's tier because access can change.
Are OSINT CTFs good for beginners?
Yes. OSINT is one of the easiest CTF categories to start with because it needs no exploitation skills and almost no setup. A browser, a few free tools and a methodical approach are enough to solve your first challenges.
What tools do I need for OSINT challenges?
Start with ExifTool for image metadata, two or three reverse image search engines, WhatsMyName or Sherlock for usernames, the Wayback Machine for deleted pages and Google Street View for geolocation. Add more tools only when a challenge actually needs them.
What is the Trace Labs Search Party CTF?
It is a team OSINT competition run by the nonprofit Trace Labs. Teams of up to four search for public information about real missing persons cases. Volunteer judges validate each submitted lead, and Trace Labs passes the resulting intelligence to law enforcement. Only passive techniques are allowed.
Is OSINT legal?
Collecting publicly available information is generally legal, but how you use it matters. Accessing private accounts, contacting people under false pretenses, harassment and publishing someone's personal data can all be illegal. Stick to the targets a challenge gives you.
Last verified: November 2026. Platform descriptions and quotes checked on each platform's own pages (OSINT Dojo, Gralhix, Sourcing.Games FAQ, OSINT Industries CTF home page). Trace Labs scoring from its published Categories & Scoring System, and November 2025 event figures from Trace Labs' event recap.
Your Next Steps
OSINT challenges reward patience and good notes more than talent. Start guided, with a Daily Hack board and the OhSINT room, move to Gralhix and the weekly OSINT Industries challenges once you can verify your own answers, and save the Trace Labs Search Party for when the five core techniques feel automatic. That path takes weeks, not years.
Then apply the same reflexes to systems. HackerDNA's OSINT for Hackers course turns these techniques into a recon methodology for pentesting, and the Git Secrets Hunter lab shows how far a single exposed repository can take you. Everything runs in your browser. Start with HackerDNA's free tier - no credit card required.
