kavklaw@llm $ cat osint-guide.md
⏱️ 30 min read · Master passive and active reconnaissance from Google dorks to GitHub secrets
Most OSINT is done through web browsers and public APIs — no special setup required. For the command-line tools used throughout this guide:
# Subdomain enumeration
sudo apt install subfinder amass
go install github.com/tomnomnom/assetfinder@latest # or: sudo apt install assetfinder
# DNS tools (usually pre-installed)
sudo apt install dnsutils # dig, nslookup, host
# Web probing
go install github.com/projectdiscovery/httpx/cmd/httpx@latest
# Email harvesting
sudo apt install theharvester
# Or: pip3 install theHarvester
# Username OSINT
pip3 install sherlock-project # sherlock
# Metadata extraction
sudo apt install libimage-exiftool-perl # exiftool
# Git secret scanning
# Install via Homebrew, Docker, or binary releases from GitHub
# See: https://github.com/trufflesecurity/trufflehog#installation
# Maltego — visual link analysis (GUI)
# Download Community Edition (free): https://www.maltego.com/downloads/
# Requires registration. Runs on Linux, macOS, Windows.
# Recon-ng — modular reconnaissance framework
sudo apt install recon-ng
# Or: pip3 install recon-ng
# Launch with: recon-ng, then install modules with "marketplace install all"
# URL mining
go install github.com/tomnomnom/waybackurls@latest
go install github.com/lc/gau/v2/cmd/gau@latestOn Kali Linux, most of these are pre-installed. The web-based tools (Google, Shodan, crt.sh, hunter.io) just need a browser. Shodan's CLI and API features require a free account at shodan.io.
Need results fast? Here's a 2-minute OSINT workflow against a target domain:
# Step 1: Passive subdomain enumeration
# subfinder queries public data sources to find subdomains without touching the target
subfinder -d target.com -silent | tee subdomains.txt
# Step 2: Check what's alive
# httpx probes each subdomain to see which ones have live web servers
cat subdomains.txt | httpx -silent -status-code -title | tee alive.txt
# Step 3: Google dork for exposed files
# In browser: site:target.com filetype:pdf OR filetype:doc OR filetype:xlsx
# Step 4: Quick DNS overview
# dig queries DNS records; whois shows domain registration info
dig target.com ANY +noall +answer
whois target.com | grep -E "Name Server|Registrant|Admin|Tech"
# Step 5: Certificate transparency for more subdomains
# crt.sh logs every SSL certificate issued — reveals subdomains
# jq is a command-line JSON parser that extracts the domain names
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' | sort -uThat gets you subdomains, live hosts, exposed documents, DNS records, and registration info — all in under two minutes. Here's what each technique does and how to get the most out of it.
Reconnaissance (often shortened to "recon") is the foundation of every penetration test, bug bounty (programs where companies pay you to find vulnerabilities), and red team engagement. Before you touch a single port, you need to understand your target. OSINT (Open Source Intelligence) is the art of gathering that understanding from publicly available information — anything that's not behind a login or paywall counts as open source: search engine results, social media posts, public records, DNS data, job listings, and more.
Every organization and individual leaves a digital footprint — the trail of information they create by existing online. For a company, this includes domain registrations, SSL certificates, job postings that reveal their tech stack, employee LinkedIn profiles, code pushed to GitHub, and documents published on their website. For individuals, it's social media activity, forum posts, reused usernames, and metadata in uploaded photos. Most people vastly underestimate how much of their digital footprint is publicly visible. As an OSINT practitioner, your job is to map this footprint and find the pieces that create security exposure — a leaked API key in a GitHub commit, an admin panel indexed by Google, or an employee's password reuse discovered through breach databases.
