Map an organization's internet-facing assets using public information, including domains, indexed services, employee details, and leaked data. Compile findings into a reconnaissance report to support authorized security assessments and identify potential exposure.
中文简介正在准备中。当前显示英语简介。
Conduct external recon using OSINT techniques to map an organization's external attack surface without touching target systems, gathering DNS records, certificate transparency logs, search results, social media, code repositories, and breach databases into a target profile. Use for the passive info-gathering phase of a pentest, external footprinting, or collecting employee/email intel for a social engineering campaign.
实测评分 未实测
查看安装方法安装前可以查看交给 AI 代理的指令内容。
Do not use for stalking, harassment, or unauthorized surveillance of individuals. OSINT gathering must be conducted within the scope of an authorized engagement and comply with applicable privacy laws (GDPR, CCPA).
Enumerate all domains, subdomains, and DNS records associated with the target:
whoxy.com or domaintools.comamass enum -passive -d target.com -o amass_subs.txt for passive subdomain discovery from 40+ data sourcessubfinder -d target.com -all -o subfinder_subs.txt for fast passive enumerationcrt.sh certificate transparency log queries: curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -udig target.com ANY, check for SPF, DKIM, DMARC records that reveal email infrastructure, and enumerate MX records to identify email providersdig axfr @ns1.target.com target.com to check for misconfigured DNS serversIdentify internet-facing infrastructure without directly scanning target systems:
shodan search "ssl.cert.subject.cn:target.com" to find all internet-facing services with TLS certificates for the target domain. Also search by organization name and IP ranges.target-com, target-backup, target-dev), Azure Blob storage (target.blob.core.windows.net), and GCP storage using tools like cloud_enumwafw00f target.com to identify web application firewalls and CDN providers that may mask the origin server IPweb.archive.org) to find removed pages, old application versions, and forgotten endpointsGather employee information and email addresses for social engineering preparation:
theHarvester -d target.com -b all -f harvest_results.html to collect emails from search engines, LinkedIn, and data sourceshunter.io to determine the email format (first.last, flast, firstl) and verify deliverabilitySearch for exposed credentials and sensitive data:
haveibeenpwned.com API for breached email addresses associated with the target domainorg:target "password", org:target "api_key", org:target "secret"trufflehog or gitleaks for automated secret scanning across the target's public repositoriesexiftool to reveal internal usernames, software versions, printer names, and file pathssite:target.com filetype:pdf for public documentssite:target.com inurl:admin for admin panelssite:target.com "index of /" for directory listingssite:pastebin.com "target.com" for paste site mentionsIdentify the technologies, frameworks, and services used by the target:
whatweb target.com or Wappalyzer browser extension to identify CMS, frameworks, JavaScript libraries, analytics, and server softwaresslyze target.com or testssl.sh target.com to identify cipher suites, protocol versions, certificate details, and cryptographic weaknessesv=spf1 include:_spf.google.com indicates Google Workspace, MS=msXXXXXX indicates Microsoft 365)apktool (Android) or frida for hardcoded URLs, API endpoints, and embedded credentials| Term | Definition |
|---|---|
| OSINT | Open Source Intelligence; intelligence collected from publicly available sources including websites, social media, public records, and government data |
| Passive Reconnaissance | Information gathering without directly interacting with target systems, leaving no footprint in target logs |
| Active Reconnaissance | Information gathering that involves direct interaction with target systems (scanning, probing) and may be logged |
| Certificate Transparency | Public logs of TLS certificates issued by certificate authorities, queryable to discover subdomains and infrastructure |
| Attack Surface | The sum of all points where an unauthorized user can attempt to enter or extract data from an environment |
| Google Dorking | Using advanced Google search operators to find sensitive information indexed by search engines that was not intended to be public |
| Shadow IT | Technology systems and services deployed by employees or departments without the knowledge or approval of the IT department |
Context: A technology company has contracted a red team assessment. Before active testing begins, the team conducts passive OSINT to map the attack surface and identify potential entry points. The target is a SaaS company with 500 employees and a primary domain of techcorp.io.
Approach:
.env file with AWS access keysPitfalls:
## External Reconnaissance Report - TechCorp.io
### Attack Surface Summary
- **Domains discovered**: 3 (techcorp.io, techcorp.com, techcorpapp.com)
- **Subdomains enumerated**: 147 unique subdomains across all domains
- **Unique IP addresses**: 34 IPs mapped across AWS us-east-1 and us-west-2
- **Email addresses collected**: 89 valid corporate email addresses
- **Exposed services**: 12 internet-facing services identified via Shodan/Censys
### Critical Findings
**1. Unauthenticated Elasticsearch Instance**
- Host: 52.xx.xx.xx:9200 (elastic.techcorp.io)
- Indexed data: Application logs containing user session tokens and PII
- Source: Shodan search "ssl.cert.subject.cn:techcorp.io"
**2. AWS Credentials in Public GitHub Repository**
- Repository: github.com/former-dev/techcorp-scripts
- File: .env containing AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
- Status: Keys appear active (not tested - out of scope for passive recon)
**3. Directory Listing Exposing Internal Documents**
- URL: https://docs.techcorp.io/internal/
- Contents: Architecture diagrams, network topology, runbooks
- Source: Google dork "site:techcorp.io intitle:index.of"
### Recommendations
1. Immediately rotate the exposed AWS credentials and audit CloudTrail logs
2. Restrict Elasticsearch access to internal networks or add authentication
3. Disable directory listings on docs.techcorp.io and audit all web servers
4. Implement GitHub secret scanning across all organization repositories
还没有评价。欢迎分享你的使用感受。
无需登录即可发表。欢迎分享使用感受、提问，或说明在哪些环境下无法运行。
还没有评论。来写第一条吧。
Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.
中文简介正在准备中。当前显示英语简介。
Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.
中文简介正在准备中。当前显示英语简介。
Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.
中文简介正在准备中。当前显示英语简介。
Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.
中文简介正在准备中。当前显示英语简介。
Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.
中文简介正在准备中。当前显示英语简介。
Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.
中文简介正在准备中。当前显示英语简介。