OSINT Reconnaissance
Methodology
Phase 1 — Scope definition and initial collection
Target: domain, IP ranges, org name, LinkedIn company page, stock ticker
Deliverables: attack surface map, employee list, technology stack, exposed assets
Phase 2 — Domain and infrastructure enumeration
# DNS enumeration
dig +any target.com
nslookup -type=ANY target.com
fierce --domain target.com
dnsx -d target.com -a -aaaa -cname -mx -ns -txt
# ASN and IP range discovery
whois -h whois.radb.net -- '-i origin AS12345'
bgp.he.net — manual lookup
amass intel -org "Target Corp"
# Certificate transparency (fast subdomain discovery)
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u
Phase 3 — Subdomain enumeration
# Passive (no direct target contact)
amass enum -passive -d target.com
subfinder -d target.com -all
assetfinder target.com
findomain -t target.com
# Active (sends DNS queries)
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
puredns bruteforce /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt target.com
# Combine and resolve
cat passive.txt active.txt | sort -u | httpx -status-code -title -tech-detect
Phase 4 — Email harvesting
theHarvester -d target.com -l 500 -b google,bing,yahoo,linkedin,twitter
hunter.io API — pattern discovery + verification
phonebook.cz — email/subdomain/URL search
emailrep.io — reputation scoring
# LinkedIn scraping (respect ToS — use during authorized engagements)
linkedin2username.py -c "Target Corp" # generate username formats
Phase 5 — Technology fingerprinting
# Web technology
whatweb target.com
wappalyzer CLI — browser-based fingerprinting
builtwith.com — technology profile
# Cloud provider and CDN
clouddetect.py target.com
nmap -sV -p 80,443,8080,8443 target.com
# WAF detection
wafw00f https://target.com
nmap --script http-waf-detect target.com
Phase 6 — Employee and social reconnaissance
LinkedIn: employees, roles, technology mentions in profiles
GitHub: employee repos — leaked credentials, internal tool names, API endpoints
Twitter/X: security event mentions, tool names, incident indicators
Glassdoor: job postings reveal technology stack
Indeed job listings: mention specific products, frameworks, versions
Phase 7 — Exposed credentials and secrets
# GitHub dorking
"target.com" password site:github.com
"target.com" api_key site:github.com
"@target.com" site:pastebin.com
# Automated credential search
trufflehog git https://github.com/target-org/
gitrob --github-access-token <token> target-org
gitleaks detect --source=.
# Breach databases
haveibeenpwned.com API
dehashed.com
intelx.io
Phase 8 — Google Dorking
site:target.com filetype:pdf
site:target.com ext:xlsx OR ext:docx
site:target.com inurl:admin OR inurl:login
site:target.com "internal use only"
"@target.com" site:linkedin.com
cache:target.com/admin
Tools
MITRE ATT&CK Mapping
- T1590 — Gather Victim Network Information
- T1591 — Gather Victim Organization Information
- T1592 — Gather Victim Host Information
- T1589 — Gather Victim Identity Information
sunilgentyala