┌──────────────────────────────────────────────────────────┐
│ RECONNAISSANCE SPECTRUM │
├──────────────────────────────────────────────────────────┤
│ │
│ PASSIVE (invisible) ACTIVE (detectable) │
│ ════════════════ ═══════════════ │
│ Google / Shodan Port scanning (nmap) │
│ WHOIS / DNS (cached) DNS zone transfers │
│ CT logs (crt.sh) Directory brute forcing │
│ GitHub secrets Web crawling / spidering │
│ Wayback Machine Banner grabbing │
│ LinkedIn / social Vulnerability scanning │
│ Document metadata │
│ │
│ ◄─── No risk ────────────── Generates logs ───────────▶ │
│ ◄─── Do this FIRST ──────── Do this AFTER ────────────▶ │
│ │
└──────────────────────────────────────────────────────────┘There are two fundamental approaches:
You never touch the target directly. All information comes from third-party sources -- search engines, public databases, DNS records cached elsewhere, social media. The target has no idea you're looking at them.
You interact directly with the target. This generates traffic, logs, and potentially alerts. The target could detect your activity.
💡 Pro Tip: Always exhaust passive recon before moving to active. Passive gives you a massive amount of intelligence without any risk of detection. Many bug bounty hunters find critical vulnerabilities purely through passive OSINT -- exposed credentials on GitHub, forgotten admin panels indexed by Google, sensitive documents with metadata leaking internal usernames.
Google dorking (also called Google hacking) uses advanced search operators -- special keywords you add to a Google search -- to find information that shouldn't be publicly accessible. Google has indexed billions of pages, and many contain sensitive data their owners didn't intend to expose.
# site: — Restrict results to a specific domain
site:target.com
site:target.com # Includes subdomains (wildcard not needed)
site:target.com -site:www.target.com # Exclude www
# intitle: — Search within page titles
intitle:"index of" site:target.com # Open directory listings
intitle:"login" site:target.com # Find login pages
intitle:"admin" site:target.com # Admin panels
# inurl: — Search within URLs
inurl:admin site:target.com
inurl:wp-admin site:target.com # WordPress admin
inurl:phpinfo site:target.com # PHP info pages (info leak)
inurl:".env" site:target.com # Exposed .env files
# filetype: — Search for specific file types
filetype:pdf site:target.com # PDF documents
filetype:xlsx site:target.com # Excel spreadsheets
filetype:sql site:target.com # SQL database dumps!
filetype:log site:target.com # Log files
filetype:conf site:target.com # Configuration files
filetype:bak site:target.com # Backup files
# intext: — Search within page body text
intext:"password" filetype:log site:target.com
intext:"api_key" site:target.com
intext:"BEGIN RSA PRIVATE KEY" # Exposed private keys!
# cache: — View Google's cached version of a page
cache:target.com/admin # See even if they took it down# Find exposed configuration files
site:target.com filetype:xml OR filetype:conf OR filetype:cnf OR filetype:ini
# Find login portals
site:target.com inurl:login OR inurl:signin OR inurl:auth OR inurl:admin
# Find exposed documents with metadata
site:target.com filetype:pdf OR filetype:doc OR filetype:docx OR filetype:xls
# Find directory listings (goldmine!)
intitle:"index of" site:target.com
intitle:"index of" "parent directory" site:target.com
# Find exposed backup files
site:target.com filetype:bak OR filetype:old OR filetype:backup OR filetype:sql.gz
# Find error messages that leak information
site:target.com "error" "warning" "mysql" "syntax"
site:target.com "Fatal error" "on line"
site:target.com "ORA-" "error" # Oracle database errors
# Find password files
site:target.com filetype:txt "username" "password"
site:target.com filetype:log "password"
# Find exposed Git repositories
site:target.com inurl:".git"
site:target.com intitle:"index of" ".git"
# Find Swagger/API documentation
site:target.com inurl:swagger OR inurl:api-docs OR inurl:openapi
# Find exposed cloud storage
site:s3.amazonaws.com "target"
site:blob.core.windows.net "target"
site:storage.googleapis.com "target"💡 Pro Tip: Google dorking isn't just for web pages. Try searching for the target's name in Pastebin (site:pastebin.com "target.com"), Trello boards (site:trello.com "target"), and GitHub (site:github.com "target.com" password). People paste secrets everywhere.
The Google Hacking Database maintained by Offensive Security contains thousands of pre-built dorks organized by category. Before building your own, check if someone's already crafted the perfect query.
While Google indexes web pages, Shodan indexes everything connected to the internet -- servers, IoT devices (internet-connected gadgets like cameras and thermostats), industrial control systems, webcams, databases, and more. Shodan periodically crawls the IPv4 address space and stores banner information (the text a service sends when you first connect to it) for every open port it finds.
