OSINT for Kali – Chapter 1: The Treasure

Hunt Begins
Imagine your company’s website and email are like a hidden treasure island. OSINT (Open
Source Intelligence) is like your map, telescope, and spy gadgets to see what’s on the island
without actually stepping foot on it. Kali Linux is your treasure hunter’s toolkit, full of gadgets
like Maltego and TheHarvester to help you explore.

Step 1: Using TheHarvester to Find Information

TheHarvester is like a metal detector for the internet. It digs around publicly available places to
find emails, subdomains, and other info related to your target (in this case, your own company).
Open your terminal in Kali and type:
theharvester -d [Link] -b google

Let’s break this down line by line:

1. theharvester → This is like saying, “Hey, metal detector, start working.”

2. -d [Link] → This tells it which island to search. Replace

[Link] with your website.

3. -b google → This tells it which source to scan. Google is like a public library that
stores info about websites.
When you run it, TheHarvester will output:
• Emails it finds
• Subdomains (like secret entrances to your island)
• Hosts and sometimes even IPs

Step 2: Using Maltego

Maltego is like a giant detective board with strings connecting people, emails, domains, and social
media profiles. It visualizes everything so you can see patterns and connections.
1. Open Maltego in Kali (Applications → Information Gathering →
Maltego)

2. Create a new graph

3. Drag the Domain entity onto the board
4. Enter your website ([Link])
5. Run a transform like “To Email Addresses”
Now you’ll see all the emails connected to your domain in a spider-web style map.
Homework for Chapter 1 (Optional Fun)
1. Run TheHarvester on your domain and save the output.
2. Try adding other sources like bing or linkedin in TheHarvester:
theharvester -d [Link] -b bing

Notice how the results are different depending on which source you use.

✅ Chapter 1 Summary:
• OSINT is a treasure hunt
• TheHarvester = metal detector
• Maltego = detective’s spider-web board
• You can find emails, subdomains, and hosts publicly available

OSINT for Kali – Chapter 2: Spy Drones and

Binoculars
Step 1: Using Sublist3r for Fast Subdomain Hunting
Sublist3r is like a drone flying over your treasure island, spotting all secret entrances
(subdomains) quickly.
In Kali, type:
sublist3r -d [Link] -o [Link]

Breaking it down line by line:

1. sublist3r → This is calling the drone.

2. -d [Link] → Tells the drone which island to fly over. Replace

[Link] with your domain.

3. -o [Link] → The drone takes photos and notes, saving them in a file called
[Link].

When it finishes, open [Link] with:

cat [Link]

You’ll see a list of all the entrances (subdomains) your company has online, like
[Link] or [Link].

Step 2: Using Amass for Deeper Recon

Amass is like a super-sophisticated satellite that can see hidden stuff even TheHarvester or
Sublist3r can’t.
Try this:
amass enum -d [Link] -o amass_results.txt

Explanation:
1. amass enum → “Hey satellite, start scanning for structures.”

2. -d [Link] → Target your domain.

3. -o amass_results.txt → Save all the findings to a file.

Pro tip: Amass can also find subdomains that aren’t public yet, using DNS records and other
sources.

Step 3: Quick Scan with Shodan (Optional Extra Gadget)

Shodan is like a spy drone that not only sees the island but checks which doors are unlocked—
it finds servers, webcams, and devices connected to your domain.
In Kali, after installing shodan CLI:
shodan search [Link]

Breaking it down:
1. shodan search → Ask Shodan to scan the internet database.

2. [Link] → Look for servers related to your domain.

It might show things like web servers, open ports, or services running. Think of it as peeking under
the hood of your island’s machinery.

Chapter 2 Summary
• Sublist3r = Quick drone over your island (fast subdomains)
• Amass = Satellite for hidden entrances (deep scan)
• Shodan = Peek inside doors and see what’s running
These tools combined give you a 360° map of your digital island.

