Performing Osint Recon On Simulated Target

⚠️ Educational Use Only — All OSINT in this skill is practiced against simulated, fictitious targets. Never collect personal information about real individuals without consent. OSINT techniques applied to real people without their knowledge may violate privacy laws (GDPR, CCPA) even when using public data. Professional OSINT is conducted with clear scope agreements.

When to Use

• At the start of an authorized penetration test, during the passive reconnaissance phase
• In CTF challenges requiring information gathering before exploitation
• When learning how attackers gather intelligence before targeting an organization
• When training a security team to understand their own exposure footprint
• As a prerequisite for spear-phishing simulations, credential stuffing, and targeted attack simulation skills

Prerequisites

• Knowledge: Basic internet navigation, understanding of DNS (what an A record, MX record, and CNAME are)
• Lab: labs/network/port-scan-lab (shared environment with simulated DNS)
• Difficulty: Beginner — no technical background required
• Time: 30–45 minutes

Workflow

Step 1: Start the Lab

agentlab start port-scan-lab
# The lab includes a simulated DNS server and fake company profile for "Acme Corp"
# All data is synthetic — no real organizations or individuals
agentlab exec port-scan-lab bash

Step 2: DNS Enumeration

DNS records reveal infrastructure:

# Basic DNS lookup (against simulated DNS server)
dig acme-corp.lab A          # IPv4 addresses
dig acme-corp.lab MX         # Mail servers
dig acme-corp.lab NS         # Name servers
dig acme-corp.lab TXT        # SPF, DKIM, verification records
dig acme-corp.lab AAAA       # IPv6 addresses

# Zone transfer (misconfiguration — dumps all DNS records)
dig axfr acme-corp.lab @ns1.acme-corp.lab

Step 3: Subdomain Enumeration

# Dictionary-based subdomain enumeration
gobuster dns -d acme-corp.lab \
  -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
  -r 172.20.0.10:53

# Alternative with ffuf
ffuf -u http://FUZZ.acme-corp.lab \
     -w /usr/share/wordlists/seclists/Discovery/DNS/subdomains-top1million-5000.txt \
     -mc 200,301

# Discovered subdomains hint at internal services:
# mail.acme-corp.lab, dev.acme-corp.lab, staging.acme-corp.lab

Step 4: Certificate Transparency Log Simulation

In real OSINT, certificate transparency logs reveal all subdomains that have ever had TLS certificates:

# Lab simulates crt.sh response for acme-corp.lab
curl http://crt-sim.lab/acme-corp.lab | jq '.[].name_value' | sort -u

# Common finds: internal subdomains leaked via certificates
# vpn.acme-corp.lab, jira.acme-corp.lab, confluence.acme-corp.lab

Step 5: Email Harvesting Simulation

# Simulated theHarvester output for acme-corp.lab
theHarvester -d acme-corp.lab -b lab-sim -l 50

# Output includes simulated email format:
# j.smith@acme-corp.com, a.jones@acme-corp.com
# Pattern: firstname.lastname@acme-corp.com

This reveals the email format — critical for spear-phishing and credential stuffing.

Step 6: Google Dork Simulation

Google dorks find sensitive files indexed by search engines:

# The lab provides a simulated search engine with indexed target pages
dork-sim "site:acme-corp.lab filetype:pdf"
dork-sim "site:acme-corp.lab inurl:admin"
dork-sim "site:acme-corp.lab intitle:\"index of\""
dork-sim "\"acme-corp.lab\" filetype:sql"

# Results may include: employee_list.pdf, admin/login.php, database_backup.sql

Step 7: Capture the Flag

The simulated zone transfer exposes a flag record:

dig axfr acme-corp.lab @ns1.acme-corp.lab | grep FLAG
# flag.acme-corp.lab.  300 IN TXT "FLAG{dns_zone_transfer_exposed}"

Key Concepts

Tools

Output / Verification

agentlab verify port-scan-lab "FLAG{dns_zone_transfer_exposed}"

Further Reading

• OSINT Framework
• MITRE ATT&CK: T1589 | T1590
• Google Hacking Database (GHDB)
• theHarvester GitHub