Passive Reconnaissance: The Basics of OSINT

Before an attacker sends a single packet to a target, they have often learned a great deal just by reading what the organisation itself, and the rest of the world, has published. This practice is called open-source intelligence, or OSINT, and it is the quietest and least intrusive form of reconnaissance. For defenders it is a mirror: it shows what your own organisation reveals without realising it. In this lesson you will learn the principles and the main source types, with no real target, and finish by investigating the only subject you are always allowed to research: yourself.

We just saw that "intelligence gathering" is the second phase of a penetration test. Here is how its passive half works, and the ethical lines you must keep in sight.

Passive versus active reconnaissance

The difference is whether you touch the target's systems:

• Passive reconnaissance uses third-party and public sources. The target's servers see no traffic from you. Reading a public web page of the company in a normal browser is borderline normal use; looking up a registry entry, a certificate transparency log or a search engine is passive.
• Active reconnaissance sends traffic to the target's systems: scanning ports, probing services, crawling a site intensively. It can be detected, and it is within the scope of the law discussed earlier: it requires authorisation.

Passive does not mean "without rules". Collecting information about people, even if it is public, raises privacy and data protection questions, and some uses of the information are unlawful. The data you gather must serve the authorised objective, be kept minimal and be protected.

What OSINT can reveal about an organisation

Here are categories of public information a security assessor looks at. In this lesson we describe the type of source and what it teaches, never a specific target.

• Domain registration data (WHOIS and RDAP): when a domain was registered, which registrar, which name servers; contact details are often hidden today because of privacy rules. It helps list the domains of an organisation.
• DNS records: as you saw in chapter 1, public records reveal mail providers (MX), email protections (TXT: SPF, DKIM, DMARC), hosting providers (A, CNAME) and subdomains. Querying public DNS records through the normal resolvers is usually considered passive information gathering.
• Certificate Transparency logs: every publicly trusted certificate is recorded, so searching for a domain in these logs reveals subdomains that the owner may not advertise, such as test or admin sites.
• Search engines: advanced search operators can find documents, pages and files that were exposed by accident. This technique is sometimes called "search engine dorking". It queries the search engine, not the target.
• Web archives: older versions of a site can show previous technologies, forgotten pages or leaked contact details.
• Public code repositories: developers sometimes publish configuration files, internal names or even secrets by mistake. This ties directly to the secrets management lesson.
• Job advertisements: "we seek an administrator for product X and Y" tells you which technologies are used internally.
• Professional and social networks: names, roles, the organisation chart, technologies listed on profiles, and also the material for social engineering. Handle personal data with great care.
• Documents and their metadata: published files can contain author names, software versions, and internal paths in their metadata.
• Breach and leak notices: information that credentials of an organisation appeared in a data breach, available from legitimate breach-notification services.
• Press, forums and conference talks: technical details and projects publicly described.

A single detail is rarely decisive, but the assembled picture of a few such details might show a technology stack, a naming convention for accounts, a list of subdomains and a set of people to impersonate in a phishing test.

From information to understanding: a method

1. Define the question. "What does this organisation expose on the Internet?" is better than "gather everything".
2. Stay in scope. In an engagement, the scope tells you which domains and organisations are in play, and whether collecting information on employees is allowed. If it is not written, do not do it.
3. Collect from several sources and note the source and the date of each piece of information.
4. Verify. Public information can be outdated or wrong, and identity can be mistaken: two companies or two people with the same name are not the same entity.
5. Correlate and prioritise. Connect the pieces: a subdomain from certificate logs plus a technology from a job advertisement can indicate a possible exposure to be checked later, with authorisation, in the active phase.
6. Minimise and protect. Keep only what the mission needs, and store it securely.

OSINT as a defender

The same techniques are the best way to discover your organisation's attack surface: forgotten domains, test servers exposed to the Internet, an outdated page, files with sensitive metadata, accounts in leaks. Many companies conduct OSINT audits on themselves, or use "attack surface management" services. The mindset is: "What can an outsider learn about us in an afternoon, with no special skills?" The answer is often surprising.

It also changes personal behaviour. Everything you publish about yourself (employer, role, photos, tags, travel plans, pets' names, old posts) contributes to a profile that someone could use for social engineering or to guess security questions. That is why the first course insisted on a careful digital footprint.

Legal and ethical limits

• Data protection law: in the European Union, the GDPR applies to personal data even when it is public. Collecting and processing it needs a legitimate purpose and proportionality. An authorised test might justify limited collection; curiosity about individuals does not.
• No intrusion by the back door: using a leaked password to log in somewhere, or accessing a document that is publicly reachable but evidently not meant to be (an exposed internal file), can cross into unauthorised access. Seeing something is not the same as being allowed to use it.
• No deception beyond the agreement: creating fake profiles to approach people is social engineering, which needs explicit permission and strict rules in an engagement.
• Respect for people: do not collect or share sensitive details about private individuals, and avoid anything resembling harassment or stalking.
• Terms of service: some platforms forbid automated collection.

If you stumble on something sensitive, such as an exposed database, follow the responsible reporting principles from lesson 1: do not explore it, and notify the owner.

Your turn: an OSINT audit of yourself

For this exercise, the only subject is you (or an organisation or a domain that you own). Do not research other people. In your notebook, write down the answers to the following:

1. Search for your full name and your usual usernames in two search engines. What public information appears (profiles, photos, old forum posts)?
2. If you own a domain: query its DNS records (A, MX, NS, TXT) and look at the registration data. What does it show about you or your providers?
3. Check whether your email addresses appear in known data breaches using a legitimate breach-notification service.
4. Review the privacy settings of two of your accounts and note what a stranger can see.
5. Make a list of five details that an attacker could use to impersonate you or to answer your security questions, and decide on one action for each (remove, restrict, change).