OSINT for Kali – Chapter 3: Digital Detective

Work
Step 1: Digging for Emails with TheHarvester
We already touched on TheHarvester in Chapter 1. Now, let’s go deeper.
theharvester -d [Link] -b linkedin -l 500

Line-by-line explanation:
 1. theharvester → Start the treasure hunt.

2. -d [Link] → Target your company island.

3. -b linkedin → Search specifically on LinkedIn, a social network for professionals.

4. -l 500 → Limit the number of results to 500 (like setting how deep your spy telescope
looks).
This can give you emails, names, and even titles of people connected to your company.

Step 2: Social Media Recon with SpiderFoot (Optional but Powerful)

SpiderFoot is like a super-intelligent assistant who checks every corner of the internet for your
target.
1. Open SpiderFoot in Kali:
spiderfoot

2. Go to your browser and open [Link]

3. Start a new scan by typing your domain or a person’s name

4. Watch it map emails, social media accounts, IPs, domains, and even leaked data
Think of it as a digital fingerprint scanner—it shows trails left by people and domains online.

Step 3: Searching People with Pipl and Email Permutator

Sometimes you know the email or name but want to see all accounts connected to it.
Email Permutator (Python-based or online tool) generates possible email patterns:
• john@[Link]
• [Link]@[Link]
• doe.j@[Link]
Then you can check which ones exist using TheHarvester or [Link].

Step 4: Quick Google Dorking

Google Dorking is like asking Google to show secret maps. Example:
site:[Link] "email"

• site:[Link] → Look only inside your domain

• "email" → Find pages with the word “email”

You can use this to find contact pages, PDF files, or old documents with email addresses.
Chapter 3 Summary
• TheHarvester + LinkedIn = Find professional emails
• SpiderFoot = All-in-one digital detective
• Email Permutator = Guess email addresses smartly
• Google Dorking = Peek inside public files
With Chapter 3, you now can map people and emails connected to your company, like leaving no
stone unturned on the island.

OSINT for Kali – Chapter 4: Exploring the

Island’s Structures
Step 1: Find Your IP Address
Before scanning, you need the coordinates of your island. Find your website’s IP:
nslookup [Link]

Line-by-line:
1. nslookup → “Hey internet map, give me the GPS coordinates of this website.”

2. [Link] → The target island

The output shows the IP address of your server, like [Link]. This is the first clue for
advanced recon.

Step 2: Scan Open Ports with Nmap

Nmap is like a robot that taps on all doors and windows to see which are open.
nmap -sV -Pn [Link]

Breaking it down:
1. nmap → Launch the robot.

2. -sV → Ask the robot to peek inside each door to see which service is running (like HTTP,
SSH, FTP).
3. -Pn → Skip the “ping check,” assuming the island is alive.

4. [Link] → The coordinates of the island (your server IP).

Output example:
PORT STATE SERVICE VERSION

22/tcp open ssh OpenSSH 8.2

80/tcp open http Apache 2.4.41

443/tcp open https Apache 2.4.41

Each open port is a door into your server. Knowing them helps you understand what’s accessible
publicly.

Step 3: Check for Vulnerabilities (Optional, Ethical)

Nmap scripts can scan for weak spots:
nmap --script vuln [Link]

• --script vuln → The robot checks for known vulnerabilities on the doors it found.

• Output shows possible weak points, like outdated software that needs patching.
⚠️Only do this on your own systems. Scanning others without permission is illegal.

Step 4: Visualize Your Digital Island (Optional)

Combine Maltego with Nmap results:
• Import IP and subdomain info into Maltego
• See a visual map of servers, services, and subdomains
It’s like turning your treasure map into a 3D model of your island.

