/conducting-external-reconnaissance-with-osint

name: conducting-external-reconnaissance-with-osint
description: Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
domain: cybersecurity
subdomain: penetration-testing
tags:
- OSINT
- reconnaissance
- attack-surface
- footprinting
- passive-recon
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- ID.RA-01
- ID.RA-06
- GV.OV-02
- DE.AE-07
mitre_attack:
- T1595
- T1592
- T1589
- T1590

Conducting External Reconnaissance with OSINT

When to Use

• Performing the initial reconnaissance phase of a penetration test to gather intelligence before active scanning
• Mapping an organization's external attack surface to identify unknown or shadow IT assets
• Collecting employee information, email formats, and organizational structure for social engineering campaigns
• Identifying exposed credentials, leaked data, or sensitive documents published on the internet
• Scoping the breadth of an organization's digital footprint prior to a red team engagement

**Do not use** for stalking, harassment, or unauthorized surveillance of individuals. OSINT gathering must be conducted within the scope of an authorized engagement and comply with applicable privacy laws (GDPR, CCPA).

Prerequisites

• Written authorization to perform reconnaissance against the target organization
• Dedicated research workstation with a VPN or Tor for anonymized queries when required
• OSINT framework tools installed: Amass, theHarvester, Shodan CLI, Recon-ng, SpiderFoot
• API keys for Shodan, Censys, SecurityTrails, Hunter.io, VirusTotal, and GitHub for enhanced results
• Disposable email accounts for accessing services that require registration during research

Workflow

Step 1: Domain and DNS Enumeration

Enumerate all domains, subdomains, and DNS records associated with the target:

• **Root domain identification**: Start with the primary domain and identify all related domains through reverse WHOIS lookups on registrant name, email, and organization using `whoxy.com` or `domaintools.com`
• **Subdomain enumeration**: Run multiple tools for comprehensive coverage:
• `amass enum -passive -d target.com -o amass_subs.txt` for passive subdomain discovery from 40+ data sources
• `subfinder -d target.com -all -o subfinder_subs.txt` for fast passive enumeration
• `crt.sh` certificate transparency log queries: `curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u`
• **DNS record analysis**: Query for all record types: `dig target.com ANY`, check for SPF, DKIM, DMARC records that reveal email infrastructure, and enumerate MX records to identify email providers
• **Zone transfer attempt**: `dig axfr @ns1.target.com target.com` to check for misconfigured DNS servers
• **Consolidate results**: Merge, deduplicate, and resolve all discovered subdomains to IP addresses. Map IP addresses to ASN and hosting providers.

Step 2: Infrastructure and Service Discovery

Identify internet-facing infrastructure without directly scanning target systems:

• **Shodan**: `shodan search "ssl.cert.subject.cn:target.com"` to find all internet-facing services with TLS certificates for the target domain. Also search by organization name and IP ranges.
• **Censys**: Search for target's IP ranges and TLS certificates to identify services, technologies, and potential vulnerabilities indexed from internet-wide scanning
• **Cloud asset discovery**: Check for S3 buckets (`target-com`, `target-backup`, `target-dev`), Azure Blob storage (`target.blob.core.windows.net`), and GCP storage using tools like `cloud_enum`
• **WAF and CDN identification**: Use `wafw00f target.com` to identify web application firewalls and CDN providers that may mask the origin server IP
• **Historical data**: Use Wayback Machine (`web.archive.org`) to find removed pages, old application versions, and forgotten endpoints

Step 3: Email and Personnel Intelligence

Gather employee information and email addresses for social engineering preparation:

• **Email harvesting**: `theHarvester -d target.com -b all -f harvest_results.html` to collect emails from search engines, LinkedIn, and data sources
• **Email format identification**: Use `hunter.io` to determine the email format (first.last, flast, firstl) and verify deliverability
• **LinkedIn reconnaissance**: Identify employees by department, particularly IT administrators, security team members, and executives. Note technologies mentioned in job postings and employee profiles.
• **Organizational chart**: Build an org chart from LinkedIn data to understand reporting structures, identify key personnel, and map departments
• **Social media analysis**: Review employee social media profiles for information about internal tools, technologies, office locations, badge photos, and security practices
• **Job postings**: Analyze current and historical job postings on the company career page and job boards for technology stack details, tools, and infrastructure information

Step 4: Credential and Data Leak Analysis

Search for exposed credentials and sensitive data:

• **Breach databases**: Check `haveibeenpwned.com` API for breached email addresses associated with the target domain
• **Paste sites**: Search Pastebin, GitHub Gists, and similar paste sites for leaked credentials, configuration files, or internal documents
• **Code repositories**: Search GitHub, GitLab, and Bitbucket for:
• `org:target "password"`, `org:target "api_key"`, `org:target "secret"`
• Use `trufflehog` or `gitleaks` for automated secret scanning across the target's public repositories
• **Document metadata**: Download publicly av