# Search by organization name
org:"Target Corporation"
# Search by hostname
hostname:target.com
# Search by IP range (CIDR notation)
net:203.0.113.0/24
# Search by port
port:3389 org:"Target Corporation" # RDP servers
port:27017 org:"Target Corporation" # MongoDB (often no auth!)
port:9200 org:"Target Corporation" # Elasticsearch
# Search by product/service
product:"Apache" org:"Target Corporation"
product:"nginx" hostname:target.com
# Search by operating system
os:"Windows Server 2012" org:"Target Corporation"
# Search by HTTP title
http.title:"Dashboard" org:"Target Corporation"
# Search by SSL certificate
ssl.cert.subject.cn:target.com
ssl:"target.com"
# Search for vulnerabilities
vuln:CVE-2021-44228 org:"Target Corporation" # Log4Shell!
# Search for default credentials / no auth
"authentication disabled" port:27017 # Open MongoDB
"220" "230 Login successful" port:21 # Anonymous FTP# Install Shodan CLI
pip install shodan
# Initialize with your API key
shodan init YOUR_API_KEY
# Search from command line
shodan search "hostname:target.com"
# Get host information
shodan host 203.0.113.50
# Count results without showing them
shodan count "org:\"Target Corporation\" port:22"
# Download results for offline analysis
shodan download results.json.gz "org:\"Target Corporation\""
shodan parse results.json.gz --fields ip_str,port,org
# Monitor for new exposure (Shodan Monitor — paid)
shodan alert create "Target Watch" 203.0.113.0/24
# Scan a specific IP (uses your scan credits)
shodan scan submit 203.0.113.50| Filter | Description |
|---|---|
hostname: | Filter by hostname |
org: | Filter by organization name |
net: | Filter by IP range (CIDR) |
port: | Filter by port number |
city: | Filter by city |
country: | Filter by country code (US, GB, DE...) |
os: | Filter by operating system |
product: | Filter by product name |
version: | Filter by version |
ssl.cert.subject.cn: | Filter by SSL certificate CN |
http.title: | Filter by HTML page title |
http.status: | Filter by HTTP status code |
vuln: | Filter by CVE identifier |
before: / after: | Results before/after date (DD/MM/YYYY) |
💡 Pro Tip: Combine Shodan with your subdomain enumeration. Once you find subdomains, resolve them to IPs, then look up each IP on Shodan. You'll often find additional ports and services that the organization forgot about -- development servers, staging environments, exposed databases.
DNS (Domain Name System) is the phone book of the internet -- it translates human-readable names like "google.com" into IP addresses. DNS records are packed with useful information: they reveal mail servers, subdomains, IP addresses, and sometimes internal network details.
# Query all record types (note: ANY is unreliable per RFC 8482 — many servers refuse or return minimal answers)
dig target.com ANY +noall +answer
# A records (IPv4 addresses)
dig target.com A +short
# AAAA records (IPv6 addresses)
dig target.com AAAA +short
# MX records (mail servers — reveals email infrastructure)
dig target.com MX +short
# NS records (nameservers — who controls their DNS?)
dig target.com NS +short
# TXT records (SPF, DKIM, DMARC — often leak internal info)
dig target.com TXT +short
# v=spf1 include:_spf.google.com include:mail.target.com ~all
# ↑ They use Google Workspace for email
# SOA record (authoritative info, admin email)
dig target.com SOA +short
# CNAME records (aliases — can reveal CDNs, cloud providers)
dig www.target.com CNAME +short
# PTR record (reverse DNS — IP to hostname)
dig -x 203.0.113.50 +short
# Trace the full DNS resolution path
dig target.com +traceA DNS zone transfer returns the entire DNS zone -- every record for the domain. This is a misconfiguration that shouldn't be possible from external sources, but it's surprisingly common.