Chapter 4 Summary
• nslookup = GPS coordinates of your island (IP address)

• nmap = Tap all doors/windows (ports)

• --script vuln = Look for weak points ethically

• Maltego = Connect the dots for a visual map

OSINT for Kali – Chapter 5: Advanced

Automation & Reporting
Step 1: Automate Subdomain Enumeration
Instead of running Sublist3r or Amass manually every time, you can write a script to do it
automatically.
Create a file called subdomain_scan.sh:
#!/bin/bash

# OSINT automated subdomain scan

TARGET="[Link]"
echo "[*] Starting Sublist3r scan for $TARGET"

sublist3r -d $TARGET -o sublist3r_results.txt

echo "[*] Starting Amass scan for $TARGET"

amass enum -d $TARGET -o amass_results.txt

echo "[*] Merge results"

cat sublist3r_results.txt amass_results.txt | sort -u > all_subdomains.txt

echo "[*] Scan complete. Results saved in all_subdomains.txt"

Line-by-line explanation:
1. #!/bin/bash → Tells Kali this is a Bash script.

2. TARGET="[Link]" → Sets the island to explore.

3. sublist3r ... → Run the Sublist3r drone.

4. amass ... → Run the satellite scan.

5. cat ... | sort -u → Merge the lists and remove duplicates.

6. echo ... → Print messages like a status update.

Run it with:
chmod +x subdomain_scan.sh

./subdomain_scan.sh

Now, your drone and satellite work automatically, saving time and effort.

Step 2: Automate Port Scanning

Similarly, automate Nmap scans:
#!/bin/bash

# OSINT automated port scan

IP="[Link]"

echo "[*] Starting Nmap scan on $IP"

nmap -sV -Pn $IP -oN nmap_results.txt

echo "[*] Vulnerability check"

nmap --script vuln $IP -oN vuln_results.txt

echo "[*] Scans complete. Results saved in nmap_results.txt and
vuln_results.txt"

• -oN → Save Nmap output in a nice readable text file.

• Now you can run scans on multiple IPs by looping over a list in the script.

Step 3: Build a Simple Report

After automation, you want a clean report. Example:
#!/bin/bash

echo "OSINT Report for [Link]" > osint_report.txt

echo "==============================" >> osint_report.txt

echo "" >> osint_report.txt

echo "[*] Subdomains" >> osint_report.txt

cat all_subdomains.txt >> osint_report.txt

echo "" >> osint_report.txt

echo "[*] Nmap Results" >> osint_report.txt

cat nmap_results.txt >> osint_report.txt

echo "" >> osint_report.txt

echo "[*] Vulnerabilities" >> osint_report.txt

cat vuln_results.txt >> osint_report.txt

echo "Report complete!"

This collects everything in one place so you don’t have to scroll through multiple files.

Step 4: Bonus Tools for Automation

• Recon-ng → Like Maltego but scriptable and automated.
• SpiderFoot CLI → Run full scans automatically without a GUI.
• Python scripts → Combine TheHarvester, Nmap, and Shodan results into one mega-
report.

Chapter 5 Summary
• Automate subdomain & port scans using Bash scripts
• Merge results and remove duplicates
• Create a readable, shareable report
• Use advanced tools like Recon-ng or SpiderFoot CLI for full automation
By the end of Chapter 5, you are essentially a master treasure hunter, with smart tools doing the
heavy lifting and organized maps of everything you find.
OSINT for Kali – Chapter 6: Advanced Recon
& Stealth
Step 1: Metadata Analysis (Finding Hidden Clues)
Files often contain hidden information called metadata. Think of it as secret notes attached to
your treasure map.
Example: PDFs, images, or Word docs can contain:
• Author names
• Creation dates
• Software used
• GPS coordinates
In Kali, you can use exiftool to check files:
exiftool company_brochure.pdf

Line-by-line:
1. exiftool → Magical magnifying glass for file metadata

2. company_brochure.pdf → Target file

Output might reveal hidden authors, usernames, or even paths that were stored in the document.

