osint

OSINT Reconnaissance

Passive intelligence gathering:

• Domain WHOIS and DNS records
• Subdomain enumeration
• IP geolocation and ASN lookup
• Certificate transparency
• Email format discovery
• GitHub/code leak search
• Social media reconnaissance

Required Context

1. Target: Domain, IP, organization, or individual
2. Scope: What to focus on (infra, emails, leaks)
3. Output: Format preference

Tools Used

whois, dig, subfinder, amass, shodan, geoiplookup, theHarvester, crt.sh

Example

/osint
Target: example.com
Focus: Infrastructure mapping, email format