# First, find the nameservers
dig target.com NS +short
# ns1.target.com
# ns2.target.com
# Attempt zone transfer against each nameserver
dig axfr target.com @ns1.target.com
dig axfr target.com @ns2.target.com
# If successful, you get EVERYTHING:
# target.com. IN A 203.0.113.50
# admin.target.com. IN A 203.0.113.51
# dev.target.com. IN A 203.0.113.52
# staging.target.com IN CNAME dev.target.com.
# mail.target.com. IN A 203.0.113.53
# vpn.target.com. IN A 203.0.113.54
# internal.target.com IN A 10.0.0.5 ← INTERNAL IP LEAKED!
# Using host command (simpler syntax)
host -t axfr target.com ns1.target.com💡 Pro Tip: Zone transfers are one of the first things to try in any CTF or pentest. It's a single command that can reveal the entire attack surface. In CTFs, they're often intentionally left enabled as a breadcrumb.
# dnsrecon — comprehensive DNS enumeration
dnsrecon -d target.com -t std # Standard enumeration
dnsrecon -d target.com -t axfr # Zone transfer
dnsrecon -d target.com -t brt # Brute force subdomains
dnsrecon -d target.com -t rvl -r 203.0.113.0/24 # Reverse lookup on range
# fierce — DNS reconnaissance and subdomain brute forcing
fierce --domain target.com
fierce --domain target.com --subdomains admin dev staging test
# amass — the most comprehensive DNS enumeration tool
# Passive mode (no direct contact with target)
amass enum -passive -d target.com -o amass-passive.txt
# Active mode (direct DNS queries)
amass enum -active -d target.com -o amass-active.txt
# Brute force mode
amass enum -brute -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
# Intel mode — discover associated domains
amass intel -org "Target Corporation"
amass intel -whois -d target.comSubdomains are where the interesting stuff hides. The main website might be hardened, but staging.target.com, dev.target.com, or old.target.com often have weaker security, default credentials, or exposed admin panels.
# subfinder — fast passive subdomain discovery
subfinder -d target.com -silent | tee subs.txt
subfinder -d target.com -all -silent # Use all sources (slower but thorough)
# assetfinder — find subdomains via various sources
assetfinder --subs-only target.com | tee subs.txt
# crt.sh — Certificate Transparency logs
# Via browser: https://crt.sh/?q=%25.target.com
# Via command line:
curl -s "https://crt.sh/?q=%25.target.com&output=json" | \
jq -r '.[].name_value' | sort -u | tee crt-subs.txt
# Combine multiple tools for maximum coverage
subfinder -d target.com -silent > all-subs.txt
assetfinder --subs-only target.com >> all-subs.txt
curl -s "https://crt.sh/?q=%25.target.com&output=json" | \
jq -r '.[].name_value' >> all-subs.txt
sort -u all-subs.txt -o all-subs.txt
wc -l all-subs.txt # See total unique subdomains# gobuster DNS mode
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
# puredns — fast, accurate DNS brute forcing with wildcard detection
puredns bruteforce /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt target.com \
--resolvers resolvers.txt
# Resolve discovered subdomains to find live ones
puredns resolve all-subs.txt --resolvers resolvers.txt -w resolved.txt
# Check which subdomains have live web servers
cat resolved.txt | httpx -silent -status-code -title -tech-detect | tee alive-web.txt
# Output:
# https://admin.target.com [200] [Admin Dashboard] [PHP,Apache]
# https://api.target.com [403] [Forbidden] [nginx]
# http://staging.target.com [200] [Staging - target.com] [Node.js,Express]
# http://jenkins.target.com [200] [Dashboard [Jenkins]] [Java,Jetty]
# ↑ Jenkins! Check for default creds or unauthenticated script console💡 Pro Tip: Always probe discovered subdomains withhttpx. It reveals the tech stack, HTTP status codes, and page titles -- giving you instant triage. A[Jenkins]or[Kibana]title is an instant investigation target.
site:target.comintitle:"index of" site:target.com finds open directory listings — web server pages that show the raw file/folder structure. These are goldmines: they often expose backup files, configuration files, credentials, and internal documents that were never intended to be public.dig axfr target.com @ns1.target.com. This is a misconfiguration that shouldn't be possible externally, but it's surprisingly common — especially in CTFs where it's often an intentional breadcrumb.WHOIS is a public database that shows who registered a domain and their contact info. While privacy protections are increasingly common (GDPR, privacy proxies), WHOIS still reveals valuable intelligence. ASN (Autonomous System Number) identifies an organization's network on the internet — finding a target's ASN reveals all the IP ranges they own.