Step 2: OSINT on Social Media & People

Advanced tools like SpiderFoot or Social-Searcher can dig deeper:
• SpiderFoot CLI can be scripted for all social media handles:
sfcli -s [Link] -o spiderfoot_results.json

• sfcli → SpiderFoot command line

• -s → Scan target domain

• -o → Save results to JSON for further processing

Deep tip: Look at patterns, connections, and digital footprints—not just emails. These can
reveal:
• Linked accounts
• Leaked credentials
• Connections between employees
Step 3: OSINT on the Dark Web (Ethical Monitoring)
The dark web is like hidden caves around your island. You can monitor it for:
• Leaked data
• Exposed credentials
• Discussions mentioning your company
Tools:
• Ahmia → Tor search engine
• OnionScan → Scans .onion sites for exposure
• DarkSearch → Dark web search API
Example with OnionScan:
onionscan scan --target [Link]

• onionscan scan → Start the cave exploration

• --target → Specify the dark web address

⚠️Always monitor your own data or with explicit permission. Scanning unknown dark web sites
can be illegal.

Step 4: Automation & Integration for Mastery

Combine all your OSINT tools into a workflow:
1. Run Sublist3r + Amass → save subdomains
2. Run Nmap on all IPs → save open ports
3. Run TheHarvester + SpiderFoot → gather emails & social media
4. Run exiftool → check files for hidden metadata
5. Combine all results into a central JSON or report
This can be automated using Python:
import subprocess

targets = ["[Link]", "[Link]"]

for t in targets:

[Link](f"amass enum -d {t} -o {t}_amass.txt", shell=True)

[Link](f"nmap -sV -Pn {t} -oN {t}_nmap.txt", shell=True)

• [Link] → Python tells Kali to run commands automatically

• Loop through targets → Scan all islands without manual work

Step 5: Stealth & Ethics
Advanced OSINT mastery isn’t just about finding everything, it’s about staying invisible and
legal:
• Avoid aggressive scanning on third-party domains
• Stick to publicly available data
• Monitor your own company for leaks without hacking
• Use proxies or VPNs if needed to protect your identity when scraping large datasets
Think of it as being a ninja treasure hunter, leaving no footprints behind.

Chapter 6 Summary
• Metadata analysis reveals hidden info in files
• Social media OSINT uncovers digital footprints
• Dark web monitoring finds potential leaks
• Automation with Python combines all your tools
• Stealth & ethics keep you safe and legal

OSINT for Kali – Chapter 7: The Ultimate

Workflow
Step 1: Define Your Targets
Create a simple text file with all targets (domains, subdomains, IPs):
nano [Link]

Add:
[Link]

[Link]

[Link]

This acts like your mission list. Every tool will loop over these targets.

Step 2: Master Script for Automation

Create osint_master.sh:
#!/bin/bash

# OSINT Master Toolkit

TARGETS=$(cat [Link])

mkdir -p results

for TARGET in $TARGETS

do

echo "[*] Scanning $TARGET"

# Subdomains

sublist3r -d $TARGET -o results/${TARGET}_sublist3r.txt

amass enum -d $TARGET -o results/${TARGET}_amass.txt

cat results/${TARGET}_sublist3r.txt results/${TARGET}_amass.txt | sort -u >

results/${TARGET}_all_subdomains.txt

# Nmap scan

for IP in $(dig +short $TARGET)

do

nmap -sV -Pn $IP -oN results/${TARGET}_${IP}_nmap.txt

nmap --script vuln $IP -oN results/${TARGET}_${IP}_vuln.txt

done

# TheHarvester

theharvester -d $TARGET -b google -l 500 -f results/${TARGET}_harvester.html

# Metadata (example file)

if [ -f "${TARGET}_brochure.pdf" ]; then

exiftool ${TARGET}_brochure.pdf > results/${TARGET}_metadata.txt

fi

echo "[*] $TARGET scan complete"

done

echo "[*] All scans complete! Check the 'results' folder."

Line-by-line explanation:
1. TARGETS=$(cat [Link]) → Reads all your targets.

2. mkdir -p results → Creates a folder to keep all findings organized.

 3. for TARGET in $TARGETS → Loops over each target automatically.

