Unit 3 – OSINT & Reconnaissance
Study Notes (Pages 1–27)
1. Open-Source Intelligence (OSINT)
OSINT is the practice of gathering information from public or open sources. It is used by security
professionals, national agencies, and cybercriminals alike. Defenders use OSINT to find what attackers could
discover about their organization.
Key points:
• Scans public networks, social media, and the deep web (not crawled by search engines but still
accessible).
• OSINT tools can be open-source or proprietary — the tool itself doesn't need to be open-source to work
with open-source content.
2. Reconnaissance
Reconnaissance is the information-gathering phase before an attack. It is divided into passive and active
types.
2.1 Passive Reconnaissance
The attacker does not touch the target system. All information comes from publicly available sources. The
target does not know it is being observed. This is essentially the same as OSINT.
Passive Recon Examples:
• ICANN WHOIS lookup
• DNS record checks
• Searching leaked credentials
• Google Dorking
• LinkedIn employee enumeration
• Checking GitHub repositories
3. ICANN WHOIS Lookup
WHOIS is a free tool that reveals who is behind any internet domain. When a registrant registers a domain, they
must provide contact information to the registrar. WHOIS queries return this data — though many registrants
use privacy protection, which replaces their details with the registrar's information.
Information WHOIS can reveal:
• Registrant name and organization
• Creation, update, and expiry dates
• Registrar name and WHOIS server
• Name servers
• Domain status codes
Challenge: Privacy features (e.g., Squarespace Domains) can redact most fields, showing only the registrar's info.
4. DNS Record Checks & DNS Attacks
DNS translates domain names to IP addresses. Checking DNS records is a passive recon technique.
DNS Attack Types:
• Rogue DNS Server: Attacker compromises a DNS server and changes records to redirect traffic to
malicious sites.
• Man-in-the-Middle (MITM): Attacker intercepts communication between user and DNS server, returning
malicious IP addresses.
Useful DNS Commands:
sudo apt install dnsutils
whois [Link] # Domain/IP registration info
host [Link] # Resolves IP, mail servers
5. Leaked Credentials
Leaked credentials are exposed usernames, passwords, session cookies, or API secrets. They can lead to
identity theft, financial fraud, and data breaches. Password reuse greatly amplifies the risk — one compromised
account can cascade to others.
5.1 How Credentials Are Leaked
• Direct Attacks: Brute force (rapid username/password combinations) or credential stuffing (reusing
previously breached credentials on other platforms).
• Criminal Marketplaces (Dark Web): Stolen credentials are sold in 'packages' including email, bank, and
admin logins. Lowers the barrier to entry for cybercriminals.
• Combolists: Massive compilations (millions/billions of entries) from various data breaches, circulated on
the dark web and used for automated credential stuffing.
5.2 Defenses Against Leaked Credentials
• Implement password blacklisting (block commonly leaked passwords).
• Monitor dark web and hacker forums for your organization's credentials.
• Enable conditional access policies (unusual location, device trust).
• Deploy credential stuffing prevention tools to detect automated login attempts.
• Implement Just-In-Time (JIT) access — credentials are only active for a limited time.
6. CrossLinked – LinkedIn Enumeration Tool
CrossLinked is a free, open-source tool on GitHub that enumerates employee names from a target
organization using search engine scraping (not LinkedIn's API). Results are accurate and require no external
API keys.
Installation:
sudo apt update && sudo apt install python3 python3-pip git -y
git clone [Link]
cd CrossLinked
pip3 install -r [Link]
Common Usage:
python3 [Link] -f [Link]
python3 [Link] -f [Link] -l 20 # limit 20 results
python3 [Link] -f [Link] -o [Link]
python3 [Link] amazon -f '{first}.{last}@[Link]'
python3 [Link] company_name -f email_format
7. Google Dorking (Google Hacking)
Google Dorking uses advanced search operators to uncover sensitive files, login pages, databases, and
hidden information that is publicly accessible but not intended to be easily found. It relies on Google's
indexing/caching system.
Operator Description Example
allintext All keywords present in page text allintext:"keyword"
intext Keywords in page text (one or all) intext:"keyword"
inurl Keyword appears in the URL inurl:"admin"
intitle Keyword appears in page title intitle:"login"
site Search within a specific site site:[Link]
filetype Search for a specific file type filetype:"pdf"
link Pages linking to a URL link:"keyword"
related Pages similar to a specified URL related:[Link]
cache Google's cached version of a page cache:[Link]
Example: site:[Link] "Shrirang"
8. Gitem – GitHub Reconnaissance Tool
Gitem is a Python-based, open-source CLI tool that searches public GitHub repositories for sensitive
information such as private keys and credentials. It iterates over all public organization/member repos and
matches filenames against patterns for files that typically contain sensitive data.
Installation & Usage:
git clone [Link]
cd gitem
sudo pip3 install -r [Link]
sudo python3 [Link] install
gitem -h
gitem organization google
9. Netcraft – Website & DNS Reconnaissance
Netcraft is a passive reconnaissance tool that identifies the systems and services a website runs on. It can
identify malicious websites, fraudulent domains, social media profiles, and emails. It handles a large portion of
worldwide phishing incident resolution.
What Netcraft can reveal for a domain:
• Site title, site rank, first-seen date, primary language
• Hosting company and netblock owner
• Nameserver and domain registrar
• All subdomains (e.g., *.[Link] → auth, shop, ir, profile, sso ...)
• Operating system of servers
Fraudulent sites often:
• Use recently registered domains
• Mimic legitimate brand names (typosquatting)
• Use low-cost or compromised hosting
How to use: Visit [Link] → Resources → Research Tools → enter domain.
Domain Registrar Examples: GoDaddy, Google Domains (now Squarespace), BigRock
10. theHarvester – OSINT Aggregation Tool
theHarvester is an open-source OSINT tool used during the reconnaissance phase to collect email addresses,
subdomains, hosts, employee names, open ports, and banners from public sources like search engines,
PGP key servers, and the SHODAN database.
Primary capabilities:
• Email Address Enumeration — discovers emails via search engines and social media.
• Subdomain Discovery — maps the full attack surface.
• Employee Name Gathering — collects names/titles from LinkedIn and similar sites.
• Host & IP Discovery — reveals network infrastructure.
• Virtual Host Enumeration — finds multiple sites on the same IP.
• OSINT Aggregation — queries multiple sources simultaneously.
Installation & Usage:
# Kali Linux — already installed, just run:
theharvester
# Other Linux:
sudo apt-get install theharvester
# Or clone from GitHub:
git clone [Link]
cd theHarvester && sudo python ./[Link]
# Example: search [Link] via Bing, max 200 results
theharvester -d [Link] -l 200 -b bing
Output includes: Emails found, hosts found (subdomain:IP mappings), IPs.
End of Notes — Pages 1 to 27 | Unit 3: OSINT & Passive Reconnaissance