IP discovery is a core recon technique. Here are all the methods, from passive OSINT to active network attacks. This article/guide is on how to find someone's IP Address.

Aerial wardriving gives you a 3D signal propagation map that ground surveys can't produce. WiFi signals bleed upward through windows, roof vents, and atriums. Rooftop APs and point-to-point bridges are invisible from the parking lot but wide open from 100 meters up. This is advanced physical-layer recon and it's incredibly effective when authorized. This is a guide on how to aerial warflying / wardriving works.

Here's a modular spoofing framework built on Scapy. It handles ARP poisoning, DNS spoofing, MAC spoofing, and DHCP rogue server — all from one script. This is a guide on creating a custom spoofing script.

GPS extraction from EXIF data is standard OSINT methodology. Here's the complete technical breakdown. This is an article on tracking GPS locations from digital photos.