Lab 02 — OSINT Surface Mapper

Operation Cedar Lattice, Phase 10.

Map synthetic OSINT findings about Meridian Freight International to vendor-impersonation pretext opportunities, exposed infrastructure, and expected detection capabilities. This lab models the structured analysis step that converts raw OSINT data into an actionable engagement plan — and simultaneously shows the defender exactly what that analysis reveals.

Safety. This lab operates entirely on synthetic org data. There are no live OSINT queries, no DNS lookups, no web requests, no real employee data, and no connection to any external system. Input and output are Python dicts and lists.

What You Will Build

Five public functions that together implement an OSINT-to-pretext analysis pipeline:

Function	Input	Output
`email_patterns(github_emails)`	list of email strings	sorted list of pattern strings
`pretext_angles(job_postings, technologies)`	two lists of strings	sorted list of pretext descriptions
`exposed_infrastructure(subdomains)`	list of subdomain strings	sorted list of `{subdomain, service_type, risk_note}`
`detection_evasion_notes(target)`	target dict	sorted list of detection-capability strings
`osint_summary(target)`	target dict	combined result dict

Target Dict Schema

target = {
    "domain":         str,          # primary domain, e.g., "meridianfreight.com"
    "subdomains":     list[str],    # known subdomains
    "github_emails":  list[str],    # email addresses from git commit metadata
    "job_postings":   list[str],    # job posting text snippets
    "technologies":   list[str],    # technology names from job postings / LinkedIn
}

Pattern Logic

Email Pattern Inference

Given a list of email addresses, infer the naming convention:

Local part	Inferred pattern
Contains `.` and both parts length > 1 (e.g., `john.smith`)	`first.last@domain`
Contains `.` and first part is single char (e.g., `a.jones`)	`f.last@domain`
No `.`, length > 1 (e.g., `jdoe`)	`flast@domain`

Vendor Impersonation

Match job postings and technologies against the built-in VENDOR_MAP dict (case-insensitive). Return sorted unique list of pretext angle descriptions.

Subdomain Sensitivity

Match each subdomain string against SENSITIVE_SUBDOMAIN_KEYWORDS (keyword must appear anywhere in the subdomain, case-insensitive). Return sorted list of {subdomain, service_type, risk_note}.

Detection Capabilities

Match technologies and job posting text against TECH_DETECTION_MAP keys (case-insensitive). Return sorted list of detection-capability descriptions.

Files

File	Purpose
`lab.py`	Your implementation — public functions stubbed with `NotImplementedError`
`solution.py`	Complete reference solution
`test_lab.py`	12 pytest tests
`requirements.txt`	`pytest>=7.0`

Running the Tests

# Run against your implementation (should fail with NotImplementedError)
pytest -q

# Run against reference solution (all 12 should pass)
LAB_MODULE=solution pytest -q

Learning Objectives

After completing this lab you should be able to:

Infer an organization's email naming convention from a small sample of known addresses.
Map job-posting technology mentions to specific vendor-impersonation pretext angles.
Identify sensitive subdomain patterns that indicate high-value infrastructure.
Derive the target organization's detection capabilities from its technology stack.
Explain why understanding detection capabilities is as important as finding attack opportunities when planning a red team engagement.

« Phase 10 README | Lab 01 — Email Auth Analyzer

Red Team Engineer