Open-Source Intelligence (OSINT) Reconnaissance
OSINT reconnaissance
The OSINT domain tests whether you can convert public data into an actionable, in-scope attack surface for the PNPT scenario. Expect to enumerate domains, subdomains, email format, employee usernames, exposed services, and leaked credentials, then correlate them into a target list and a credential-spraying candidate list.
Core rules and concepts
- Stay inside written scope: only authorized domains, IP ranges, and subsidiaries.
- Collect passively first: search engines, certificate transparency, DNS, WHOIS, job posts, GitHub, and breach-data services.
- Keep an evidence trail: timestamp queries, save raw output, and record source URLs.
- Correlate findings: an email format plus a VPN portal plus a breach dump beats three unrelated lists.
- Mine metadata: PDF authors, document paths, and EXIF can reveal usernames and naming conventions.
Worked example
Target: acme-example.com. A dork such as site:acme-example.com filetype:pdf finds a public PDF whose author field is 'j.smith'. LinkedIn shows [email protected]. TheHarvester returns 40 employee emails and staging.acme-example.com; certificate transparency adds vpn.acme-example.com. A breach service lists two @acme-example.com addresses in an old combo list. Reasoning: the format builds a spray list, the VPN host is an external authentication target, and staging is a likely weaker web app. You now have a prioritized external hypothesis before active scanning.
Traps that cost marks
- Collecting hundreds of emails but never prioritizing them.
- Touching subsidiaries or domains outside scope.
- Omitting the source of a finding, making the report unreproducible.
- Treating OSINT as passive-only when it must feed active testing.