OSINT

Passive and semi-passive intelligence gathering focused on code repositories, developer footprints, and exposed secrets across public platforms.

Phases

1. Organization Discovery

• Enumerate GitHub/GitLab/Bitbucket orgs for target company name variants
• Find employee personal accounts linked to the target org
• Identify archived, forked, and deleted repositories

2. Repository Analysis

• Map all repos: tech stack, languages, CI/CD, dependencies
• Identify internal hostnames, IPs, endpoints, environment names
• Check for .env, config files, secrets in current code