> For the complete documentation index, see [llms.txt](https://hackzzz.gitbook.io/welcome/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackzzz.gitbook.io/welcome/everything-about-and-notes/osint.md).

# OSINT

## Passive Reconnaissance

Types of **Passive Recon**:

### Physical/Social

1. Location Information - **Satellite Images, Drone Recon, Building Layout**
2. Job Information - **Employees** (name, job title, phone number, manager), **Pictures** (Computer photos, badge photos, desk photos, etc.)

### Web Host

1. Target Validation - **WHOIS, nslookup, dnsrecon**
2. Finding Subdomains - **Google Fu, dig, Nmap, Sublist3r, crt.sh etc.**
3. Fingerprinting - **Nmap, Whatweb, Wappalyzer, Netcat**
4. Data breaches - **HaveIBeenPwned!, WeleakInfo, Breachparse, DeHashed etc.**

## Tools & Resources

* [ ] <https://technisette.com/p/home>
* [ ] <https://osintframework.com>
* [ ] <https://github.com/Acceis/leakScraper>
* [ ] <https://github.com/sherlock-project/sherlock>
* [ ] <https://github.com/sundowndev/phoneinfoga>
* [ ] <https://github.com/twintproject/twint>
* [ ] <https://github.com/NextKool/Osintgram>