Civic IT security asks the OSINT analyst to get the password from a public dump so staff can log into a vendor SSO. What should the analyst do?
Select an answer to reveal the explanation.
Short Explanation
Password OSINT here is a weather report: the credential might be out in the wild. It is not a spare garage-door opener for vendor SSO. Tell IT the identifier looks exposed, then stop.
Full Explanation
When civic IT security asks an OSINT analyst to retrieve a password from a public dump so staff can log into a vendor SSO, the correct response is to refuse replay and cracking and to report only that the identifier appears exposed in public breach data. PORP collection stops at publicly observable exposure intelligence; using recovered secrets against live systems is unauthorized access regardless of the city's curiosity or "impact proof" framing. Extracting and replaying the password against vendor SSO to demonstrate risk converts OSINT into credential stuffing and can violate computer-access law even when the requester is municipal IT. GPU cracking of dump hashes is a recovery or offensive technique outside standard PORP civic OSINT deliverables; password hunting in this curriculum means recognizing exposure, not reconstructing usable secrets for operational login. Pasting recovered passwords into a council packet spreads secrets into a broadly circulated civic record and invites misuse by anyone who receives the agenda. Exam caveat: PORP draws a hard line between documenting public exposure and interacting with credentials against systems; "for the city" does not create authorization. Operational check: cite dump source, date, and identifier only; redact secrets; notify vendor-risk or IT through approved channels; recommend forced resets and monitoring; and document the refusal to replay or crack in the engagement notes so the file shows disciplined scope.