OSINT is where red team engagements actually begin. Not when you fire up Metasploit. Not when you scan the first subnet. Before any of that — you do recon. You learn everything you can without touching the target. Done right, OSINT tells you where the doors are before you ever try to open one.

This guide covers the full methodology: what to collect, which tools to use, how to stay invisible while doing it, and how to turn raw intelligence into an attack plan.

Why OSINT Matters on Red Team Ops

Most pentesters skip OSINT or rush it. That’s a mistake.

Good OSINT reconnaissance:

  • Surfaces attack surface that automated scanners miss (shadow IT, forgotten subdomains, exposed credentials)
  • Identifies organizational structure — who manages what, who has admin access, who’s likely to click a phishing link
  • Reveals technology stack details before you send a single packet
  • Informs your social engineering approach if that’s in scope
  • Keeps you undetected — passive recon generates no logs on the target

On a well-scoped red team engagement, you might spend 20–30% of your time on OSINT. That time pays dividends in every phase that follows.

OSINT Methodology: The Framework

Red team OSINT follows a simple loop: Define → Collect → Analyze → Act.

Phase 1: Define Scope

Before collecting anything, be precise about what’s in scope:

  • Domains (primary + subsidiaries)
  • IP ranges
  • Specific people (executive targets, IT staff)
  • Physical locations (if relevant)
  • Third-party relationships (cloud providers, SaaS tools, contractors)

Write this down. You’ll use it to filter noise later.

Phase 2: Passive Collection

Passive OSINT means you never interact directly with target infrastructure. No DNS queries to their servers. No HTTP requests. Just pulling data from third-party sources that already indexed it.

Sources:

  • Public DNS records (passive DNS databases)
  • Certificate transparency logs
  • Search engines (Google dorking)
  • Social media and LinkedIn
  • Job postings (goldmine for tech stack)
  • WHOIS/RDAP registrations
  • Breach databases
  • Code repositories (GitHub/GitLab)
  • Internet scanners (Shodan, Censys, FOFA)

This is where you spend most of your OSINT time.

Phase 3: Active Collection

Active OSINT involves controlled, low-noise interactions. Not exploitation — just probing:

  • DNS enumeration
  • Web crawling target’s public-facing sites
  • Certificate parsing
  • Email validation (careful — some validation methods ping the server)

Stay light. The goal is intelligence, not detection.

Phase 4: Analysis and Pivoting

Raw data isn’t intelligence. You need to find patterns:

  • Which subdomains are running outdated software?
  • Which employees have credentials in breach dumps?
  • What does the org’s GitHub history reveal about internal tooling?
  • What’s the email format? ([email protected] opens phishing doors)

Every data point is a potential pivot. One leaked API key in a GitHub commit can own the whole engagement.

Core OSINT Tools for Red Teamers

1. theHarvester

The starting point for almost every engagement. Collects emails, subdomains, IPs, and URLs from public sources — search engines, Shodan, Hunter.io, Bing, and more.

# Install
pip3 install theHarvester

# Basic usage — query multiple sources
theHarvester -d target.com -b google,bing,shodan,hunter -l 500

# Save output
theHarvester -d target.com -b all -l 500 -f /tmp/harvester-output

What you’re looking for:

  • Employee email addresses (format + actual names)
  • Subdomains you didn’t know about
  • IPs associated with the domain
  • Related hostnames

theHarvester is fast and free. Run it first, always.

2. Amass — Subdomain Enumeration

OWASP Amass is the gold standard for subdomain discovery. It combines passive sources, brute force, and certificate transparency to map an organization’s full attack surface.

# Install
sudo apt install amass
# or
go install -v github.com/owasp-amass/amass/v4/...@master

# Passive enumeration only (no direct target contact)
amass enum -passive -d target.com

# Full enumeration with certificate transparency
amass enum -d target.com -src -ip

# Save to database for later
amass enum -d target.com -o /tmp/amass-output.txt

# Visualize the attack surface
amass viz -d3 -d target.com

Run amass intel to discover additional root domains:

# Find related domains via ASN
amass intel -org "Target Corp" -max-dns-queries 500
amass intel -asn 12345

A single engagement can surface hundreds of subdomains. Many will be forgotten — running outdated software, exposed admin panels, or misconfigured cloud storage.

3. Recon-ng

Recon-ng is a modular reconnaissance framework built for red teamers. Think Metasploit but for OSINT. It has modules for everything: harvesting contacts, mapping infrastructure, pulling breach data, and more.

# Install
pip3 install recon-ng
recon-ng

# Inside recon-ng
marketplace install all
workspaces create target-engagement

Key modules:

# Find contacts
modules load recon/domains-contacts/whois_pocs
options set SOURCE target.com
run

# Subdomain discovery
modules load recon/domains-hosts/hackertarget
options set SOURCE target.com
run

# Resolve hosts to IPs
modules load recon/hosts-hosts/resolve
run

# Pull company info
modules load recon/companies-contacts/linkedin_crawl

The workflow: build up your database of hosts, contacts, and networks across multiple module runs. Recon-ng stores everything — you can query and pivot across your whole dataset.

4. Shodan — Internet-Connected Device Intelligence

Shodan indexes everything exposed on the internet: servers, cameras, industrial controls, VPN endpoints, cloud storage. For red teamers, it’s how you find the forgotten and the misconfigured.

