Reconnaissance & OSINT

When to Activate

• New target engagement begins — need full attack surface mapping
• Gathering intelligence before exploitation phase
• Building target profile for social engineering
• Identifying exposed services, leaked credentials, historical infrastructure

Methodology

Phase 1: Passive Reconnaissance

Domain & Subdomain Enumeration

# Subdomain discovery (passive)
subfinder -d $DOMAIN -all -o subs_passive.txt
amass enum -passive -d $DOMAIN -o subs_amass.txt
cat subs_*.txt | sort -u > all_subdomains.txt