OSINT Investigations
Conduct OSINT investigations using publicly available information.
Project objective
Practice structured OSINT methodology — using only publicly available information — against a self-hosted practice target: a demo company domain and a set of synthetic "employee" personas set up specifically for this exercise, to build a repeatable recon workflow that could later support an authorized external reconnaissance phase of a penetration test.
What I did
Reconnaissance was broken into passive infrastructure mapping and public-footprint discovery, using only open sources and no active exploitation.
# Domain and DNS footprint
whois demo-target.local
dig demo-target.local ANY
dig axfr demo-target.local @ns1.demo-target.local
# Passive subdomain enumeration via certificate transparency logs
curl -s "https://crt.sh/?q=%.demo-target.local&output=json" | jq -r '.[].name_value' | sort -u
# Automated OSINT sweep: emails, subdomains, and hosts
theHarvester -d demo-target.local -b crtsh,dnsdumpster,duckduckgo -f results.html
# Infrastructure fingerprinting via Shodan
shodan search "hostname:demo-target.local"
# Metadata extraction from publicly posted documents
exiftool -a -u downloads/*.pdf | grep -iE "author|software|creator"The exercise walked through Google dorking to find exposed documents and login portals, reverse image search to check for reused profile photography across the synthetic personas, and correlating usernames across platforms to demonstrate how quickly a public digital footprint can be reconstructed. All findings were compiled into a recon report summarizing the organization's external attack surface and the categories of information exposed.
Key learning
Passive recon adds up fast when it's organized rather than ad hoc — keeping a single running spreadsheet of discovered subdomains, emails, and technologies as they're found (rather than re-deriving them at report time) saved significant time. It also reinforced why organizations should treat metadata in public documents and certificate transparency logs as sensitive: neither requires any interaction with the target's systems, yet both leak real internal structure.