OSINT Reconnaissance
Passive intelligence gathering:
- Domain WHOIS and DNS records
- Subdomain enumeration
- IP geolocation and ASN lookup
- Certificate transparency
- Email format discovery
- GitHub/code leak search
- Social media reconnaissance
Required Context
- Target: Domain, IP, organization, or individual
- Scope: What to focus on (infra, emails, leaks)
- Output: Format preference
Tools Used
whois, dig, subfinder, amass, shodan, geoiplookup, theHarvester, crt.sh
Example
/osint
Target: example.com
Focus: Infrastructure mapping, email format