OSINT: reconnaissance before the attack

August 5, 2024 · 1 min read · #recon #osint #reconnaissance

Open Source Intelligence gathers information from public sources to map the target before any direct contact — passive, hence invisible.

What is gathered

Surface: subdomains (crt.sh certificates, DNS), IPs and services (Shodan, Censys). People: emails and roles (LinkedIn, corporate email formats), yielding lists for spraying/phishing. Leaks: credentials in past breaches, secrets in public repos (GitHub dorks). Metadata: in published documents (authors, software, internal paths).

crt.sh?q=%25.company.com          # subdomains from certificates
shodan search hostname:company.com
github dork: "company.com" password

Defence

Reduce your footprint: no secrets in repos (continuous scanning), metadata scrubbed from documents, minimal service exposure. Monitor what of you is public (attack surface management), and breaches involving your domains. You cannot prevent OSINT, but you can reduce what it finds.

« back to home