HACKING PROJECT · social · Intermediate
OSINT Personal-Exposure Dashboard
Aggregate and risk-score an individual's public digital footprint and drive prioritized exposure reduction.
Individuals and executives leak vast amounts of personal data across breaches, data-broker sites, social media, and public records, creating attack surface for phishing, doxxing, identity theft, and physical-security threats. Most people have no visibility into their aggregate digital footprint or how an attacker would profile them. Organizations similarly lack executive-protection tooling to assess and reduce this exposure.
**What you'll build**
Build an OSINT aggregation dashboard that, given consented subject identifiers, queries breach databases, data-broker/people-search sites, social platforms, and public records to compile an exposure profile, scored by risk (PII type, sensitivity, exploitability). Provide prioritized remediation guidance (opt-out links, privacy hardening) and a footprint-reduction tracker, built with strict consent, scoping, and ethical/legal guardrails.
**Objective** — Aggregate and risk-score an individual's public digital footprint and drive prioritized exposure reduction.
**Expected outcome** — A dashboard that compiles a consented subject's exposure profile with a risk score, source breakdown, and an actionable remediation checklist with progress tracking.
**Difficulty** — Intermediate — API/data aggregation and scoring; advanced when handling scraping ethics, rate limits, and privacy-law compliance.
**Primary category** — OSINT / Reconnaissance; Secondary = Privacy/Data Protection, Executive Protection, GRC
**Security domains** — Primary = Threat Intelligence (OSINT); Secondary = Red Team (recon), GRC (privacy), Security Research
**Technical focus** — OSINT collection, breach-data lookup, data-broker enumeration, social-media footprinting, public-records aggregation, PII risk scoring, entity resolution, privacy remediation, consent/scoping controls
**Core technologies** — Languages: Python, JavaScript; Frameworks/Libraries: requests/httpx, SpiderFoot/theHarvester (basis), React dashboard, Sherlock (username enum); Security Tools: SpiderFoot, theHarvester, Maltego, Have I Been Pwned API; Cloud/Infra: Docker, cloud backend, secrets management; AI/Data: entity resolution/NLP, LLM for report summarization; Databases: PostgreSQL, Elasticsearch
**Where it's valued** — Executive protection, MSSPs/red teams, privacy-tech/consumer security, finance/legal, journalism, high-risk individuals (activists, execs)
**Careers it builds toward** — OSINT Analyst, Threat Intelligence Analyst, Red Team Recon Specialist, Privacy Engineer, Executive-Protection Analyst
**Framework alignment**
• MITRE ATT&CK: Reconnaissance (TA0043) — Gather Victim Identity Information (T1589), Gather Victim Org Information (T1591), Search Open Websites/Domains (T1593), Search Open Technical Databases (T1596); this project maps and defends against pre-attack recon.
• NIST CSF 2.0: Identify (ID.AM/ID.RA — asset & exposure identification, risk assessment), Protect (privacy hardening)
• OWASP: API Top 10 — API2 Broken Authentication / API4 Resource Consumption for third-party lookups; otherwise N/A
• CIS Controls v8: Control 3 (Data Protection), Control 8 (Audit Log Management), Control 14 (Awareness) for privacy hygiene
**Innovation** — Improved Existing Solution — data-broker removal and breach-check services exist, but a unified, risk-scored, consent-driven executive-exposure dashboard with remediation tracking is a marketable product. Scores: Innovation 7/10, Startup 8/10, Enterprise-Readiness 7/10, Patent = No.