offensive-osint

To perform domain reconnaissance, profile social media, discover code leaks, query breach data, and map infrastructure, you enforce scope selection and archive artifacts with timestamps, screenshots, and SHA-256 hashes to build a reproducible attack surface map.

You archive OSINT artifacts by recording the URL, timestamp, screenshot (PNG), and hash (SHA-256) for each finding, and logging the data in JSONL format to ensure end-to-end reproducible investigations across red team engagements.

You can investigate domains, organizations, individuals, crypto addresses, and geo subjects. The methodology covers social media profiling, infrastructure mapping, breach data lookups, and code leaks discovery to develop a comprehensive attack surface.

Infrastructure mapping in threat intelligence works by enumerating exposed assets and services using Shodan and Censys, integrating geospatial context to prioritize targets, and assembling the results into a structured reconnaissance plan.

Yes, you can use this workflow for bug bounty reconnaissance. It systematically collects and categorizes open-source intelligence artifacts, allowing investigators to build a reproducible attack surface map tailored for bug bounty target scopes.

GitHub code leak discovery requires tool-compatible JSONL logging and artifact archiving to track findings, but relies on systematically applying structured OSINT workflows rather than any specific proprietary platform dependency.