🔍OSINT

Open-Source Intelligence

Passive Reconnaissance

Types of Passive Recon:

Physical/Social

1. Location Information - Satellite Images, Drone Recon, Building Layout

2. Job Information - Employees (name, job title, phone number, manager), Pictures (Computer photos, badge photos, desk photos, etc.)

Web Host

1. Target Validation - WHOIS, nslookup, dnsrecon

2. Finding Subdomains - Google Fu, dig, Nmap, Sublist3r, crt.sh etc.

3. Fingerprinting - Nmap, Whatweb, Wappalyzer, Netcat

4. Data breaches - HaveIBeenPwned!, WeleakInfo, Breachparse, DeHashed etc.

Tools & Resources

• https://technisette.com/p/home

• https://osintframework.com

• https://github.com/Acceis/leakScraper

• https://github.com/sherlock-project/sherlock

• https://github.com/sundowndev/phoneinfoga

• https://github.com/twintproject/twint

• https://github.com/NextKool/Osintgram