conducting-external-reconnaissance-with-osint

What problem does it solve?

OSINT reconnaissance is essential for mapping an organization's external footprint before engagement. This skill aggregates data from certificate transparency logs, DNS records, Shodan, breach databases, and GitHub to surface publicly exposed assets and sensitive information that could be misused or ignored.

Core Features & Use Cases

• Passive OSINT collection across certificate transparency logs, DNS, Shodan, breach data, and code repos to build an external footprint.
• Infrastructure and asset discovery to identify exposed services, domains, subdomains, and potential misconfigurations.
• Use Case: Before a red team engagement, map the target's external surface to guide safe, authorized testing and risk assessment.

Quick Start

Run the External Reconnaissance OSINT agent for a target domain to enumerate subdomains, DNS records, Shodan results, email security posture, and GitHub leaks, producing a structured JSON report.