osint

Cybersecurity Skills (Invoke First)

Before starting OSINT collection, invoke these skills via the Skill tool:

• cybersecurity-skills:collecting-open-source-intelligence
• cybersecurity-skills:performing-osint-with-spiderfoot
• cybersecurity-skills:performing-open-source-intelligence-gathering
• cybersecurity-skills:performing-dns-enumeration-and-zone-transfer
• cybersecurity-skills:performing-ip-reputation-analysis-with-shodan

Scope Enforcement

OSINT is passive — does not touch target systems directly. Still verify target domain/company is in scope.txt before proceeding. All output is for intelligence gathering only. Store in evidence/osint/.

Domain Intelligence

WHOIS & DNS

mkdir -p evidence/$(date +%Y%m%d)/$TARGET/osint/{dns,web,email,social,breach}

# WHOIS registration data
whois $DOMAIN 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/osint/whois.txt

# Full DNS record enumeration
dig ANY $DOMAIN @8.8.8.8 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns_any.txt
dig NS $DOMAIN @8.8.8.8 2>&1
dig MX $DOMAIN @8.8.8.8 2>&1
dig TXT $DOMAIN @8.8.8.8 2>&1
dig AAAA $DOMAIN @8.8.8.8 2>&1

# Resolve all DNS record types with dnsx
dnsx -d $DOMAIN -a -aaaa -cname -ns -mx -txt -soa -resp \
  -o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/dnsx_all.txt 2>&1

# Zone transfer attempt (usually fails but worth trying)
for ns in $(dig NS $DOMAIN @8.8.8.8 +short); do
  echo "=== Zone transfer attempt: $ns ==="
  dig axfr $DOMAIN @$ns 2>&1
done | tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns/zone_transfer_attempt.txt

# Reverse DNS lookup
dig -x $IP @8.8.8.8 2>&1

Certificate Transparency

# crt.sh — all certificates for domain (historical + current)
curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" | \
  python3 -c "
import json, sys
data = json.load(sys.stdin)
names = set()
for entry in data:
    name = entry.get('name_value', '')
    for n in name.split('\n'):
        n = n.strip().lstrip('*.')
        if n and '$DOMAIN' in n:
            names.add(n)
print('\n'.join(sorted(names)))
" 2>&1 | tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt

echo "[*] Found $(wc -l < evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt) unique subdomains from crt.sh"

# Subfinder passive subdomain enumeration
subfinder -d $DOMAIN \
  -silent \
  -o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/subfinder.txt 2>&1

# Combine and resolve all found subdomains
cat evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt \
    evidence/$(date +%Y%m%d)/$TARGET/osint/dns/subfinder.txt | \
  sort -u | \
  dnsx -a -resp-only -silent \
  -o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/resolved_subdomains.txt 2>&1

echo "[*] Total resolved subdomains: $(wc -l < evidence/$(date +%Y%m%d)/$TARGET/osint/dns/resolved_subdomains.txt)"