# Domain WHOIS lookup
whois target.com
# Look for:
# - Registrant name, email, organization
# - Name servers (reveals DNS provider)
# - Creation/expiration dates
# - Registrar information
# IP WHOIS lookup
whois 203.0.113.50
# Reveals:
# - IP range owned by the organization
# - ASN (Autonomous System Number)
# - Network name
# - Abuse contact
# ASN lookup — find ALL IP ranges owned by the target
# Step 1: Find their ASN
whois -h whois.cymru.com " -v 203.0.113.50"
# AS | IP | BGP Prefix | CC | Registry | Allocated | AS Name
# 12345 | 203.0.113.50 | 203.0.113.0/24 | US | arin | 2015-01-01 | TARGET-CORP
# Step 2: Find all prefixes announced by that ASN
whois -h whois.radb.net "!gAS12345"
# 203.0.113.0/24
# 198.51.100.0/23
# 192.0.2.0/24
# ↑ Now you know ALL their IP ranges — scan them all!
# bgp.he.net — visual ASN explorer (web tool)
# https://bgp.he.net/AS12345
# Using amass for ASN intelligence
amass intel -asn 12345Email addresses are critical OSINT targets. They reveal naming conventions (firstname.lastname@), identify employees, and serve as usernames for credential-based attacks.
# theHarvester — the classic email/subdomain harvester
theHarvester -d target.com -b google,bing,linkedin,dnsdumpster
theHarvester -d target.com -b all # Use all sources
theHarvester -d target.com -b google -l 500 # Limit to 500 results
# Example output:
# [*] Emails found:
# [email protected]
# [email protected]
# [email protected]
# [email protected]
# [email protected]
#
# [*] Hosts found:
# www.target.com: 203.0.113.50
# mail.target.com: 203.0.113.51
# vpn.target.com: 203.0.113.52
# hunter.io — find emails associated with a domain
# Web: https://hunter.io/search/target.com
# API:
curl "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=YOUR_KEY"
# phonebook.cz — free email/subdomain search
# https://phonebook.cz/?query=target.com&type=email
# Verify if an email address exists (SMTP verification)
# Using smtp-user-enum
smtp-user-enum -M RCPT -U users.txt -D target.com -t mail.target.com
# Derive naming convention from found emails
# j.smith@ → first initial + last name
# john.doe@ → first name + dot + last name
# Then generate a full list from LinkedIn employees💡 Pro Tip: Once you identify the email naming convention, combine it with employee names from LinkedIn to build a targeted user list. That list feeds directly into password spraying attacks against OWA, VPN portals, and other login endpoints.
Username enumeration means discovering which usernames exist on a system or platform. People reuse usernames across platforms, so finding someone's username on one site often leads to their accounts on dozens of others.
# sherlock — find usernames across 400+ social networks
sherlock targetuser
sherlock targetuser --output results.txt
# Example output:
# [+] GitHub: https://github.com/targetuser
# [+] Twitter: https://twitter.com/targetuser
# [+] Reddit: https://reddit.com/user/targetuser
# [+] HackerOne: https://hackerone.com/targetuser
# [+] Instagram: https://instagram.com/targetuser
# [+] LinkedIn: https://linkedin.com/in/targetuser
# namechk / knowem — web-based alternatives
# https://namechk.com/
# https://knowem.com/
# whatsmyname — another username search tool
# https://whatsmyname.app/
# For CTFs — enumerate users from services
# WordPress user enumeration
curl -s "http://target.com/?author=1" -L | grep -oP 'author/\K[^/]+'
curl -s "http://target.com/wp-json/wp/v2/users" | jq '.[].slug'
# SSH user enumeration (OpenSSH < 7.7 — CVE-2018-15473)
python3 ssh_user_enum.py --host target.com --username adminDocuments (PDFs, Office files, images) contain metadata that leaks internal information -- author names, software versions, internal paths, GPS coordinates, and more.
