Developed by SPYDIRBYTE

A free, in-depth OSINT investigation course, delivered as a fully simulated operating system. Boot it up, log in, and everything lives on a real desktop: a file browser holding all 8 case files, a network map you can click through, a searchable terminology glossary, and a genuinely interactive terminal you can type real commands into.

8 case files  ·  9 desktop apps  ·  48 practice exam questions  ·  26 glossary terms  ·  0 backend

---

Contents

• Why this exists in this form
• What it covers
• The desktop
• Using it
• Hosting on GitHub Pages
• Structure
• On the labs specifically
• Progress tracking

---

Why this exists in this form

Earlier versions of this project tried a navigable 3D room. Hand-coded primitive geometry has a hard ceiling on how good it can actually look, no amount of shader work gets past that without real 3D assets and a production pipeline this project doesn't have. This version drops 3D entirely and puts all the effort into one thing that's genuinely achievable at a high bar: a convincing, detailed simulated OS. No WebGL, no GPU dependency, no CDN dependency at all, works everywhere a browser does.

What it covers

Six case files, structured 1:1 to the real GIAC GOSI certification domains, plus a practice section and a closing module:

#	Case	GOSI Domain
01	OSINT Methodology	Intelligence cycle, source reliability rating
02	Searching, Collecting & Processing Data	Search operators, archives, regex basics
03	Investigating People	PII, social media, verification technique
04	Investigating Businesses	Registries, filings, due-diligence red flags
05	Network & Infrastructure Analysis	WHOIS, DNS, certificate transparency
06	Investigator OPSEC	Attribution risk, secure storage, the legal line
07	Practice Files	6 hands-on labs, one per domain, fabricated scenarios only
08	Tools & Next Steps	spy-osint-suite, spy-geoint, exam prep notes

The desktop

Nine real apps, not one generic content viewer. Every case and every app opens in a real window: animated open and close (with a matching synthesized sound), draggable by the title bar, closeable, multiple open at once, shows up as a chip in the taskbar you can click to refocus.

App	What it does
Case Files	File browser listing all 8 cases, shows reviewed/unread status live, has its own search box that matches against actual case content, not just titles
Network Map	The same 8 cases as a radial node graph with animated traveling data pulses along each connection, click a node to open it
Glossary	Searchable reference of 26 OSINT/GOSI terms used across the case files, type to filter
Field Notes	Personal scratchpad, autosaves locally as you type, ties directly to the documentation discipline covered in Case 01
Practice Exam	48 original questions, 8 per GOSI domain, scored, with an explanation shown for every answer afterward, not just a pass/fail
Live Op Sim	A multi-step, fully fabricated investigation: work through simulated business registry, WHOIS, certificate transparency, social media, and news archive checks, then submit a calibrated conclusion and get scored on whether it actually matches the evidence
VPN	A simulated connect/disconnect flow with a fake server list, purely flavor, with an honest one-line reminder of what a real VPN actually does and doesn't do
Terminal	A real command line. help lists commands, open <name or number> opens any case, search <term> searches all case content from the shell
Settings	Toggle sound, toggle the CRT scanline effect, or reset all progress

Case files render with a reading-progress bar and a classification-style header for a genuine dossier feel. A live desktop widget tracks case progress and session status without needing to open anything. Toast notifications confirm session start and each case you mark reviewed. Complete all 8 cases and a full field certification screen appears, with its own generated certificate ID.

All sound (boot beeps, keystrokes, notification dings, the login chime, window open/close, achievements) is synthesized live with the Web Audio API, not loaded from audio files, so there are zero binary audio assets and zero licensing questions. Fully mutable from Settings.

On the Live Op Sim specifically: Northgate Ventures is entirely fabricated, the domain used is on the .test suffix which is reserved so it can never resolve to a real site, and every simulated tool output is invented. Same standard held by every lab in this course.

Using it

python3 -m http.server 8000

Open http://localhost:8000. Boot sequence plays once per session, then a login prompt (login: analyst, a typed password, "ACCESS GRANTED"), then the desktop.

Hosting on GitHub Pages

Push this repo, then in Settings > Pages, set the source to the main branch, root directory. Leave the Custom domain field blank, that field is only for a domain you separately own.

Structure

Show full file structure

.
├── index.html                 # boot screen, login screen, desktop shell
├── .nojekyll                    # tells GitHub Pages to skip Jekyll processing entirely
├── assets/
│   └── wallpaper.png              # desktop background
├── css/style.css
└── js/
    ├── course-data.js          # case order and labels, single source of truth
    ├── content-data.js          # the actual case file content, as data
    ├── glossary-data.js          # terminology reference, tied directly to case content
    ├── exam-data.js                # 48 original practice exam questions, 8 per domain
    ├── investigation-data.js        # the Live Op Sim's fabricated scenario
    ├── sounds.js                      # synthesized sound effects via Web Audio API, no audio files
    ├── terminal.js                      # the terminal app's command parser, self-contained
    └── app.js                             # boot, login, desktop, window management, all nine apps

terminal.js is deliberately self-contained: it takes a line of input and returns output lines plus an optional action, it doesn't know anything about windows or the DOM. app.js owns everything else.

On the labs specifically

Every practice scenario is fabricated: invented names, invented companies, any domain example uses the .test suffix, which is reserved by internet standards so it can never resolve to a real site. Practicing investigative technique on a real, non-consenting person isn't a harmless exercise just because it's framed as practice.

Progress tracking

The "mark reviewed" button saves to localStorage in the visitor's own browser. Nothing is sent anywhere, there's no backend at all.

---

_{MIT License}