1---2name: recon-osint3description: Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)4---56# Reconnaissance & OSINT78## When to Activate910- A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.11- Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.12- Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.13- Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).14- Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.15- Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.1617## Technique Map1819| Technique | ATT&CK | CWE | Reference | Script |20|-----------|--------|-----|-----------|--------|21| Passive subdomain enum (subfinder/amass/CT logs) | T1590.002, T1596.001 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py |22| DNS brute / permutation / resolution (puredns/alterx/dnsx) | T1595.002, T1590.002 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py |23| ASN → CIDR → reverse-DNS expansion | T1590.005, T1596.005 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py |24| HTTP probing + tech fingerprint (httpx) | T1595.002, T1592.002 | CWE-200 | references/attack-surface-mapping.md | scripts/recon_orchestrator.py |25| Headless crawling + archive URLs (katana/gau) | T1595.002, T1593.003 | CWE-200 | references/attack-surface-mapping.md | scripts/js_secret_hunter.py |26| JavaScript endpoint / secret extraction | T1593.003, T1552.001 | CWE-540 | references/attack-surface-mapping.md | scripts/js_secret_hunter.py |27| Subdomain takeover (dangling CNAME/NS) | T1583.001, T1584.001 | CWE-350 | references/subdomain-takeover.md | scripts/subdomain_takeover.py |28| Deleted-S3 takeover → supply-chain pivot | T1583.001, T1195.002 | CWE-350 | references/subdomain-takeover.md | scripts/subdomain_takeover.py |29| Multi-cloud bucket/blob enum (cloud_enum) | T1580, T1596.005 | CWE-732 | references/cloud-saas-recon.md | scripts/cloud_asset_enum.py |30| Azure tenant outsider recon (AADInternals) | T1590.001, T1589 | CWE-200 | references/cloud-saas-recon.md | scripts/cloud_asset_enum.py |31| GitHub/GitLab dorking + secret scanning | T1593.003, T1213.003 | CWE-540 | references/cloud-saas-recon.md | scripts/cloud_asset_enum.py |32| Email/username harvesting (theHarvester) | T1589.002, T1591 | CWE-200 | references/breach-credential-intel.md | scripts/breach_intel.py |33| Breach + infostealer credential intel (HIBP/DeHashed) | T1589.001, T1596 | CWE-522 | references/breach-credential-intel.md | scripts/breach_intel.py |34| CVE enrichment + prioritization (NVD/EPSS/KEV) | T1592.002, T1596 | CWE-1395 | references/cve-exploit-intel.md | scripts/cve_prioritizer.py |35| Shodan InternetDB exposure → CVE mapping | T1596.005, T1595.002 | CWE-200 | references/cve-exploit-intel.md | scripts/cve_prioritizer.py |3637## Quick Start3839```bash40export DOMAIN=target.com41# 0. Validate resolvers once (puredns needs a clean list)42dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt4344# 1. Full discovery + probe + crawl + takeover + nuclei, JSONL out (see orchestrator)45python3 scripts/recon_orchestrator.py -d $DOMAIN -o out/ --resolvers resolvers.txt --nuclei4647# 2. JS/endpoint + secret hunting over live hosts48python3 scripts/js_secret_hunter.py -l out/httpx_live.txt -o out/js/4950# 3. Dangling-DNS / subdomain-takeover triage51python3 scripts/subdomain_takeover.py -l out/all_subdomains.txt -o out/takeovers.jsonl5253# 4. Cloud + code recon (buckets, Azure tenant, GitHub secrets)54python3 scripts/cloud_asset_enum.py -k $DOMAIN --company target --azure-domain $DOMAIN --gh-org target5556# 5. People + breach/infostealer intel57python3 scripts/breach_intel.py --domain $DOMAIN --harvest --hibp --dehashed5859# 6. Triage CVEs from fingerprints → KEV/EPSS/exposure ranked60python3 scripts/cve_prioritizer.py --from-httpx out/httpx_live.txt --ip-file out/ips.txt -o out/cve_ranked.jsonl61```6263## OPSEC & Detection (summary)6465| Technique | Telemetry / IOC | Detection (Sigma/EDR) | OPSEC note |66|-----------|-----------------|------------------------|------------|67| Passive enum (CT/API) | None on target; queries hit 3rd-party APIs | Target cannot see it; CT-log monitoring (certstream) detects *new* certs only | Fully passive — prefer for stealth; no target traffic |68| DNS brute / resolution | Burst of NXDOMAIN/A queries to authoritative + resolvers | DNS firewall: high-volume distinct-label rate per source IP; Zeek `dns.cc`/NXDOMAIN ratio | Throttle `-rate`, rotate resolvers, never brute a single auth NS directly |69| httpx / katana probing | Spike of HTTP(S) requests, odd UA, favicon/JARM fetches | WAF/CDN: request-rate + UA anomaly; access-log `User-Agent: *httpx*`/`*katana*` | Set custom UA, low `-rl`, route via proxy pool / cloud egress |70| Subdomain takeover check | HTTP GET to dangling host (lands on 3rd-party) | 3rd-party provider logs; CT for new cert on claimed host | Verify with passive fingerprint before any claim; claiming is loud |71| Cloud bucket enum | DNS + HTTP to `*.s3/blob/storage.googleapis` | Cloud provider access logs; GuardDuty `Discovery:S3/*` | Hits provider, not target; still rate-limited / loggable |72| Azure tenant recon | Requests to `login.microsoftonline.com` | Entra sign-in/audit logs do *not* see unauth realm probes | `getuserrealm`/OpenID are unauth & invisible to tenant |73| GitHub/GitLab dorking | API/search queries from your token | GitHub audit log (only org members'); secret-scanning alerts | Use a throwaway token; respect rate limits to avoid bans |74| Breach/infostealer lookup | 3rd-party API calls (HIBP/DeHashed) | None on target | Handle PII per ROE/GDPR; document lawful basis |75| CVE enrichment | NVD/EPSS/KEV/Shodan API calls | None on target | Map exposure to *in-scope* assets only |7677## Deep Dives7879- references/subdomain-discovery.md — Passive sources + CT logs, puredns/massdns resolution, alterx permutations, ASN→CIDR→PTR expansion, wildcard handling.80- references/attack-surface-mapping.md — httpx enrichment (`-td -favicon -jarm -asn`), katana headless/authenticated crawling, gau/wayback archive mining, JS endpoint + secret extraction, nuclei triage of the live set.81- references/subdomain-takeover.md — Dangling-DNS theory, can-i-take-over-xyz fingerprints, subzy/baddns/nuclei detection, the 2024-2025 deleted-S3 → CI/CD supply-chain pivot, NS-delegation takeover.82- references/cloud-saas-recon.md — cloud_enum multi-cloud, AADInternals/MicroBurst Azure tenant + blob recon (incl. the June-2025 Get-AADIntTenantDomains patch), GrayhatWarfare, GitHub/GitLab dorking with trufflehog/gitleaks/noseyparker.83- references/breach-credential-intel.md — theHarvester 4.x, HIBP API v3 (ALIEN TXTBASE), DeHashed, infostealer-log intel (Snowflake-style aged creds), username/email format derivation, password-pattern modeling.84- references/cve-exploit-intel.md — NVD 2.0 API + the 2026 selective-enrichment shift, EPSS v4, CISA KEV, Shodan InternetDB, searchsploit/nuclei, the KEV×EPSS×exposure prioritization stack.
hypnguyen1209