Osint Recon

OSINT Recon

Open Source Intelligence investigation and reconnaissance workflows.

how to use

• /osint-recon Apply OSINT methodology to the current investigation.

• /osint-recon <target-type> Plan an OSINT investigation for username, domain, email, or organization.

when to apply

Reference these guidelines when:

• investigating usernames or email addresses
• performing domain intelligence gathering
• conducting threat intelligence research
• analyzing social media footprints
• mapping organizational structure
• participating in OSINT CTF challenges

investigation methodology

OSINT Cycle

1. Planning: Define objectives, scope, legal constraints
2. Collection: Gather raw data from open sources
3. Processing: Clean, normalize, deduplicate data
4. Analysis: Correlate findings, identify patterns
5. Dissemination: Report findings with confidence levels
6. Feedback: Refine collection based on gaps

Evidence Classification

username enumeration

Sherlock-Style Patterns

# Pattern: Multi-platform username check
import asyncio
import aiohttp
from typing import TypedDict

class UsernameResult(TypedDict):
    platform: str
    url: str
    status: str  # "found", "not_found", "error"
    response_time_ms: float

PLATFORMS = {
    "github": "https://github.com/{username}",
    "twitter": "https://x.com/{username}",
    "instagram": "https://instagram.com/{username}",
    "reddit": "https://reddit.com/user/{username}",
    "linkedin": "https://linkedin.com/in/{username}",
    "medium": "https://medium.com/@{username}",
    "dev.to": "https://dev.to/{username}",
    "hackernews": "https://news.ycombinator.com/user?id={username}",
}

async def check_username(
    session: aiohttp.ClientSession,
    platform: str,
    url: str,
) -> UsernameResult:
    """Check if username exists on a platform."""
    try:
        async with session.get(url, timeout=aiohttp.ClientTimeout(total=10)) as resp:
            return {
                "platform": platform,
                "url": url,
                "status": "found" if resp.status == 200 else "not_found",
                "response_time_ms": 0,
            }
    except Exception:
        return {"platform": platform, "url": url, "status": "error", "response_time_ms": 0}

Key Tools

• Sherlock: Username enumeration across 400+ sites
• WhatsMyName: Web-based username search
• Namechk: Domain + username availability

domain intelligence

DNS & WHOIS

# DNS enumeration
dig +short A example.com
dig +short MX example.com
dig +short TXT example.com
dig +short NS example.com

# WHOIS
whois example.com

# Subdomain enumeration
# Tools: subfinder, amass, sublist3r
subfinder -d example.com -silent

# Certificate transparency
curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq '.[].name_value'

Technology Fingerprinting

• Wappalyzer: Browser extension for tech stack detection
• BuiltWith: Historical technology data
• Shodan: Internet-connected device search
• Censys: Certificate and host search

email intelligence

Email Verification Patterns

# Pattern: Email OSINT workflow
def email_osint(email: str) -> dict:
    """Gather intelligence from an email address."""
    local_part, domain = email.split("@")
    return {
        "email": email,
        "domain_info": {
            "mx_records": dns_lookup(domain, "MX"),
            "spf_record": dns_lookup(domain, "TXT", filter="spf"),
            "dmarc_record": dns_lookup(f"_dmarc.{domain}", "TXT"),
        },
        "breach_check": "Use HaveIBeenPwned API",
        "social_profiles": "Cross-reference with username enumeration",
        "domain_age": "WHOIS creation date",
    }

Tools

• theHarvester: Email, subdomain, name harvesting
• Hunter.io: Email pattern discovery
• HaveIBeenPwned: Breach exposure check

dark web intelligence

CTI Feed Sources (from DeepDarkCTI)

CTI Integration Pattern

# Pattern: CTI feed aggregation
from dataclasses import dataclass
from datetime import datetime
from enum import Enum

class ThreatLevel(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class ThreatIndicator:
    ioc_type: str  # ip, domain, hash, email, url
    ioc_value: str
    source: str
    threat_level: ThreatLevel
    first_seen: datetime
    context: str
    confidence: float  # 0.0 - 1.0

social media analysis

Profile Analysis Framework

1. Account metadata: Creation date, follower/following ratio, posting frequency
2. Content analysis: Topics, sentiment, language patterns
3. Network analysis: Connections, group memberships, interactions
4. Temporal analysis: Activity patterns, time zones, posting schedules
5. Cross-platform correlation: Matching profiles across platforms

OSINT Workflow Template (from Obsidian OSINT Templates)

## Investigation: {{target}}
**Date**: {{date}}
**Objective**: {{objective}}
**Scope**: {{scope}}

### Findings
| Source | Data Point | Confidence | Notes |
|--------|-----------|------------|-------|

### Timeline
| Date | Event | Source |

### Connections Map
[Graph of relationships between entities]

### Assessment
**Confidence Level**: Confirmed / Probable / Possible / Doubtful
**Summary**:
**Recommendations**:

data correlation techniques

Entity Resolution

# Pattern: Cross-source entity matching
def correlate_entities(sources: list[dict]) -> list[dict]:
    """Match entities across different OSINT sources."""
    # Exact matches: email, phone, unique IDs
    # Fuzzy matches: names (Levenshtein), usernames (substring)
    # Behavioral matches: writing style, posting times
    # Visual matches: profile photo reverse image search
    ...

Pivot Points

• Username → email → real name → address
• Domain → IP → other domains (reverse DNS)
• Phone → social media → real identity
• Image → EXIF data → GPS coordinates → other photos

integration with the operator's environment

Using Memory MCP for Investigations

# Store investigation entities
mcp__memory__create_entities: [{name: "target_user", entityType: "person", observations: ["..."]}]
mcp__memory__create_relations: [{from: "target_user", to: "target_domain", relationType: "owns"}]
mcp__memory__search_nodes: {query: "target investigation"}

legal and ethical guidelines

1. Only use publicly available information
2. Never access private accounts or systems without authorization
3. Respect robots.txt and rate limits (see browser-automation-safety skill)
4. Document your methodology for reproducibility
5. Report findings responsibly (coordinated disclosure)
6. Comply with local privacy laws (GDPR, CCPA, etc.)
7. Never harass or stalk individuals

cross-references

• offensive-security skill: Full penetration testing methodology
• security-review skill: Code-level security analysis
• browser-automation-safety skill: Rate limiting, robots.txt compliance
• research-methodology skill: Source credibility assessment
• SECURITY_ARSENAL.md: Complete tool inventory