skills.rest
Yenn503
Yenn503COMMUNITY
Explore all skills by this author →
WebsiteGitHub

conducting-external-reconnaissance-with-osint

Maps an organization's external attack surface using passive OSINT sources and reconnaissance tools.

1|1|Updated Apr 3, 2026
Search Tags:#penetration testing#reconnaissance#subdomain enumeration#attack surface#footprinting#osint#shodan
One-click install
npx skills add https://github.com/Yenn503/Net-Runners --skill conducting-external-reconnaissance-with-osint-yenn503
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-external-reconnaissance-with-osint
Source: https://github.com/Yenn503/Net-Runners/tree/main/.netrunner/skills/recon/conducting-external-reconnaissance-with-osint
Command: npx skills add https://github.com/Yenn503/Net-Runners --skill conducting-external-reconnaissance-with-osint-yenn503

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security testers need a structured, repeatable method to gather intelligence about a target organization from public sources before active testing begins, without touching target systems or leaving traces in target logs. ## Core Features & Use Cases - Domain and DNS Enumeration: Discovers subdomains and DNS records using Amass, subfinder, and certificate transparency logs like crt.sh. - Infrastructure and Leak Discovery: Identifies exposed services via Shodan and Censys, finds leaked credentials in breach databases and public code repositories, and detects open cloud storage buckets. - Personnel and Technology Profiling: Harvests employee emails with theHarvester, builds org charts from LinkedIn, and fingerprints technology stacks with whatweb and sslyze. - Use Case: Before a red team engagement against a SaaS company, run this workflow to enumerate 147 subdomains, find an unauthenticated Elasticsearch instance via Shodan, and discover exposed AWS keys in a former developer's GitHub repository, then compile everything into a reconnaissance report. ## Quick Start Conduct a passive OSINT reconnaissance of the authorized target domain example.com and produce an external attack surface report.

Frequently Asked Questions about conducting-external-reconnaissance-with-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains for a target domain?▼

Subdomain enumeration combines multiple passive tools for full coverage: run amass enum -passive, subfinder -all, and query crt.sh certificate transparency logs. Merge, deduplicate, and resolve all results to IP addresses mapped to ASN and hosting providers.

What tools are used for OSINT reconnaissance in penetration testing?▼

Core tools include Amass and subfinder for subdomain discovery, theHarvester for email harvesting, Shodan and Censys for internet-facing service discovery, and SpiderFoot or Recon-ng for automated multi-source correlation. API keys for Shodan, SecurityTrails, and Hunter.io improve results.

What is the difference between passive and active reconnaissance?▼

Passive reconnaissance gathers information from public sources like DNS records, certificate logs, and search engines without touching target systems, leaving no trace in target logs. Active reconnaissance involves direct interaction such as port scanning, which may be detected and logged.

Can OSINT reconnaissance find leaked credentials?▼

Yes, credential discovery searches breach databases like Have I Been Pwned, paste sites, and public code repositories on GitHub, GitLab, and Bitbucket. Tools like trufflehog and gitleaks automate secret scanning across a target's public repositories.

When should I not use passive OSINT reconnaissance?▼

Do not use it for stalking, harassment, or unauthorized surveillance of individuals. OSINT gathering requires written authorization within a defined engagement scope and must comply with privacy laws such as GDPR and CCPA.

Related Skills

Explore More Software Engineering Skills→
markwang2658markwang2658
31

web-pentest

Automate authorized web-application penetration testing from reconnaissance to reporting.

Community
Advanced
dapperdiversdapperdivers
1

shodan-recon

Discovers Internet-facing assets and vulnerabilities via Shodan queries.

Community
Intermediate
starwreckntxstarwreckntx

DiscoveryAgent

Discover network assets and maintain service inventory across environments.

Community
Basic
0X6C78790X6C7879

initial-access-recon

Map external attack surfaces with OSINT and subdomain enumeration.

Community
Advanced