osint-footprinting

name	osint-footprinting
description	Map a target organization's external footprint and attack surface from public sources — domains, subdomains, IP ranges, exposed services, technologies, and organizational details. Use at the start of an engagement (or for attack-surface management) to see what an attacker sees. Authorized scope, public sources.

Goal

A structured, organized map of the target's internet-facing attack surface, built from public/passive sources, ready to drive testing or defensive remediation.

What to gather (see reference.md for sources)

1. Domains & subdomains — root domains, subdomains (passive DNS, CT logs), related/typosquat domains.
2. IP space & hosting — IP ranges, ASNs, cloud footprint, CDNs.
3. Exposed services — internet-reachable hosts/ports/services (passive sources like internet-wide scan datasets), web apps, login portals, remote access.
4. Technologies — stacks, frameworks, third-party services, email/DNS records (SPF/DMARC/MX).
5. Organizational context — business units, acquisitions, brands (each expands the surface), code repos and public assets.

Steps

1. Confirm scope (which org/domains are authorized) — stay within it.
2. Collect from public/passive sources; avoid active scanning here (hand live hosts to network-security:network-pentest if/when authorized).
3. Organize by asset, deduplicate, and flag the most exposed/sensitive (admin portals, remote access, forgotten/legacy assets, dev/staging exposed to internet).
4. Map it — an attack-surface mindmap (security-diagramming:mindmap).

Output

An attack-surface inventory: asset · type · service/tech · exposure · source · notes, plus a prioritized list of where to test (offense) or remediate (defense). Feed exposures to exposure-discovery and live hosts to network-security.

Notes

Footprinting is passive and public-source — it shows the attacker's outside view. Forgotten/legacy and dev/staging assets exposed to the internet are the highest-value finds. Acquisitions and alternate brands quietly expand the surface — enumerate them. Stay within the authorized scope even though sources are public.