# exiftool — the king of metadata extraction
exiftool document.pdf
# Output includes:
# Author: John Smith
# Creator: Microsoft Word 2019
# Producer: Microsoft PDF Driver
# Create Date: 2024:03:15 14:22:01
# ↑ Author name → potential username
# ↑ Software → reveals internal tooling
# Extract metadata from images (GPS coordinates!)
exiftool photo.jpg
# GPS Latitude: 37 deg 47' 29.10" N
# GPS Longitude: 122 deg 24' 11.90" W
# Camera Model: iPhone 14 Pro
# ↑ Exact location where the photo was taken!
# Bulk download documents from a target website
wget -r -l 1 -A pdf,doc,docx,xls,xlsx,ppt,pptx "https://target.com" -P downloads/
# Extract metadata from all downloaded files
exiftool -r downloads/ | grep -E "Author|Creator|Producer|Software|Company" | sort -u
# metagoofil — automated metadata extraction from search engines
metagoofil -d target.com -t pdf,doc,xls,ppt -l 100 -n 25 -o downloads/ -f results.html
# FOCA (Windows) — the most powerful metadata analysis tool
# Downloads documents, extracts metadata, maps out:
# - Usernames and email addresses
# - Software and OS versions
# - Printers and internal servers
# - Network paths and shares
# - GPS coordinates from images💡 Pro Tip: Download every PDF and Office document from the target's website. Run exiftool on all of them. You'll often find internal usernames (Author field), internal server paths (Creator field), and software versions that reveal the internal infrastructure. This is pure passive OSINT -- no interaction with the target.
The Wayback Machine (web.archive.org) stores historical snapshots of websites. Pages that have been taken down, changed, or "deleted" often still exist in the archive.
# Browse historical snapshots in your browser
# https://web.archive.org/web/*/target.com
# waybackurls — extract all archived URLs for a domain
echo target.com | waybackurls | tee wayback-urls.txt
# Filter for interesting file types
cat wayback-urls.txt | grep -E "\.(php|asp|aspx|jsp|json|xml|conf|bak|sql|env|log|txt)" | sort -u
# gau (Get All URLs) — combines Wayback, Common Crawl, and more
gau target.com | tee all-urls.txt
gau --subs target.com # Include subdomains
# Filter for potentially sensitive endpoints
cat all-urls.txt | grep -iE "(api|admin|login|upload|config|backup|debug|test|staging)"
# Look for JavaScript files (may contain API keys, endpoints)
cat all-urls.txt | grep "\.js$" | sort -u > js-files.txt
# Download an old version of a page
curl "https://web.archive.org/web/20200101/https://target.com/robots.txt"
# Old robots.txt might reveal paths they've since hiddenCertificate Transparency (CT) is a system where every SSL/TLS certificate (the digital certificates that enable HTTPS) issued is logged publicly. This is a goldmine for subdomain discovery -- every time an organization gets an SSL certificate, the domain names it covers are publicly recorded.
# crt.sh — search Certificate Transparency logs
# Browser: https://crt.sh/?q=%25.target.com
# The %25 is URL-encoded % — searches for *.target.com
# Command line with JSON output
curl -s "https://crt.sh/?q=%25.target.com&output=json" | \
jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u
# This reveals:
# target.com
# www.target.com
# mail.target.com
# admin.target.com
# staging.target.com
# api.target.com
# dev-portal.target.com ← Interesting!
# legacy-app.target.com ← Forgotten system!
# internal.target.com ← Should this be public?
# censys.io — another CT log search with more features
# https://search.censys.io/certificates?q=target.com
# Also reveals wildcard certificates:
# *.staging.target.com → There's a staging environment!
# *.internal.target.com → Internal subdomain namespace!💡 Pro Tip: CT logs are one of the most reliable subdomain sources because they're based on actual SSL certificates, not guessing. Organizations can't hide subdomains that have SSL certificates -- the issuance is permanently logged. Even certificates that have been revoked still appear in the logs.
GitHub is one of the most dangerous OSINT sources for organizations. Developers accidentally commit (save to version control) credentials, API keys, database connection strings, and internal documentation to public repositories -- and Git remembers everything, even after deletion.
