recon-osint

name	recon-osint
description	Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
metadata	{"type":"offensive","phase":"reconnaissance","tools":"subfinder, amass, puredns, dnsx, httpx, katana, gau, nuclei, subzy, baddns, cloud_enum, AADInternals, trufflehog, gitleaks, theHarvester, h8mail, shodan, censys","mitre":"TA0043"}
kill_chain	{"phase":["recon"],"step":[1],"attck_tactics":["TA0043","TA0006"],"attck_techniques":["T1595","T1595.002","T1590","T1590.001","T1590.002","T1590.005","T1592","T1592.002","T1589","T1589.001","T1589.002","T1593","T1593.001","T1593.003","T1596","T1596.005","T1591","T1583.001","T1213.003"]}
depends_on	[]
feeds_into	["vulnerability-analysis","web-pentest","network-attack","exploit-development","cloud-security","mobile-pentest","active-directory-attack","initial-access"]
inputs	["scope_definition","target_list","root_domains","asn_list","email_list"]
outputs	["attack_surface_map","subdomain_list","technology_fingerprint","cve_list","takeover_candidates","leaked_secrets","breach_intel","prioritized_findings"]
references	["references/subdomain-discovery.md","references/attack-surface-mapping.md","references/subdomain-takeover.md","references/cloud-saas-recon.md","references/breach-credential-intel.md","references/cve-exploit-intel.md"]
scripts	["scripts/recon_orchestrator.py","scripts/subdomain_takeover.py","scripts/js_secret_hunter.py","scripts/cloud_asset_enum.py","scripts/breach_intel.py","scripts/cve_prioritizer.py","scripts/wordlist_ranker.py","scripts/hackerone_public_recon.py"]

Reconnaissance & OSINT

When to Activate

• A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
• Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
• Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
• Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
• Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
• Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Passive subdomain enum (subfinder/amass/CT logs)	T1590.002, T1596.001	CWE-200	references/subdomain-discovery.md	scripts/recon_orchestrator.py
DNS brute / permutation / resolution (puredns/alterx/dnsx)	T1595.002, T1590.002	CWE-200	references/subdomain-discovery.md	scripts/recon_orchestrator.py
ASN → CIDR → reverse-DNS expansion	T1590.005, T1596.005	CWE-200	references/subdomain-discovery.md	scripts/recon_orchestrator.py
HTTP probing + tech fingerprint (httpx)	T1595.002, T1592.002	CWE-200	references/attack-surface-mapping.md	scripts/recon_orchestrator.py
Headless crawling + archive URLs (katana/gau)	T1595.002, T1593.003	CWE-200	references/attack-surface-mapping.md	scripts/js_secret_hunter.py
JavaScript endpoint / secret extraction	T1593.003, T1552.001	CWE-540	references/attack-surface-mapping.md	scripts/js_secret_hunter.py
Subdomain takeover (dangling CNAME/NS)	T1583.001, T1584.001	CWE-350	references/subdomain-takeover.md	scripts/subdomain_takeover.py
Deleted-S3 takeover → supply-chain pivot	T1583.001, T1195.002	CWE-350	references/subdomain-takeover.md	scripts/subdomain_takeover.py