conducting-external-reconnaissance-with-osint

Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.

仓库: mukul975/Anthropic-Cybersecurity-Skills
最近来源活动: 2026年8月2日 16:32
检测到的 SKILL.md 语言: 英语
星标: 27,732
分支: 3,366

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

返回搜索返回安装

name	conducting-external-reconnaissance-with-osint
description	Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
domain	cybersecurity
subdomain	penetration-testing
tags	["OSINT","reconnaissance","attack-surface","footprinting","passive-recon"]
version	1.0.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]
mitre_attack	["T1595","T1592","T1589","T1590"]

Conducting External Reconnaissance with OSINT

When to Use

Performing the initial reconnaissance phase of a penetration test to gather intelligence before active scanning
Mapping an organization's external attack surface to identify unknown or shadow IT assets
Collecting employee information, email formats, and organizational structure for social engineering campaigns
Identifying exposed credentials, leaked data, or sensitive documents published on the internet
Scoping the breadth of an organization's digital footprint prior to a red team engagement

Do not use for stalking, harassment, or unauthorized surveillance of individuals. OSINT gathering must be conducted within the scope of an authorized engagement and comply with applicable privacy laws (GDPR, CCPA).

Prerequisites

Written authorization to perform reconnaissance against the target organization
Dedicated research workstation with a VPN or Tor for anonymized queries when required
OSINT framework tools installed: Amass, theHarvester, Shodan CLI, Recon-ng, SpiderFoot
API keys for Shodan, Censys, SecurityTrails, Hunter.io, VirusTotal, and GitHub for enhanced results
Disposable email accounts for accessing services that require registration during research

Workflow

Step 1: Domain and DNS Enumeration

Enumerate all domains, subdomains, and DNS records associated with the target:

Root domain identification: Start with the primary domain and identify all related domains through reverse WHOIS lookups on registrant name, email, and organization using whoxy.com or domaintools.com
Subdomain enumeration: Run multiple tools for comprehensive coverage:
- amass enum -passive -d target.com -o amass_subs.txt for passive subdomain discovery from 40+ data sources
- subfinder -d target.com -all -o subfinder_subs.txt for fast passive enumeration
- crt.sh certificate transparency log queries: curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -u
DNS record analysis: Query for all record types: dig target.com ANY, check for SPF, DKIM, DMARC records that reveal email infrastructure, and enumerate MX records to identify email providers
Zone transfer attempt: dig axfr @ns1.target.com target.com to check for misconfigured DNS servers

Term	Definition
OSINT	Open Source Intelligence; intelligence collected from publicly available sources including websites, social media, public records, and government data
Passive Reconnaissance	Information gathering without directly interacting with target systems, leaving no footprint in target logs
Active Reconnaissance	Information gathering that involves direct interaction with target systems (scanning, probing) and may be logged
Certificate Transparency	Public logs of TLS certificates issued by certificate authorities, queryable to discover subdomains and infrastructure
Attack Surface	The sum of all points where an unauthorized user can attempt to enter or extract data from an environment
Google Dorking	Using advanced Google search operators to find sensitive information indexed by search engines that was not intended to be public
Shadow IT	Technology systems and services deployed by employees or departments without the knowledge or approval of the IT department

## External Reconnaissance Report - TechCorp.io

### Attack Surface Summary
- **Domains discovered**: 3 (techcorp.io, techcorp.com, techcorpapp.com)
- **Subdomains enumerated**: 147 unique subdomains across all domains
- **Unique IP addresses**: 34 IPs mapped across AWS us-east-1 and us-west-2
- **Email addresses collected**: 89 valid corporate email addresses
- **Exposed services**: 12 internet-facing services identified via Shodan/Censys

### Critical Findings

**1. Unauthenticated Elasticsearch Instance**
- Host: 52.xx.xx.xx:9200 (elastic.techcorp.io)
- Indexed data: Application logs containing user session tokens and PII
- Source: Shodan search "ssl.cert.subject.cn:techcorp.io"

**2. AWS Credentials in Public GitHub Repository**
- Repository: github.com/former-dev/techcorp-scripts
- File: .env containing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
- Status: Keys appear active (not tested - out of scope for passive recon)

**3. Directory Listing Exposing Internal Documents**
- URL: https://docs.techcorp.io/internal/
- Contents: Architecture diagrams, network topology, runbooks
- Source: Google dork "site:techcorp.io intitle:index.of"

### Recommendations
1. Immediately rotate the exposed AWS credentials and audit CloudTrail logs
2. Restrict Elasticsearch access to internal networks or add authentication
3. Disable directory listings on docs.techcorp.io and audit all web servers
4. Implement GitHub secret scanning across all organization repositories