<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: osint-recon
description: >-
  OSINT and reconnaissance — passive intelligence gathering, active subdomain
  enumeration, web content discovery, network scanning, username/people OSINT,
  cloud asset enumeration, and attack surface mapping. Use when asked about
  reconnaissance, OSINT, target enumeration, attack surface discovery,
  infrastructure mapping, subdomain discovery, Google dorking, GitHub intelligence,
  username enumeration, network scanning, or cloud recon.
domain: cybersecurity
subdomain: reconnaissance
tags:
  - osint
  - recon
  - enumeration
  - subdomain
  - scanning
  - dns
  - cloud-recon
  - username-enum
  - web-discovery
  - attack-surface
version: "1.1"
author: defconxt
license: AGPL-3.0
compatibility: >-
  subfinder, dnsx, httpx, feroxbuster, nmap, masscan, sherlock, maigret,
  ghunt, octosuite, bbot, cloud_enum, nuclei, SecLists wordlists.
metadata:
  mitre-attack:
    - "T1595"    # Active Scanning
    - "T1592"    # Gather Victim Host Information
    - "T1589"    # Gather Victim Identity Information
    - "T1590"    # Gather Victim Network Information
    - "T1591"    # Gather Victim Org Information
    - "T1593"    # Search Open Websites/Domains
    - "T1596"    # Search Open Technical Databases
    - "T1597"    # Search Closed Sources
    - "T1598"    # Phishing for Information
    - "T1018"    # Remote System Discovery
    - "T1046"    # Network Service Discovery
    - "T1087"    # Account Discovery
    - "T1526"    # Cloud Service Discovery
---

# OSINT and Reconnaissance

## When to Use

- Passive intelligence gathering (CT logs, WHOIS, Shodan, Google dorks, GitHub secrets)
- Active subdomain enumeration (subfinder → dnsx → httpx pipeline)
- Web content discovery and directory brute-forcing (feroxbuster, httpx)
- Network scanning and service fingerprinting (nmap, masscan)
- Username and people OSINT (sherlock, maigret, ghunt, octosuite)
- Cloud asset enumeration (AWS/Azure/GCP metadata, S3, cloud_enum)
- Attack surface mapping and structured recon workflows

## Prerequisites

- subfinder, dnsx, httpx, feroxbuster from ProjectDiscovery toolchain
- nmap 7.90+, masscan for network scanning
- sherlock, maigret for username enumeration
- ghunt (with Google auth), octosuite for platform-specific OSINT
- bbot for automated multi-source reconnaissance
- SecLists wordlists installed at `/usr/share/seclists/`
- API keys configured for Shodan, SecurityTrails, Censys, VirusTotal (optional but recommended)

## Quick Reference

| Task | Command |
|------|---------|
| Subfinder passive | `subfinder -d target.com -silent -all -o subs.txt` |
| DNS resolve + filter live | `subfinder -silent -d target.com \| dnsx -silent -a -resp` |
| HTTP probe pipeline | `cat subs.txt \| httpx -silent -sc -title -tech-detect -o live.txt` |
| Username enum | `sherlock username --csv --print-found` |
| Deep username | `maigret username --html -a` (all 3000+ sites) |
| Google intel | `ghunt email target@gmail.com --json out.json` |
| GitHub OSINT | `octosuite user targetname --repos --json` |
| BBOT full recon | `bbot -t target.com -p subdomain-enum -rf passive` |
| BBOT kitchen sink | `bbot -t target.com -p kitchen-sink --allow-deadly` |
| Nmap SYN+sV | `nmap -sS -sV -sC -O --top-ports 1000 -T4 -oA output target` |
| Nmap NSE vuln | `nmap --script=vuln -p 80,443,8080 target` |
| Feroxbuster | `feroxbuster -u http://target.com -w raft-large-files.txt -x php,html,js -r` |
| Zone transfer | `dnsx -d target.com -axfr -resp` |
| AWS enum | `enumerate-iam.py --access-key $KEY --secret-key $SECRET` |
| Certificate transparency | `curl -s "https://crt.sh/?q=%.target.com&output=json" \| jq '.[].name_value'` |

## Workflow

### 1. Passive Reconnaissance

Gather intelligence without touching the target. CT logs, WHOIS, Shodan, Google/GitHub
dorking, email harvesting, Wayback Machine, and breach data correlation.

