Recon & OSINT (RECON phase — the front of the lifecycle)
Overview
Find what's actually exposed before deciding what to test. Threat modeling assumes a surface;
recon discovers it. Most breaches start at an asset the defender forgot they had.
Core principle: You can't protect what you don't know exists. Enumerate everything first.
⚠️ Authorization
Only enumerate assets you own or are explicitly authorized to test. Passive OSINT on your own
org is always safe; active scanning/brute-forcing requires the asset to be in scope.
Method (passive → active)
- Passive footprint (no packets to target) — search engines, certificate transparency,
public code, breach data, DNS records, archived pages. Zero noise, often highest value.
- Asset discovery — subdomains, IP ranges, cloud buckets, related domains, forgotten staging.
- Service & tech fingerprinting — what's running, which versions, which frameworks/CMS.
- Content discovery — hidden endpoints, directories, API routes, JS-referenced URLs, params.
- Secret & exposure hunting — leaked keys/tokens in public repos, paste sites, JS bundles, archives.
- Consolidate — turn findings into a target inventory the threat model can rank.
See references/recon-playbook.md for concrete tools and commands per step.
Quick reference — what to hunt
| Category |
Goldmine sources |
| Subdomains |
crt.sh / cert transparency, subfinder, amass, DNS brute-force |
| Forgotten assets |
staging/dev/old subdomains, S3/GCS/Azure buckets, archived pages (Wayback) |
| Tech stack |
whatweb, wappalyzer, response headers, favicon hash, JS libs |
| Endpoints/params |
gau/waybackurls, JS file parsing, katana, robots/sitemap, Swagger/GraphQL |
| Leaked secrets |
GitHub/Gist dorking, trufflehog/gitleaks on public repos, paste sites |
| Exposed creds |
breach-corpus lookups for org emails (defensive: know what attackers know) |
Output: target inventory
A list the threat model consumes:
| Asset |
Type |
Tech |
Notable |
Exposure |
api.example.com |
API host |
Node/Express |
Swagger exposed |
public |
staging.example.com |
web |
old build |
debug=on |
should be internal |
Hand-off
Feed the inventory into threat-modeling to rank, then security-code-audit /
api-security-testing for the prioritized targets.
Common mistakes
- Jumping to scanning before passive recon — you make noise and miss the easy wins.
- Enumerating only the main domain — forgotten subdomains/buckets are where breaches live.
- Ignoring JS bundles — they leak endpoints, params, and sometimes keys.
- Testing assets you found but aren't authorized for — discovery ≠ permission.
1---2name: recon-and-osint3description: Use when starting an assessment and you need to discover an application's full attack surface — subdomains, hosts, endpoints, technologies, exposed services, leaked credentials and secrets — on assets you own or are authorized to test. Feeds the threat model with real, not assumed, targets.4---56# Recon & OSINT (RECON phase — the front of the lifecycle)78## Overview9Find what's actually exposed before deciding what to test. Threat modeling assumes a surface;10recon *discovers* it. Most breaches start at an asset the defender forgot they had.1112**Core principle:** You can't protect what you don't know exists. Enumerate everything first.1314## ⚠️ Authorization15Only enumerate assets you own or are explicitly authorized to test. Passive OSINT on your own16org is always safe; active scanning/brute-forcing requires the asset to be in scope.1718## Method (passive → active)191. **Passive footprint** (no packets to target) — search engines, certificate transparency,20 public code, breach data, DNS records, archived pages. Zero noise, often highest value.212. **Asset discovery** — subdomains, IP ranges, cloud buckets, related domains, forgotten staging.223. **Service & tech fingerprinting** — what's running, which versions, which frameworks/CMS.234. **Content discovery** — hidden endpoints, directories, API routes, JS-referenced URLs, params.245. **Secret & exposure hunting** — leaked keys/tokens in public repos, paste sites, JS bundles, archives.256. **Consolidate** — turn findings into a target inventory the threat model can rank.2627See `references/recon-playbook.md` for concrete tools and commands per step.2829## Quick reference — what to hunt30| Category | Goldmine sources |31|----------|------------------|32| Subdomains | crt.sh / cert transparency, `subfinder`, `amass`, DNS brute-force |33| Forgotten assets | staging/dev/old subdomains, S3/GCS/Azure buckets, archived pages (Wayback) |34| Tech stack | `whatweb`, `wappalyzer`, response headers, favicon hash, JS libs |35| Endpoints/params | `gau`/`waybackurls`, JS file parsing, `katana`, robots/sitemap, Swagger/GraphQL |36| Leaked secrets | GitHub/Gist dorking, `trufflehog`/`gitleaks` on public repos, paste sites |37| Exposed creds | breach-corpus lookups for org emails (defensive: know what attackers know) |3839## Output: target inventory40A list the threat model consumes:4142| Asset | Type | Tech | Notable | Exposure |43|-------|------|------|---------|----------|44| `api.example.com` | API host | Node/Express | Swagger exposed | public |45| `staging.example.com` | web | old build | debug=on | should be internal |4647## Hand-off48Feed the inventory into **`threat-modeling`** to rank, then **`security-code-audit`** /49**`api-security-testing`** for the prioritized targets.5051## Common mistakes52- Jumping to scanning before passive recon — you make noise and miss the easy wins.53- Enumerating only the main domain — forgotten subdomains/buckets are where breaches live.54- Ignoring JS bundles — they leak endpoints, params, and sometimes keys.55- Testing assets you found but aren't authorized for — discovery ≠ permission.
mn-youssef