OSINT and Reconnaissance

3 min readArticle

OSINT (Open Source Intelligence) is the practice of collecting information from publicly available sources. Recon is the broader pre-engagement information gathering phase — understanding your target before you attack or defend. Good recon makes everything that follows more effective.

Passive vs Active

Type	Definition	Detection Risk	Examples
Passive	No direct interaction with target	Very low	Google, Shodan, WiGLE, LinkedIn, DNS records
Active	Direct interaction with target systems	Moderate-High	Nmap, banner grabbing, zone transfers

Always start passive — gather as much as possible before touching anything.

Passive OSINT Sources

Search Engines and OSINT Platforms

bash

# Google Dorking
site:target.com filetype:pdf
site:target.com ext:sql OR ext:log
"@target.com" -site:target.com  # Emails exposed elsewhere
inurl:target.com password OR login OR admin

# Bing / DuckDuckGo — sometimes shows different results

# Shodan — internet-facing services
shodan search "org:\"Target Company\""
shodan search "hostname:target.com"

# Censys — similar to Shodan
censys search "autonomous_system.name:\"Target\""

DNS and Network Information

bash

# WHOIS
whois target.com
whois 192.168.1.1

# DNS records
dig target.com ANY
dig target.com MX
dig target.com TXT  # SPF, DKIM, verification records

# Subdomain enumeration (passive)
# crt.sh — certificate transparency
curl "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

# theHarvester — aggregate passive recon
theHarvester -d target.com -b all

# Amass (passive)
amass enum -passive -d target.com

Social and Human Intelligence

bash

# LinkedIn — employee names, job titles, technologies used
# LinkedIn search: "target company" AND (IT OR security OR developer)

# GitHub — code leaks, API keys, internal docs
# site:github.com "target.com"
# github.com/search?q=target.com

# Pastebin — leaked data
# site:pastebin.com "target.com"

# HaveIBeenPwned — check if email in breach data
curl "https://haveibeenpwned.com/api/v3/breachedaccount/[email protected]"

Certificate Transparency

bash

# Find all SSL certs issued for a domain
curl "https://crt.sh/?q=%.target.com&output=json" | python3 -m json.tool | grep "name_value"

# This reveals subdomains the target uses
# Often shows internal/dev subdomains exposed externally

Active Recon

See active/index for detailed active recon notes.

Quick reference:

bash

# Host discovery
nmap -sn 192.168.1.0/24
netdiscover -r 192.168.1.0/24

# Port/service scanning
nmap -sS -sV -T4 192.168.1.1
nmap -sV -sC --script=vuln target.com

# DNS zone transfer
dig axfr @ns1.target.com target.com

# Web app discovery
gobuster dir -u https://target.com -w /usr/share/wordlists/dirb/common.txt

Tools Summary

Tool	Type	Use
theHarvester	Passive	Email, subdomain, people
Maltego	Passive/Active	Visual link analysis
Shodan	Passive	Internet device search
Censys/ZoomEye	Passive	IoT/device search
WiGLE	Passive	WiFi network database
Recon-ng	Passive	Modular OSINT framework
SpiderFoot	Passive	Automated OSINT
Amass	Passive/Active	Subdomain enumeration
OSINT Framework	Reference	osintframework.com

Wireless OSINT

For WiFi reconnaissance specifically:

../attacks/wireless-hacking/wifi-hacking/wigle — WiGLE database (historical WiFi data)
../attacks/wireless-hacking/wifi-hacking/war-driving/index — Active war driving
../attacks/wireless-hacking/wifi-hacking/war-driving/kismet — Kismet for passive mapping

Sub-pages

active/index — Active recon techniques
active/shodan.io — Shodan reference
active/iot-search — IoT search engines

techzonesite.comUnlock Your IT Potential