# Search GitHub directly (github.com/search)
# Use these search queries:
"target.com" password # Passwords mentioning the domain
"target.com" api_key # API keys
"target.com" secret # Secrets
org:targetcorp password # Within the org's repos
org:targetcorp filename:.env # .env files (contain secrets!)
org:targetcorp filename:wp-config # WordPress configs (DB creds)
org:targetcorp filename:id_rsa # SSH private keys
org:targetcorp filename:credentials # Credential files
# Search for specific secret patterns
"AKIA" org:targetcorp # AWS Access Key IDs start with AKIA
"ghp_" org:targetcorp # GitHub Personal Access Tokens
"sk-" org:targetcorp # Stripe/OpenAI secret keys
"SG." org:targetcorp # SendGrid API keys
"xoxb-" org:targetcorp # Slack Bot tokens
# Search in commit history (things deleted but still in Git)
# This is why tools like truffleHog exist# truffleHog — scans Git repos for high-entropy strings and known patterns
trufflehog git https://github.com/targetcorp/webapp.git
trufflehog github --org targetcorp # Scan entire organization
# Example output:
# Found verified result 🐷🔑
# Detector Type: AWS
# Raw result: AKIAIOSFODNN7EXAMPLE
# File: deploy/config.yml
# Commit: abc123
# Email: [email protected]
# ↑ A verified AWS key! This is game over for their cloud.
# gitleaks — another great secret scanner
gitleaks detect --source /path/to/cloned/repo
gitleaks detect --source https://github.com/targetcorp/webapp.git
# git-secrets — AWS-focused secret prevention
git secrets --scan -r /path/to/repo
# gitrob — find sensitive files in GitHub repos (older tool)
gitrob -org targetcorp# Clone the repo and search through ALL history
git clone https://github.com/targetcorp/webapp.git
cd webapp
# Search all commits for sensitive strings
git log --all -p | grep -iE "(password|secret|api_key|token|credential)" | head -50
# Find deleted files that might contain secrets
git log --all --diff-filter=D --name-only | sort -u
# Show contents of a deleted file
git log --all --full-history -- "config/secrets.yml"
git show COMMIT_HASH:config/secrets.yml
# Search for specific file patterns across all branches
git log --all --name-only | grep -iE "\.(env|pem|key|sql|conf|bak)" | sort -u org:"Target Corporation"port:27017 org:"Target Corporation" finds all MongoDB servers associated with the target. Exposed MongoDB instances are a critical finding — they often contain production data with no authentication required.git log --all -p scan the entire commit history to find secrets that were "deleted." This is why credential rotation is essential after any accidental commit.Social media profiles leak more than people realize. Employees unknowingly reveal technology stacks, internal tools, office locations, and even credentials through their posts and profiles.
LinkedIn OSINT:
Twitter OSINT: Search site:twitter.com "target.com" and from:@targetcompany. Look for internal screenshots, error messages, and complaint tweets.
Instagram / Facebook: Office photos may show screens, whiteboards, badge designs. Geotagged posts reveal office locations.
LinkedIn Employee Enumeration workflow:
Tools: linkedin2username, Twint (Twitter scraping), Instaloader (Instagram), OSRFramework (multi-platform)
Maltego is a powerful OSINT tool that visually maps relationships between entities (people, domains, IPs, emails, social media accounts) as an interactive graph. It's the "connect the dots" tool for intelligence analysis.
Maltego workflow:
Common transforms:
Example investigation flow:
target.com ─┬─ DNS ──▶ subdomains ──▶ IP addresses ──▶ other domains on same IP
├─ WHOIS ──▶ registrant email ──▶ other domains by same registrant
├─ MX ──▶ email provider ──▶ phishing opportunities
└─ employees ──▶ social media ──▶ personal emails ──▶ password reuseMaltego Community Edition (free) includes DNS, WHOIS, social media, Shodan, and VirusTotal transforms.
💡 Pro Tip: Maltego excels at finding connections humans miss. A registrant email shared between a target domain and a personal blog. An IP that hosts both the corporate site and a forgotten dev environment. Two employees whose social media reveals they use the same weak password pattern. The visual graph makes these connections obvious.
Here's the complete OSINT methodology I use on every engagement. Follow this order for maximum coverage with minimum detection.
