| name | osint-footprinting |
| description | Map a target organization's external footprint and attack surface from public sources — domains, subdomains, IP ranges, exposed services, technologies, and organizational details. Use at the start of an engagement (or for attack-surface management) to see what an attacker sees. Authorized scope, public sources. |
Goal
A structured, organized map of the target's internet-facing attack surface, built
from public/passive sources, ready to drive testing or defensive remediation.
What to gather (see reference.md for sources)
- Domains & subdomains — root domains, subdomains (passive DNS, CT logs),
related/typosquat domains.
- IP space & hosting — IP ranges, ASNs, cloud footprint, CDNs.
- Exposed services — internet-reachable hosts/ports/services (passive sources
like internet-wide scan datasets), web apps, login portals, remote access.
- Technologies — stacks, frameworks, third-party services, email/DNS records
(SPF/DMARC/MX).
- Organizational context — business units, acquisitions, brands (each expands
the surface), code repos and public assets.
Steps
- Confirm scope (which org/domains are authorized) — stay within it.
- Collect from public/passive sources; avoid active scanning here (hand live hosts
to
network-security:network-pentest if/when authorized).
- Organize by asset, deduplicate, and flag the most exposed/sensitive (admin
portals, remote access, forgotten/legacy assets, dev/staging exposed to internet).
- Map it — an attack-surface mindmap (
security-diagramming:mindmap).
Output
An attack-surface inventory: asset · type · service/tech · exposure · source · notes,
plus a prioritized list of where to test (offense) or remediate (defense). Feed
exposures to exposure-discovery and live hosts to network-security.
Notes
Footprinting is passive and public-source — it shows the attacker's outside view.
Forgotten/legacy and dev/staging assets exposed to the internet are the highest-value
finds. Acquisitions and alternate brands quietly expand the surface — enumerate them.
Stay within the authorized scope even though sources are public.
