conducting-external-reconnaissance-with-osint

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.

Jump to install

Repository: autohandai/community-skills
Last source activity: March 16, 2026 at 00:59
Detected SKILL.md language: English
Stars: 10
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	conducting-external-reconnaissance-with-osint
description	Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
domain	cybersecurity
subdomain	penetration-testing
tags	["OSINT","reconnaissance","attack-surface","footprinting","passive-recon"]
version	1.0.0
author	mahipal
license	Apache-2.0

Conducting External Reconnaissance with OSINT

When to Use

Performing the initial reconnaissance phase of a penetration test to gather intelligence before active scanning
Mapping an organization's external attack surface to identify unknown or shadow IT assets
Collecting employee information, email formats, and organizational structure for social engineering campaigns
Identifying exposed credentials, leaked data, or sensitive documents published on the internet
Scoping the breadth of an organization's digital footprint prior to a red team engagement

Do not use for stalking, harassment, or unauthorized surveillance of individuals. OSINT gathering must be conducted within the scope of an authorized engagement and comply with applicable privacy laws (GDPR, CCPA).

Prerequisites

Written authorization to perform reconnaissance against the target organization
Dedicated research workstation with a VPN or Tor for anonymized queries when required
OSINT framework tools installed: Amass, theHarvester, Shodan CLI, Recon-ng, SpiderFoot
API keys for Shodan, Censys, SecurityTrails, Hunter.io, VirusTotal, and GitHub for enhanced results
Disposable email accounts for accessing services that require registration during research

Workflow

Step 1: Domain and DNS Enumeration

Enumerate all domains, subdomains, and DNS records associated with the target:

Root domain identification: Start with the primary domain and identify all related domains through reverse WHOIS lookups on registrant name, email, and organization using whoxy.com or domaintools.com
Subdomain enumeration: Run multiple tools for comprehensive coverage:
- amass enum -passive -d target.com -o amass_subs.txt for passive subdomain discovery from 40+ data sources
- subfinder -d target.com -all -o subfinder_subs.txt for fast passive enumeration
- crt.sh certificate transparency log queries: curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u
DNS record analysis: Query for all record types: dig target.com ANY, check for SPF, DKIM, DMARC records that reveal email infrastructure, and enumerate MX records to identify email providers
Zone transfer attempt: dig axfr @ns1.target.com target.com to check for misconfigured DNS servers

Term	Definition
OSINT	Open Source Intelligence; intelligence collected from publicly available sources including websites, social media, public records, and government data
Passive Reconnaissance	Information gathering without directly interacting with target systems, leaving no footprint in target logs
Active Reconnaissance	Information gathering that involves direct interaction with target systems (scanning, probing) and may be logged
Certificate Transparency	Public logs of TLS certificates issued by certificate authorities, queryable to discover subdomains and infrastructure
Attack Surface	The sum of all points where an unauthorized user can attempt to enter or extract data from an environment
Google Dorking	Using advanced Google search operators to find sensitive information indexed by search engines that was not intended to be public
Shadow IT	Technology systems and services deployed by employees or departments without the knowledge or approval of the IT department

## External Reconnaissance Report - TechCorp.io

### Attack Surface Summary
- **Domains discovered**: 3 (techcorp.io, techcorp.com, techcorpapp.com)
- **Subdomains enumerated**: 147 unique subdomains across all domains
- **Unique IP addresses**: 34 IPs mapped across AWS us-east-1 and us-west-2
- **Email addresses collected**: 89 valid corporate email addresses
- **Exposed services**: 12 internet-facing services identified via Shodan/Censys

### Critical Findings

**1. Unauthenticated Elasticsearch Instance**
- Host: 52.xx.xx.xx:9200 (elastic.techcorp.io)
- Indexed data: Application logs containing user session tokens and PII
- Source: Shodan search "ssl.cert.subject.cn:techcorp.io"

**2. AWS Credentials in Public GitHub Repository**
- Repository: github.com/former-dev/techcorp-scripts
- File: .env containing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
- Status: Keys appear active (not tested - out of scope for passive recon)

**3. Directory Listing Exposing Internal Documents**
- URL: https://docs.techcorp.io/internal/
- Contents: Architecture diagrams, network topology, runbooks
- Source: Google dork "site:techcorp.io intitle:index.of"

### Recommendations
1. Immediately rotate the exposed AWS credentials and audit CloudTrail logs
2. Restrict Elasticsearch access to internal networks or add authentication
3. Disable directory listings on docs.techcorp.io and audit all web servers
4. Implement GitHub secret scanning across all organization repositories