Pros
- • Completely passive discovery generates zero alarms on client infrastructure
- • Maps external exposure across domains, subdomains, and shadow IT
- • Enriches asset inventories with Shodan, DNS, and Certificate Transparency data
- • Visualizes complex organizational relationships using Maltego graphing
- • Provides highly accurate scoping intelligence for subsequent penetration tests
- • Identifies historical credential breach exposure without violating privacy boundaries
- • Delivers an executive-friendly attack surface narrative
Cons
- • Public data is inherently incomplete and subject to false positives
- • Requires intensive manual validation to separate signal from noise
- • Must strictly navigate data privacy and ethical reconnaissance boundaries
- • Limited internal context requires eventual client alignment to confirm asset ownership
The gap that gets organisations breached is rarely the asset they’re guarding. It’s the one they forgot they owned — a staging subdomain from a 2022 project still resolving, an S3 bucket a contractor stood up and never locked down, an AWS key a developer committed to a public repo at 2 a.m. and never rotated. A competent attacker spends the first weeks of an operation building exactly that inventory, passively, before touching a single packet you’d log. The perimeter you think you’re defending and the perimeter they can see are usually two different maps.
The OSINT Attack Surface Intelligence Workflow builds the attacker’s map first, using only passive, legal methods. Run it before the penetration test, not after — it surfaces the assets you didn’t know existed, so the testers spend their hours on the real attack surface instead of rediscovering your main website.
Ethical Boundaries and Passive Reconnaissance
The whole value of this phase is that it’s passive — nothing we do touches your infrastructure, so nothing generates an alert or a log entry on your side. That’s also the boundary that keeps it legal, and the line matters because it’s genuinely easy to step over without noticing.
No active scanning: We read what Shodan and Censys have already indexed. We don’t run our own port scans or probes against your hosts — the moment we send a SYN to your network, this stops being passive reconnaissance and becomes an unauthorised scan.
No credential testing: We’ll tell you an employee address appears in a known breach corpus. We do not attempt to log in with anything. Confirming a leaked password by trying it is unauthorised access, full stop, regardless of intent.
No social engineering: We reconstruct org structure from LinkedIn and public filings. We don’t call anyone, don’t send test phishing, and don’t interact with staff. The people are data points in the map, not participants in the exercise.
Intelligence Objectives
The objective is a complete picture of what’s exposed, assembled from the same places an attacker looks:
Infrastructure Every domain — the flagship ones, the forgotten subdomains, the ASNs and IP ranges the organisation may not remember registering after an acquisition or a cloud migration.
Cloud & Shadow IT Orphaned S3 buckets, publicly readable blob storage, SaaS tools stood up by a team without telling IT. Shadow IT is valuable to an attacker precisely because nobody who could secure it knows it’s there.
Technology Fingerprinting The stack you’re running — frameworks, WAF provider, CMS versions. This is how an attacker narrows to version-specific exploits instead of guessing. Worth remembering the limit: public fingerprinting infers versions from banners and behaviour, and banners lie, so treat it as a lead to confirm rather than ground truth.
SSL Certificates & CT Logs
Certificate Transparency logs record every certificate ever issued for your domains, and you can’t opt out of them — which cuts both ways. It’s why they’re such a rich source: a cert issued for internal-billing.dev.target.com announces an environment you may have assumed was private.
Source Code & Secrets Public GitHub for hardcoded API keys, AWS credentials, CI/CD configs a developer pushed and forgot. This is both extremely common and extremely damaging, because a live key is not an exposure to fix later — it’s an active credential someone else may already be using.
The Practitioner Tool Stack
Doing this at scale needs the right tools. What actually gets used, and what each one is good and bad at:
Maltego The graphing layer. It links domains, IPs, addresses and registrants into a visual map of your internet presence, which is what makes the relationships legible to a non-technical audience. The caveat: Maltego’s transforms are only as good as their data sources, and it will happily draw a confident-looking edge between two entities that aren’t actually related. The graph is a hypothesis generator, not a verified fact.
Passive DNS Discovery: Amass, Subfinder, DNSdumpster These enumerate subdomains without probing your network — they pull from passive DNS databases, CT logs and other public sources. Fast and quiet, but incomplete: they only know subdomains that have appeared in a data source, so a genuinely obscure host can stay invisible until it shows up in a certificate.
Shodan & Censys Internet-wide scanners that index exposed services. They tell you what’s reachable, on which ports, running what. Remember their data is a snapshot on a scan cadence — a service exposed an hour ago may not be indexed yet, and one you closed last week may still show as open until the next crawl.
Historical Data: Wayback Machine, crt.sh, WHOIS/RDAP Archive.org resurrects old endpoints and paths long after they vanished from the live site. crt.sh queries the CT logs for every certificate issued to your domains. WHOIS/RDAP gives registration detail — though privacy redaction and GDPR mean much of the juicy registrant data is now masked, so calibrate expectations accordingly.
