OSINT
Passive and semi-passive intelligence gathering focused on code repositories, developer footprints, and exposed secrets across public platforms.
Phases
1. Organization Discovery
- Enumerate GitHub/GitLab/Bitbucket orgs for target company name variants
- Find employee personal accounts linked to the target org
- Identify archived, forked, and deleted repositories
2. Repository Analysis
- Map all repos: tech stack, languages, CI/CD, dependencies
- Identify internal hostnames, IPs, endpoints, environment names
- Check for
.env, config files, secrets in current code
3. Secret & Credential Scanning
- Scan current code with
gitleaks / trufflehog
- Scan full git history (secrets removed in commits are still accessible)
- Search with targeted dorks (see
reference/repository-recon.md)
4. Code Intelligence
- Extract API endpoints, auth patterns, internal service names
- Review Dockerfiles, CI configs, IaC for infra details
- Check dependency files for version-specific CVE candidates
Output
data/reconnaissance/repositories.json # Repo inventory + findings
reports/reconnaissance_report.md # OSINT section appended
raw/osint/ # Raw tool outputs
Tools
trufflehog, gitleaks, gitrob, GitHub/GitLab search, gh CLI, git log
Rules
- Passive discovery first (search APIs, public pages) before any cloning
- Scan git history — deleted secrets are still in commit objects
- Check employee personal accounts, not just org accounts
- Document every discovered credential/secret immediately as a finding
- All output saved to
{OUTPUT_DIR}/ per CLAUDE.md directory structure
Reference
reference/repository-recon.md - Dorks, tool commands, secret patterns, workflow
1---2name: osint3description: Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.4---5
6# OSINT
7
8Passive and semi-passive intelligence gathering focused on code repositories, developer footprints, and exposed secrets across public platforms.
9
10## Phases
11
12### 1. Organization Discovery
13- Enumerate GitHub/GitLab/Bitbucket orgs for target company name variants
14- Find employee personal accounts linked to the target org
15- Identify archived, forked, and deleted repositories
16
17### 2. Repository Analysis
18- Map all repos: tech stack, languages, CI/CD, dependencies
19- Identify internal hostnames, IPs, endpoints, environment names
20- Check for `.env`, config files, secrets in current code
21
22### 3. Secret & Credential Scanning
23- Scan current code with `gitleaks` / `trufflehog`
24- Scan full git history (secrets removed in commits are still accessible)
25- Search with targeted dorks (see `reference/repository-recon.md`)
26
27### 4. Code Intelligence
28- Extract API endpoints, auth patterns, internal service names
29- Review Dockerfiles, CI configs, IaC for infra details
30- Check dependency files for version-specific CVE candidates
31
32## Output
33
34```
35data/reconnaissance/repositories.json # Repo inventory + findings
36reports/reconnaissance_report.md # OSINT section appended
37raw/osint/ # Raw tool outputs
38```
39
40## Tools
41
42`trufflehog`, `gitleaks`, `gitrob`, GitHub/GitLab search, `gh` CLI, `git log`
43
44## Rules
45
461. Passive discovery first (search APIs, public pages) before any cloning
472. Scan git history — deleted secrets are still in commit objects
483. Check employee personal accounts, not just org accounts
494. Document every discovered credential/secret immediately as a finding
505. All output saved to `{OUTPUT_DIR}/` per CLAUDE.md directory structure
51
52## Reference
53
54- `reference/repository-recon.md` - Dorks, tool commands, secret patterns, workflow
transilienceai