# 1. WHOIS and ASN mapping
whois target.com
amass intel -org "Target Corporation"
# → Know their IP ranges, DNS providers, registration info
# 2. Google dorking for exposed files
# site:target.com filetype:pdf OR filetype:doc OR filetype:xlsx
# site:target.com intitle:"index of"
# site:target.com inurl:admin
# → Find exposed documents, admin panels, directory listings
# 3. Job postings analysis
# Search Indeed, LinkedIn, Glassdoor for "target.com" jobs
# → Reveals tech stack, internal tools, team structure# 1. Passive subdomain enumeration
subfinder -d target.com -all -silent > subs.txt
assetfinder --subs-only target.com >> subs.txt
curl -s "https://crt.sh/?q=%25.target.com&output=json" | jq -r '.[].name_value' >> subs.txt
sort -u subs.txt -o subs.txt
# 2. DNS zone transfer attempt
dig target.com NS +short | while read ns; do dig axfr target.com @$ns; done
# 3. DNS record analysis
for sub in $(cat subs.txt); do
dig +short $sub A
done | sort -u > ips.txt
# 4. Probe for live web servers
cat subs.txt | httpx -silent -status-code -title -tech-detect > alive.txt# 1. Email harvesting
theHarvester -d target.com -b all
# 2. Metadata extraction from documents
wget -r -l 1 -A pdf,doc,docx,xls -np "https://target.com" -P docs/
exiftool -r docs/ | grep -E "Author|Creator|Company" | sort -u
# 3. GitHub secret scanning
trufflehog github --org targetcorp
# Search GitHub manually for "target.com" + sensitive terms
# 4. Breach database check (have credentials leaked?)
# Check haveibeenpwned.com for known breaches
# Check dehashed.com for leaked credentials (authorized use only)# 1. Shodan analysis
shodan search "org:\"Target Corporation\"" --fields ip_str,port,product,os
# 2. Wayback Machine URL mining
echo target.com | waybackurls | grep -iE "(api|admin|config|backup|\.env)" | sort -u
# 3. Technology fingerprinting
# Use Wappalyzer, WhatWeb, or httpx --tech-detect on alive hosts
# 4. Cloud asset discovery
# Check for S3 buckets: s3.amazonaws.com/target
# Check for Azure blobs: target.blob.core.windows.net
# Check for GCP storage: storage.googleapis.com/target❌ Mistake #1: Jumping straight to active scanning.
Passive OSINT can reveal credentials, admin panels, and internal documentation without touching the target. Exhaust passive sources first -- you might find your way in without ever sending a single packet.
❌ Mistake #2: Only using one subdomain tool.
No single tool finds everything. subfinder misses what amass finds, crt.sh reveals what neither discovers. Always combine at least 3 sources and deduplicate results.
❌ Mistake #3: Ignoring metadata in documents.
That PDF on the target's website was created by "jsmith" using "Microsoft Word 2019" on a machine named "CORP-PC-42". That's a username, software version, and internal naming convention -- all from a singleexiftoolcommand.
❌ Mistake #4: Not checking Git history.
Developers delete secrets and commit the removal. But Git remembers. The API key deleted in commit #500 is still in commit #499. Use truffleHog to scan the entire history, not just the current state.
❌ Mistake #5: Forgetting about historical data.
The Wayback Machine preserves pages the target deleted. Old robots.txt files reveal hidden paths. Expired SSL certificates in CT logs reveal decommissioned subdomains that might still resolve. The internet never forgets.
❌ Mistake #6: Not documenting findings.
OSINT generates massive amounts of data. Keep organized notes -- which subdomains you found, where, what's alive, what technology each runs. Use a structured approach or you'll drown in data.
❌ Mistake #7: Treating OSINT as a one-time activity.
New subdomains appear, new code gets pushed to GitHub, new employees join. Set up monitoring (Shodan alerts, GitHub notifications, subdomain monitoring) for ongoing intelligence during long engagements.
exiftool extracts document metadata including Author (potential username), Creator (software version), Company name, internal file paths, and even GPS coordinates from images. This is pure passive OSINT — download documents from the target's public website and analyze them without any direct interaction.