[ TIP ]
OSINT = gathering information from publicly available sources, without ever approaching the target itself. Stay passive until you have explicit permission for active recon.
Methodology — from broad to narrow
- Define scope — person, company, or domain? What is/isn't allowed (rules of engagement)
- Passive recon — public sources, no direct interaction with the target
- Broaden — related domains, employees, leaks, social media
- Verify — cross-reference information across multiple sources, don't trust a single hit
- Report — only relevant findings, with a source per item
Per target type: company/domain
# Subdomains
subfinder -d target.com
amass enum -passive -d target.com
# DNS and infrastructure
whois target.com
dig target.com ANY
# Technology stack of the website
whatweb target.com- Shodan / Censys — which services are publicly open
- crt.sh — certificate transparency logs, often subdomains that don't show up in DNS enum
- LinkedIn — employees, roles, technology mentioned in job postings
Per target type: person
- Sherlock / Maigret — recognize a username across hundreds of platforms
- Have I Been Pwned — which breaches contain this email address
- Google dorking —
site:linkedin.com "name",filetype:pdf "name" - EXIF data in publicly shared photos — location, device
[WARN]
Person-OSINT touches privacy law (GDPR/AVG) sooner than company-OSINT. Only do it within an explicit, authorized engagement.
Toolbelt
- theHarvester — emails, subdomains, names in one run
- Maltego — visually connect entities to each other
- SpiderFoot — automated, broad sweep across dozens of sources
- Wayback Machine — old versions of a site, often info that has since been removed