/iblai-vibe-security-osint-recon
Collect, analyze, and correlate publicly available information from open
sources. For threat intel, authorized assessments, CTF, and defensive
research.
Do NOT use this for harassment, doxing, stalking, or unauthorized
surveillance. Refuse those requests outright.
Step 0: Ethics Check
Confirm before collecting anything:
- The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research).
- You are only touching publicly available information.
- Findings will not be used to harass, dox, or aggregate private data beyond what the objective needs.
Refuse if any of those is shaky.
Collection
Domain and Infrastructure
Map the target's infrastructure:
whois <domain> # Registration data
dig any <domain> # DNS records
Subdomain enumeration via certificate transparency:
curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u
Other sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net,
Wayback Machine, Shodan, Censys.
Organization
- Company registrations, filings, SEC records (public companies)
- LinkedIn company page — headcount, roles, tech-stack hints
- Job postings — internal tooling, stack, pain points
- Press releases and news
- GitHub/GitLab org pages and public repos
- Patent filings
Email and Username
- Email format patterns (e.g., first.last@domain.com)
- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
- PGP key servers for email discovery
- Gravatar lookups for email-to-identity correlation
Document and File
- Metadata from public documents:
exiftool <file> reveals author, software, GPS, timestamps
- Google dorking:
site:<domain> filetype:pdf, site:<domain> filetype:xlsx
- Pastebin and paste-site monitoring
- Public cloud storage with predictable names (S3, GCS buckets)
Threat Intelligence
- CVE databases for the target's stack
- Exploit databases (exploit-db, searchsploit)
- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
- Abuse contact databases
Analysis
- Cross-reference findings across sources.
- Validate every claim against at least two independent sources.
- Build a timeline when investigating an incident.
- Map relationships between entities (people, domains, IPs, organizations).
- Rate confidence honestly: High (multiple corroborating sources), Medium (single reliable source), Low (unverified).
Output Format
# OSINT Report
## Objective: [what we're investigating and why]
## Target: [entity/domain/person]
## Date: [date]
### Collection Summary
| Source | Findings | Confidence |
|--------|----------|------------|
### Key Findings
#### Finding 1: [Title]
- **Source:** [where this was found]
- **Details:** [what was discovered]
- **Confidence:** High / Medium / Low
- **Relevance:** [why this matters to the objective]
### Correlations
[How different findings connect to each other]
### Intelligence Gaps
[What we couldn't find or verify]
### Recommendations
[Next steps and actionable intelligence]
Boundaries
- Public sources only.
- Never probe private or authenticated systems.
- Don't aggregate PII beyond what the objective requires.
- Attribute every finding to its source.
- Rate confidence honestly — do not overstate certainty.
- If a finding could cause harm if misused, flag the sensitivity.
- Refuse doxing, stalking, or unauthorized-surveillance requests.
References
- OSINT Framework (osintframework.com)
- SANS OSINT resource list
- Bellingcat Online Investigation Toolkit
1---2name: iblai-vibe-security-osint-recon3description: Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'investigate a domain,' or needs to research a target using publicly available data.4---56# /iblai-vibe-security-osint-recon78Collect, analyze, and correlate publicly available information from open9sources. For threat intel, authorized assessments, CTF, and defensive10research.1112Do NOT use this for harassment, doxing, stalking, or unauthorized13surveillance. Refuse those requests outright.1415## Step 0: Ethics Check1617Confirm before collecting anything:18191. The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research).202. You are only touching publicly available information.213. Findings will not be used to harass, dox, or aggregate private data beyond what the objective needs.2223Refuse if any of those is shaky.2425## Collection2627### Domain and Infrastructure2829Map the target's infrastructure:3031```bash32whois <domain> # Registration data33dig any <domain> # DNS records34```3536Subdomain enumeration via certificate transparency:3738```bash39curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u40```4142Other sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net,43Wayback Machine, Shodan, Censys.4445### Organization4647- Company registrations, filings, SEC records (public companies)48- LinkedIn company page — headcount, roles, tech-stack hints49- Job postings — internal tooling, stack, pain points50- Press releases and news51- GitHub/GitLab org pages and public repos52- Patent filings5354### Email and Username5556- Email format patterns (e.g., first.last@domain.com)57- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)58- PGP key servers for email discovery59- Gravatar lookups for email-to-identity correlation6061### Document and File6263- Metadata from public documents: `exiftool <file>` reveals author, software, GPS, timestamps64- Google dorking: `site:<domain> filetype:pdf`, `site:<domain> filetype:xlsx`65- Pastebin and paste-site monitoring66- Public cloud storage with predictable names (S3, GCS buckets)6768### Threat Intelligence6970- CVE databases for the target's stack71- Exploit databases (exploit-db, searchsploit)72- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)73- Abuse contact databases7475## Analysis7677- Cross-reference findings across sources.78- Validate every claim against at least two independent sources.79- Build a timeline when investigating an incident.80- Map relationships between entities (people, domains, IPs, organizations).81- Rate confidence honestly: **High** (multiple corroborating sources), **Medium** (single reliable source), **Low** (unverified).8283## Output Format8485```markdown86# OSINT Report87## Objective: [what we're investigating and why]88## Target: [entity/domain/person]89## Date: [date]9091### Collection Summary92| Source | Findings | Confidence |93|--------|----------|------------|9495### Key Findings9697#### Finding 1: [Title]98- **Source:** [where this was found]99- **Details:** [what was discovered]100- **Confidence:** High / Medium / Low101- **Relevance:** [why this matters to the objective]102103### Correlations104[How different findings connect to each other]105106### Intelligence Gaps107[What we couldn't find or verify]108109### Recommendations110[Next steps and actionable intelligence]111```112113## Boundaries114115- Public sources only.116- Never probe private or authenticated systems.117- Don't aggregate PII beyond what the objective requires.118- Attribute every finding to its source.119- Rate confidence honestly — do not overstate certainty.120- If a finding could cause harm if misused, flag the sensitivity.121- Refuse doxing, stalking, or unauthorized-surveillance requests.122123## References124125- OSINT Framework (osintframework.com)126- SANS OSINT resource list127- Bellingcat Online Investigation Toolkit
iblai