Week 3 — Information gathering (OSINT)
Learning objectives
- Distinguish passive from active reconnaissance: passive sends no packet to the target.
- Extract useful data from public sources: DNS, WHOIS, SSL certificates, search engines.
- Build a clean, versioned target profile, ready to feed the active phase.
Essential sources
| Source | What it gives | Tools |
|---|---|---|
| DNS | Subdomains, MX, TXT, SPF, DMARC | dig, dnsx, amass |
| WHOIS | Owner, dates, technical contacts | whois, RDAP |
| Certificate Transparency | Every certificate issued for a domain | crt.sh, censys |
| Search engines | Leaks, forgotten pages, exposed configs | Google Dorks, duckduckgo |
| Social networks | Org chart, technologies, internal discourse | LinkedIn, GitHub |
Essential recipes
# Subdomains via public certificates: fast, no packet to the target.
curl -s 'https://crt.sh/?q=%25.example.com&output=json' | jq -r '.[].name_value' | sort -u
# Key DNS records in a single call.
for t in A AAAA MX NS TXT CNAME; do dig +short example.com $t | sed "s/^/[$t] /"; done
# Google Dorks: the forgotten robots.txt, the directory index, the exposed .git.
site:example.com inurl:.git
site:example.com filetype:sql
site:example.com intitle:"index of"
Target profile — Template to fill in
# Target: example.com
## Domains and subdomains
- example.com (registrar: X, expires: YYYY-MM-DD)
- api.example.com — Cloudflare
- vpn.example.com — Fortinet ?
## Detected technologies
- Front: Next.js (hint: X-Powered-By header)
- CDN: Cloudflare
## Key people (public LinkedIn)
- CIO: ...
- Sysadmin: ...
## Public leaks
- HaveIBeenPwned: 12 @example.com accounts in the Collection#1 leak
## Grey areas
- Subdomain s3-backup.example.com — verify in week 4.
Classic trap
Many automated OSINT tools actually fire off active requests (port scans, HTTP probes). Read the documentation before running them: passive reconnaissance requires discipline, not just tools.