Custom Python Scripts The glue. Parse DNS records, aggregate feeds, dedupe, and drive the collection pipeline so a workflow that took a week by hand runs overnight and repeats on a schedule.
The Intelligence Workflow
1. Scoping & Authorisation Agree which domains are in scope and get it in writing before anything else. Passive though this work is, an authorisation letter is what separates reconnaissance from something a prosecutor could frame differently — and it protects you when the OSINT turns up an asset that turns out to belong to a sister company you weren’t cleared to touch.
2. Passive Data Collection Run the sources in parallel — DNS enumeration, GitHub secret searches, breach-corpus lookups, Shodan queries. This phase deliberately over-collects; the raw output will be far larger and far noisier than the final report, and that’s fine.
3. Data Enrichment Cross-reference. Take an IP into Shodan, take a domain into its CT history, connect an address to a registrant. This is where isolated facts start becoming a picture — the subdomain plus the certificate plus the exposed port describe a real system, not three unrelated hits.
4. Validation & Filtering The unglamorous step that decides whether the report is trusted. Public data is full of false positives — a repo that looks like yours is a fork, an IP in your range was reassigned last quarter, a “breached” address belongs to a former employee. Everything gets verified by hand before it goes in the report. Skip this and you’ll send the client chasing assets they don’t own.
5. Risk Scoring Rank by real impact, not by how alarming a finding sounds. A live internal API is urgent. A parked marketing domain with no service behind it is noise. Ordering matters because the client has finite remediation hours and will spend them top-down.
6. Integration Hand the validated inventory to the penetration testing team or the vulnerability management programme as the tested scope. The OSINT isn’t the deliverable on its own — it’s what makes everything downstream aim at the right targets.
How This Feeds Into Security Testing
OSINT is the foundation the rest of the engagement stands on.
Red Team Operations Knowing the org structure, the key people, the collaboration tools and the roles turns a generic phishing lure into a credible one — a pretext that references a real project and a real internal tool lands where “Dear valued employee” gets deleted. That credibility is the entire difference between a red team exercise that tests your people and one that just tests your spam filter.
Penetration Testing
The hidden v1 API endpoints, the staging subdomains, the developer portals that never appear on the main site — this is where the real vulnerabilities usually live, because they’re the systems that skipped the security review the flagship app went through. Without the OSINT, testers spend their budget on the hardened front door. With it, they test the window someone left open round the back.
Sample OSINT Findings Matrix
| Risk Level | Finding / Exposure | Attack Vector & Implication | Priority |
|---|---|---|---|
| High | Exposed .git Directory | A forgotten development subdomain (dev.api.target.com) is exposing source code, potentially revealing backend logic and credentials. | Immediate |
| High | GitHub Secrets Leak | A developer committed an AWS Access Key ID to a public repository associated with their corporate email. | Immediate |
| Medium | Exposed RDP (Shodan) | An IP address registered to the organization has port 3389 open to the internet, exposing the network to brute-force and ransomware attacks. | 1-3 Days |
| Low | Breached Email Exposure | 45 corporate email addresses found in the “Collection #1” data breach. Indicates a high risk of credential stuffing if MFA is not enforced. | 1-2 Weeks |
Core Deliverables
The intelligence becomes concrete engineering and security deliverables:
- Attack Surface OSINT Report: A narrative of what an attacker can see, categorised by risk, written to be read by both the SOC and the board.
- Visual Entity Graph: A Maltego chart of the relationships between domains, IPs and third-party vendors — useful precisely because it makes third-party exposure visible, which spreadsheets tend to hide.
- External Asset Register: A clean CSV/Excel inventory of discovered subdomains, IPs and tech stacks, ready to import into asset management — and to diff against next quarter’s run so new exposure gets caught.
- Prioritised Remediation List: The immediate actions, ordered, starting with anything that is a live credential rather than a latent weakness.
30-Day Attack Surface Reduction Plan
Days 1–7: Immediate Triage The live-credential work happens first, because a leaked key is being exploited or it isn’t, and you don’t get to decide the timeline. Revoke and rotate exposed keys — and assume anything that was public has been harvested, so rotate rather than just delete. Firewall off exposed RDP and shut public access to staging.
Days 8–15: Asset Reconciliation Diff the OSINT inventory against your internal asset register. The gap between the two is the shadow IT — the forgotten marketing sites, the legacy boxes nobody owns. Each one gets an explicit decision: keep and secure, or decommission. Leaving it undecided is how it ends up back on next year’s report.
Days 16–30: Automate & Monitor Stand up continuous subdomain monitoring so a new host triggers an alert instead of a surprise. Turn on GitHub secret scanning so the next committed key is caught at push time, not by an attacker. And make the policy explicit: infrastructure gets documented before it goes live, because undocumented is exactly how the last batch became invisible.
Run this workflow and the economics shift in your favour. The forgotten assets and the low-hanging fruit — where most breaches actually start — are gone, and an attacker now has to work for the map you already hold. It doesn’t make you unbreachable. It makes you a harder, slower, noisier target than the organisation next door that never looked.