→ **Full reference:** [references/passive-recon.md](references/passive-recon.md)

### 2. Active Subdomain Enumeration & Scanning

Subfinder → dnsx → httpx canonical pipeline. DNS brute-force, zone transfers,
BBOT automated enumeration. Nmap/masscan for port scanning and service fingerprinting.
Feroxbuster for web content discovery and directory brute-forcing.

→ **Full reference:** [references/active-scanning.md](references/active-scanning.md)

### 3. Cloud & Web Enumeration

AWS/Azure/GCP metadata services, IAM privilege escalation paths, S3 enumeration,
subdomain takeover via cloud CNAMEs. Username/people OSINT with sherlock, maigret,
ghunt, octosuite.

→ **Full reference:** [references/cloud-web-enum.md](references/cloud-web-enum.md)

### 4. Recon Chains

#### Passive-to-Active Pipeline
1. CT log enumeration → Shodan/Censys passive → merge all passive sources
2. DNS resolve and filter live: `dnsx -silent -a -resp`
3. HTTP probe: `httpx -sc -title -tech-detect`
4. Targeted active scanning: Nmap `-sV -sC` on confirmed in-scope IPs
5. Output: structured asset inventory with confidence tags

#### Full-Scope Recon (reconftw-style)
1. OSINT phase: WHOIS, Google dorks, GitHub secrets, email harvest
2. Subdomain enum: subfinder `-all` + BBOT + DNS brute-force
3. Zone transfer attempt: `dnsx -axfr`
4. DNS resolution + ASN mapping: `dnsx -recon -asn`
5. Web probing: httpx across all resolved subdomains
6. Port scanning: Nmap `--top-ports 200 -sV` against all live IPs
7. Web fuzzing: feroxbuster with raft-large wordlists
8. Cloud enumeration: cloud_enum for S3/GCS/Azure blob
9. Vulnerability scan: `nuclei -l live_web.txt -severity medium,high,critical`
10. Report: Attack Surface Assessment with prioritized findings

#### Username-to-Infrastructure Pivot
1. sherlock `--print-found` → map social network presence
2. maigret `--html` → linked accounts, biographical data
3. Email discovery via LinkedIn + Hunter.io patterns
4. GHunt email → Google account ID, linked services
5. octosuite user → repos, commit emails, org membership
6. Extract org emails from commits: `git log --format='%ae' | sort -u`
7. Infrastructure correlation: IPs from configs in GitHub → Shodan
8. Feed hostnames to subfinder/dnsx pipeline for full enumeration

### 5. Intelligence Products & OPSEC

**Recon output structure:**
- Target Summary: org, primary domain, ASN, IP ranges, tech stack
- Assets Identified: subdomains `[HIGH]`, IPs, open ports, web apps
- Attack Surface: external services, public S3, exposed admin panels, leaked creds
- Key Personnel: emails, usernames, LinkedIn profiles
- Technology Stack: web servers, frameworks, CDNs, cloud providers
- Intelligence Gaps: areas needing active verification

**Confidence annotations:** `[HIGH]` (DNS-confirmed/actively probed), `[MEDIUM]` (passive inference), `[LOW]` (single source, unverified).

**OPSEC for recon:**
- Use residential/datacenter proxies — avoid burning attacker-controlled IPs
- Rate-limit active tools: `--rate-limit` flags in subfinder/httpx/feroxbuster
- Tor for passive lookups only — exit nodes are blacklisted from many APIs
- Time-box active scanning outside business hours unless testing detection
- Avoid scanning CDN-fronted targets with automated tools — WAFs trigger bans

**BBOT scan profiles:**
```bash
bbot -t target.com -p subdomain-enum          # subdomain enumeration
bbot -t target.com -p web-basic               # quick web scan
bbot -t target.com -p web-thorough            # aggressive web scan
bbot -t target.com -p email-enum subdomain-enum spider  # combined
bbot -t target.com -p cloud-enum              # cloud storage enumeration
```

## Verification

- [ ] Passive recon produces deduplicated subdomain list with source attribution
- [ ] DNS resolution filters dead hosts; only live targets enter active phase
- [ ] HTTP probe output includes status codes, titles, tech stack per host
- [ ] Port scan results mapped to services with version strings
- [ ] All findings tagged with confidence level (`[HIGH]`/`[MEDIUM]`/`[LOW]`)
- [ ] OPSEC controls applied: rate limiting, proxy usage, scan timing documented
- [ ] Final report follows structured output format with prioritized findings

---
v1.1 | Validated: 2026-03-13
