recon-osint

Reconnaissance & OSINT

When to Activate

• New target engagement begins — need full attack surface mapping
• Gathering intelligence before exploitation phase
• Building target profile for social engineering
• Identifying exposed services, leaked credentials, historical infrastructure

Methodology

Phase 1: Passive Reconnaissance

Domain & Subdomain Enumeration

# Subdomain discovery (passive)
subfinder -d $DOMAIN -all -o subs_passive.txt
amass enum -passive -d $DOMAIN -o subs_amass.txt
cat subs_*.txt | sort -u > all_subdomains.txt

# Certificate transparency
curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" | jq -r '.[].name_value' | sort -u >> all_subdomains.txt

# Wayback Machine URL discovery
waybackurls $DOMAIN | sort -u > wayback_urls.txt
cat wayback_urls.txt | grep -E '\.(js|json|xml|config|env|bak|sql)' > interesting_urls.txt

# DNS records
for type in A AAAA MX NS TXT SOA CNAME SRV; do
  dig +short $type $DOMAIN
done | tee dns_records.txt

# WHOIS
whois $DOMAIN | tee whois.txt

Technology Fingerprinting

# HTTP probing live subdomains
cat all_subdomains.txt | httpx -sc -cl -title -tech-detect -o httpx_results.txt

# Web crawling for endpoints
katana -u https://$DOMAIN -d 3 -jc -o crawl_results.txt

# Wappalyzer-style detection
whatweb https://$DOMAIN

CVE & Exploit Intelligence

# For each identified component+version:
searchsploit "$COMPONENT $VERSION"
searchsploit -j "$COMPONENT $VERSION" | jq '.RESULTS_EXPLOIT[]'

# NVD API
curl -s "https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=$COMPONENT+$VERSION&resultsPerPage=10" \
  | jq '.vulnerabilities[].cve | {id, descriptions: .descriptions[0].value}'

# GitHub PoC search
curl -s "https://api.github.com/search/repositories?q=CVE+$COMPONENT+poc&sort=updated&per_page=5" \
  | jq '.items[] | {name, html_url, description}'

# Nuclei template scan
nuclei -u https://$DOMAIN -t cves/ -severity critical,high -o nuclei_cves.txt

Phase 2: Active Reconnaissance