4. Sublist3r + Amass → Finds all subdomains.

5. Nmap scans → Finds open ports and vulnerabilities for each IP.
6. TheHarvester → Collects emails, domains, and data.
7. Exiftool → Checks metadata if the file exists.
8. Results are saved neatly in the results folder for each target.
Run it with:
chmod +x osint_master.sh

./osint_master.sh

Step 3: Generate a Centralized Report

You can combine all findings into a single report:
#!/bin/bash

echo "OSINT Master Report" > master_report.txt

echo "===================" >> master_report.txt

for f in results/*_all_subdomains.txt; do

echo "[*] Subdomains for $(basename $f)" >> master_report.txt

cat $f >> master_report.txt

echo "" >> master_report.txt

done

for f in results/*_nmap.txt; do

echo "[*] Nmap results for $(basename $f)" >> master_report.txt

cat $f >> master_report.txt

echo "" >> master_report.txt

done

echo "[*] Master report ready as master_report.txt"

• Everything is in one file, ready to review or share.

• Keeps your workflow clean and professional.

Step 4: Optional Enhancements

• SpiderFoot CLI → Add deep OSINT scanning for emails, social media, and leaks.
• Python Integration → Parse JSON results from SpiderFoot, Shodan, or other tools.
 • Email Alerts → Trigger scripts to notify if new subdomains or leaks are found.
• Visualization → Import results into Maltego or Gephi for network maps.

Chapter 7 Summary
• Create a targets list for full automation
• Combine subdomain enumeration, port scanning, email harvesting, and metadata
analysis in one script
• Generate centralized reports
• Optionally integrate SpiderFoot, Shodan, and visualization tools
• Your workflow now runs like a full OSINT command center, ready to monitor your
company automatically

OSINT for Kali – Chapter 8: Defending Your

Company
Step 1: Monitor Your Public Subdomains
Your subdomains are like outposts around your island. Attackers often target forgotten or old
subdomains.
• Use Amass or Sublist3r regularly to check all subdomains:
amass enum -d [Link] -o amass_current.txt

• Compare with your previous scan to find new, unexpected subdomains.

diff previous_scan.txt amass_current.txt

• Any new subdomain is a potential weak point.

Defense Tip: Shut down unused domains or secure them with proper SSL and firewalls.

Step 2: Monitor Open Ports and Services

Open ports are like doors to your island buildings. Use Nmap regularly:
nmap -sV -Pn [Link] -oN nmap_current.txt

• Compare with previous scans:

diff nmap_previous.txt nmap_current.txt

• Unexpected open ports = possible vulnerabilities.

• Make sure all services are up-to-date and patched.
Step 3: Email Security and Leak Monitoring
Use TheHarvester, [Link], or SpiderFoot to monitor leaked emails:
theharvester -d [Link] -b google -l 500

• If new emails appear publicly, make sure:

• They are protected with strong passwords
• Not linked to critical accounts
• Employees are aware of phishing risks
Optional: Set up alerts with HaveIBeenPwned API to notify if company emails appear in leaks.

Step 4: Metadata & Document Safety

PDFs, Word docs, and images can leak internal info.
exiftool internal_doc.pdf

• Check author, software, GPS coordinates, or hidden comments.

• Remove metadata before public release:
exiftool -all= internal_doc.pdf

• Always sanitize documents shared outside your company.

Step 5: Dark Web Monitoring

Use SpiderFoot or OnionScan to monitor mentions of your company on the dark web:
sfcli -s [Link] -o spiderfoot_darkweb.json

• Check for:
• Leaked credentials
• Discussions of vulnerabilities
• Counterfeit or scam sites
• Early detection = stop problems before they escalate.

Step 6: Centralized Defense Dashboard

Combine all scans into one defense dashboard:
• Subdomains → List & status
• Open ports → List & versions
• Emails → Known & leaks
• Metadata → Files shared publicly
• Dark web mentions → Alerts
Optional: Use Maltego or a custom Python script to generate a visual security map of your
digital assets.

Chapter 8 Summary
• Regularly scan for subdomains, open ports, and vulnerabilities
• Monitor company emails for leaks
• Check document metadata before public release
• Keep an eye on dark web mentions
• Centralize results in a visual dashboard for quick action
With Chapter 8, you’re not just an OSINT explorer—you’re now a digital guardian, proactively
protecting your company from leaks, phishing, and attacks.