OSINT Recon — Open Source Intelligence Gathering
Systematically gather, analyze, and correlate publicly available information from open sources.
Cross-references: recon for the active/passive target-mapping pass against an authorized system (DNS, ports, fingerprinting) — osint-recon focuses on people, organizations, leaked data, and historical artifacts; the two pair naturally. breach-patterns for ingesting public breach intelligence into your own preemptive assessments. incident-triage if OSINT surfaces evidence the user is already compromised.
Ethics Check
Before proceeding, confirm:
- The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
- You are only gathering publicly available information
- Results will not be used for harassment, stalking, or doxing
Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.
Collection Techniques
Domain and Infrastructure OSINT
Run these to map a target's infrastructure:
whois <domain> # Registration data
dig any <domain> # DNS records
Query certificate transparency for subdomains:
curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u
Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.
Organization OSINT
- Company registrations, filings, SEC records (public companies)
- LinkedIn company page — employee count, roles, tech stack hints
- Job postings — reveal internal tools, tech stack, pain points
- Press releases and news articles
- GitHub/GitLab organization pages and public repositories
- Patent filings
Email and Username OSINT
- Email format patterns (e.g., first.last@domain.com)
- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
- PGP key servers for email discovery
- Gravatar lookups for email-to-identity correlation
Document and File OSINT
- Extract metadata from public documents:
exiftool <file> reveals author, software, GPS, timestamps
- Google dorking:
site:<domain> filetype:pdf, site:<domain> filetype:xlsx
- Pastebin and code paste site monitoring
- Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)
Threat Intelligence
- CVE databases for the target's technology stack
- Exploit databases (exploit-db, searchsploit)
- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
- Abuse contact databases
Analysis
- Cross-reference findings across multiple sources
- Validate information with at least two independent sources
- Build a timeline of events when investigating incidents
- Map relationships between entities (people, domains, IPs, organizations)
- Rate confidence: High (multiple corroborating sources), Medium (single reliable source), Low (unverified)
Output Format
# OSINT Report
## Objective: [what we're investigating and why]
## Target: [entity/domain/person]
## Date: [date]
### Collection Summary
| Source | Findings | Confidence |
|--------|----------|------------|
### Key Findings
#### Finding 1: [Title]
- **Source:** [where this was found]
- **Details:** [what was discovered]
- **Confidence:** High / Medium / Low
- **Relevance:** [why this matters to the objective]
### Correlations
[How different findings connect to each other]
### Intelligence Gaps
[What we couldn't find or verify]
### Recommendations
[Next steps and actionable intelligence]
Boundaries
- Only use publicly available sources
- Never attempt to access private or authenticated systems
- Do not aggregate PII beyond what is necessary for the stated objective
- Attribute all findings to their source
- Rate confidence levels honestly — do not overstate certainty
- If a finding could cause harm if misused, note the sensitivity
- Refuse requests for doxing, stalking, or unauthorized surveillance
References
- OSINT Framework (osintframework.com)
- SANS OSINT resource list
- Bellingcat Online Investigation Toolkit
1---
2name: osint-recon
3description: "Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'investigate a domain,' or needs to research a target using publicly available data."
4allowed-tools: Bash, WebSearch, WebFetch, Read, Write
5---
6
7# OSINT Recon — Open Source Intelligence Gathering
8
9Systematically gather, analyze, and correlate publicly available information from open sources.
10
11Cross-references: `recon` for the active/passive target-mapping pass against an authorized system (DNS, ports, fingerprinting) — osint-recon focuses on people, organizations, leaked data, and historical artifacts; the two pair naturally. `breach-patterns` for ingesting public breach intelligence into your own preemptive assessments. `incident-triage` if OSINT surfaces evidence the user is already compromised.
12
13## Ethics Check
14
15Before proceeding, confirm:
161. The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
172. You are only gathering publicly available information
183. Results will not be used for harassment, stalking, or doxing
19
20Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.
21
22## Collection Techniques
23
24### Domain and Infrastructure OSINT
25
26Run these to map a target's infrastructure:
27
28```bash
29whois <domain> # Registration data
30dig any <domain> # DNS records
31```
32
33Query certificate transparency for subdomains:
34```bash
35curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u
36```
37
38Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.
39
40### Organization OSINT
41
42- Company registrations, filings, SEC records (public companies)
43- LinkedIn company page — employee count, roles, tech stack hints
44- Job postings — reveal internal tools, tech stack, pain points
45- Press releases and news articles
46- GitHub/GitLab organization pages and public repositories
47- Patent filings
48
49### Email and Username OSINT
50
51- Email format patterns (e.g., first.last@domain.com)
52- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
53- PGP key servers for email discovery
54- Gravatar lookups for email-to-identity correlation
55
56### Document and File OSINT
57
58- Extract metadata from public documents: `exiftool <file>` reveals author, software, GPS, timestamps
59- Google dorking: `site:<domain> filetype:pdf`, `site:<domain> filetype:xlsx`
60- Pastebin and code paste site monitoring
61- Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)
62
63### Threat Intelligence
64
65- CVE databases for the target's technology stack
66- Exploit databases (exploit-db, searchsploit)
67- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
68- Abuse contact databases
69
70## Analysis
71
72- Cross-reference findings across multiple sources
73- Validate information with at least two independent sources
74- Build a timeline of events when investigating incidents
75- Map relationships between entities (people, domains, IPs, organizations)
76- Rate confidence: **High** (multiple corroborating sources), **Medium** (single reliable source), **Low** (unverified)
77
78## Output Format
79
80```markdown
81# OSINT Report
82## Objective: [what we're investigating and why]
83## Target: [entity/domain/person]
84## Date: [date]
85
86### Collection Summary
87| Source | Findings | Confidence |
88|--------|----------|------------|
89
90### Key Findings
91
92#### Finding 1: [Title]
93- **Source:** [where this was found]
94- **Details:** [what was discovered]
95- **Confidence:** High / Medium / Low
96- **Relevance:** [why this matters to the objective]
97
98### Correlations
99[How different findings connect to each other]
100
101### Intelligence Gaps
102[What we couldn't find or verify]
103
104### Recommendations
105[Next steps and actionable intelligence]
106```
107
108## Boundaries
109
110- Only use publicly available sources
111- Never attempt to access private or authenticated systems
112- Do not aggregate PII beyond what is necessary for the stated objective
113- Attribute all findings to their source
114- Rate confidence levels honestly — do not overstate certainty
115- If a finding could cause harm if misused, note the sensitivity
116- Refuse requests for doxing, stalking, or unauthorized surveillance
117
118## References
119
120- OSINT Framework (osintframework.com)
121- SANS OSINT resource list
122- Bellingcat Online Investigation Toolkit
briiirussell