conducting-external-reconnaissance-with-osint

name	conducting-external-reconnaissance-with-osint
description	Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
domain	cybersecurity
subdomain	penetration-testing
tags	["OSINT","reconnaissance","attack-surface","footprinting","passive-recon"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]

Conducting External Reconnaissance with OSINT

When to Use

• Performing the initial reconnaissance phase of a penetration test to gather intelligence before active scanning
• Mapping an organization's external attack surface to identify unknown or shadow IT assets
• Collecting employee information, email formats, and organizational structure for social engineering campaigns
• Identifying exposed credentials, leaked data, or sensitive documents published on the internet
• Scoping the breadth of an organization's digital footprint prior to a red team engagement

Do not use for stalking, harassment, or unauthorized surveillance of individuals. OSINT gathering must be conducted within the scope of an authorized engagement and comply with applicable privacy laws (GDPR, CCPA).

Prerequisites

• Written authorization to perform reconnaissance against the target organization
• Dedicated research workstation with a VPN or Tor for anonymized queries when required
• OSINT framework tools installed: Amass, theHarvester, Shodan CLI, Recon-ng, SpiderFoot
• API keys for Shodan, Censys, SecurityTrails, Hunter.io, VirusTotal, and GitHub for enhanced results
• Disposable email accounts for accessing services that require registration during research

Workflow

Step 1: Domain and DNS Enumeration

Enumerate all domains, subdomains, and DNS records associated with the target:

• Root domain identification: Start with the primary domain and identify all related domains through reverse WHOIS lookups on registrant name, email, and organization using whoxy.com or domaintools.com
• Subdomain enumeration: Run multiple tools for comprehensive coverage:
  • amass enum -passive -d target.com -o amass_subs.txt for passive subdomain discovery from 40+ data sources
  • subfinder -d target.com -all -o subfinder_subs.txt for fast passive enumeration
  • crt.sh certificate transparency log queries: curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u
• DNS record analysis: Query for all record types: dig target.com ANY, check for SPF, DKIM, DMARC records that reveal email infrastructure, and enumerate MX records to identify email providers
• Zone transfer attempt: dig axfr @ns1.target.com target.com to check for misconfigured DNS servers