OSINT Recon — Open Source Intelligence Gathering
Systematically gather, analyze, and correlate publicly available information from open sources.
Ethics Check
Before proceeding, confirm:
- The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
- You are only gathering publicly available information
- Results will not be used for harassment, stalking, or doxing
Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.
Collection Techniques
Domain and Infrastructure OSINT
Run these to map a target's infrastructure:
whois <domain> # Registration data
dig any <domain> # DNS records
Query certificate transparency for subdomains:
curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u
Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.
Organization OSINT
- Company registrations, filings, SEC records (public companies)
- LinkedIn company page — employee count, roles, tech stack hints
- Job postings — reveal internal tools, tech stack, pain points
- Press releases and news articles
- GitHub/GitLab organization pages and public repositories
- Patent filings
Email and Username OSINT
- Email format patterns (e.g., first.last@domain.com)
- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
- PGP key servers for email discovery
- Gravatar lookups for email-to-identity correlation
Document and File OSINT
- Extract metadata from public documents:
exiftool <file> reveals author, software, GPS, timestamps
- Google dorking:
site:<domain> filetype:pdf, site:<domain> filetype:xlsx
- Pastebin and code paste site monitoring
- Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)
Threat Intelligence
- CVE databases for the target's technology stack
- Exploit databases (exploit-db, searchsploit)
- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
- Abuse contact databases
Analysis
- Cross-reference findings across multiple sources
- Validate information with at least two independent sources
- Build a timeline of events when investigating incidents
- Map relationships between entities (people, domains, IPs, organizations)
- Rate confidence: High (multiple corroborating sources), Medium (single reliable source), Low (unverified)
Output Format
# OSINT Report
## Objective: [what we're investigating and why]
## Target: [entity/domain/person]
## Date: [date]
### Collection Summary
| Source | Findings | Confidence |
|--------|----------|------------|
### Key Findings
#### Finding 1: [Title]
- **Source:** [where this was found]
- **Details:** [what was discovered]
- **Confidence:** High / Medium / Low
- **Relevance:** [why this matters to the objective]
### Correlations
[How different findings connect to each other]
### Intelligence Gaps
[What we couldn't find or verify]
### Recommendations
[Next steps and actionable intelligence]
Boundaries
- Only use publicly available sources
- Never attempt to access private or authenticated systems
- Do not aggregate PII beyond what is necessary for the stated objective
- Attribute all findings to their source
- Rate confidence levels honestly — do not overstate certainty
- If a finding could cause harm if misused, note the sensitivity
- Refuse requests for doxing, stalking, or unauthorized surveillance
References
- OSINT Framework (osintframework.com)
- SANS OSINT resource list
- Bellingcat Online Investigation Toolkit
1---2name: osint-recon3description: Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'investigate a domain,' or needs to research a target using publicly available data.4---56# OSINT Recon — Open Source Intelligence Gathering78Systematically gather, analyze, and correlate publicly available information from open sources.910## Ethics Check1112Before proceeding, confirm:131. The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)142. You are only gathering publicly available information153. Results will not be used for harassment, stalking, or doxing1617Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.1819## Collection Techniques2021### Domain and Infrastructure OSINT2223Run these to map a target's infrastructure:2425```bash26whois <domain> # Registration data27dig any <domain> # DNS records28```2930Query certificate transparency for subdomains:31```bash32curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u33```3435Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.3637### Organization OSINT3839- Company registrations, filings, SEC records (public companies)40- LinkedIn company page — employee count, roles, tech stack hints41- Job postings — reveal internal tools, tech stack, pain points42- Press releases and news articles43- GitHub/GitLab organization pages and public repositories44- Patent filings4546### Email and Username OSINT4748- Email format patterns (e.g., first.last@domain.com)49- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)50- PGP key servers for email discovery51- Gravatar lookups for email-to-identity correlation5253### Document and File OSINT5455- Extract metadata from public documents: `exiftool <file>` reveals author, software, GPS, timestamps56- Google dorking: `site:<domain> filetype:pdf`, `site:<domain> filetype:xlsx`57- Pastebin and code paste site monitoring58- Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)5960### Threat Intelligence6162- CVE databases for the target's technology stack63- Exploit databases (exploit-db, searchsploit)64- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)65- Abuse contact databases6667## Analysis6869- Cross-reference findings across multiple sources70- Validate information with at least two independent sources71- Build a timeline of events when investigating incidents72- Map relationships between entities (people, domains, IPs, organizations)73- Rate confidence: **High** (multiple corroborating sources), **Medium** (single reliable source), **Low** (unverified)7475## Output Format7677```markdown78# OSINT Report79## Objective: [what we're investigating and why]80## Target: [entity/domain/person]81## Date: [date]8283### Collection Summary84| Source | Findings | Confidence |85|--------|----------|------------|8687### Key Findings8889#### Finding 1: [Title]90- **Source:** [where this was found]91- **Details:** [what was discovered]92- **Confidence:** High / Medium / Low93- **Relevance:** [why this matters to the objective]9495### Correlations96[How different findings connect to each other]9798### Intelligence Gaps99[What we couldn't find or verify]100101### Recommendations102[Next steps and actionable intelligence]103```104105## Boundaries106107- Only use publicly available sources108- Never attempt to access private or authenticated systems109- Do not aggregate PII beyond what is necessary for the stated objective110- Attribute all findings to their source111- Rate confidence levels honestly — do not overstate certainty112- If a finding could cause harm if misused, note the sensitivity113- Refuse requests for doxing, stalking, or unauthorized surveillance114115## References116117- OSINT Framework (osintframework.com)118- SANS OSINT resource list119- Bellingcat Online Investigation Toolkit
Corey Haines