Reconnaissance & OSINT

When to Activate

• A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
• Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
• Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
• Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
• Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
• Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.

Technique Map