# CLI usage (requires API key)
pip install shodan
shodan init YOUR_API_KEY

# Search for hosts
shodan search "org:\"Target Corp\""
shodan search "hostname:target.com"

# Get host details
shodan host 192.168.1.1

# Find specific services
shodan search "org:\"Target Corp\" port:22"
shodan search "org:\"Target Corp\" product:\"Cisco IOS\""

# Download results
shodan download --limit 1000 results "org:\"Target Corp\""
shodan parse --fields ip_str,port,transport,hostnames results.json.gz

Web-based dorking:

org:"Target Corp" http.title:"Outlook Web App"
org:"Target Corp" http.title:"VPN"
org:"Target Corp" ssl.cert.subject.cn:"target.com"
org:"Target Corp" port:3389

Shodan shows you what the target has exposed — including things their IT team may not even know about. VPN concentrators, RDP endpoints, outdated Exchange servers, exposed Jenkins instances. This is where you find the easy wins.

Free tier is limited. The $49/month Shodan membership is worth it for serious red team work.

5. SpiderFoot — Automated OSINT Collection

SpiderFoot automates the tedious parts of OSINT. It runs dozens of modules in parallel against your target and correlates the results in a searchable database with a web UI.

# Install
pip3 install spiderfoot

# Launch web UI
spiderfoot -l 127.0.0.1:5001

# CLI mode
spiderfoot -s target.com -t INTERNET_NAME -m all -o /tmp/sf-output.csv

Good SpiderFoot modules for red teamers:

  • sfp_shodan — Shodan integration
  • sfp_hunter — Email harvesting
  • sfp_haveibeenpwned — Breach data
  • sfp_github — GitHub code/repo exposure
  • sfp_linkedin — LinkedIn profile enumeration
  • sfp_dnsgrep — Passive DNS

SpiderFoot isn’t precise — it generates noise. Use it for breadth, then manually validate the interesting findings.

6. Maltego — Relationship Mapping

Maltego visualizes the relationships between OSINT data points. IPs, domains, people, organizations, email addresses — Maltego shows how they connect.

It’s GUI-based, which makes it different from everything else on this list. The visual graph is its superpower: you can see attack paths that are impossible to spot in a spreadsheet.

Key transforms:

  • Domain to IP to ASN to organization
  • Email to person to social media profiles
  • Certificate to domain to related infrastructure
  • WHOIS to registrant to other domains they own

Maltego CE (free) is limited to 12 results per transform. For full red team work, you want a commercial license. The Community edition is still useful for getting started and learning the tool.

7. Censys — Infrastructure Search

Censys does what Shodan does but with a different indexing approach. The two tools complement each other — run both, compare results.

# Python API
pip install censys

# Search hosts
from censys.search import CensysHosts
h = CensysHosts()
for host in h.search("services.software.product: Apache AND autonomous_system.organization: Target"):
    print(host)

Web-based searches:

services.tls.certificates.leaf_data.subject.common_name: "target.com"
services.http.response.html_title: "Outlook"
autonomous_system.organization: "Target Corp" and services.port: 22

Censys has better certificate coverage than Shodan. For finding all TLS-enabled services, it’s the better tool.

Google Dorking for Red Teamers

Google indexes things that shouldn’t be public. Dorking is just using advanced search operators to find them.

High-Value Dorks

# Login pages
site:target.com inurl:login
site:target.com inurl:admin
site:target.com intitle:"login"

# Exposed files
site:target.com filetype:pdf
site:target.com filetype:xlsx
site:target.com filetype:env
site:target.com filetype:log

# Config and backup files
site:target.com ext:xml | ext:conf | ext:cnf | ext:reg | ext:inf | ext:rdp | ext:cfg
site:target.com ext:bak | ext:old | ext:backup

# Database files
site:target.com ext:sql | ext:dbf | ext:mdb

# Exposed directories
site:target.com intitle:"index of"

# Error messages with stack traces
site:target.com "Warning: mysql_connect()" 
site:target.com "Fatal error:"

# Subdomains
site:*.target.com

# Related domains / cached
cache:target.com

Google dorking surfaces exposed credential files, admin panels, directory listings, and error pages that contain valuable information — all without touching the target.

GitHub Recon: Finding Exposed Secrets

Developer teams commit secrets. API keys, passwords, private keys, internal URLs — they end up in public repos constantly.

# GitHub search operators
org:TargetCorp password
org:TargetCorp api_key
org:TargetCorp BEGIN PRIVATE KEY
org:TargetCorp AKIA  # AWS access keys
org:TargetCorp "target.com" password
org:TargetCorp "DB_PASSWORD"
org:TargetCorp ".env"

Automated with Trufflehog

pip install trufflehog

# Scan a repo
trufflehog git https://github.com/TargetCorp/repo.git

# Scan a GitHub org
trufflehog github --org=TargetCorp

# Scan with regex
trufflehog git https://github.com/TargetCorp/repo.git --regex

Automated with Gitleaks

# Install
brew install gitleaks
# or
go install github.com/gitleaks/gitleaks/v8@latest

# Scan a repo
gitleaks detect --source /path/to/repo

# Scan remote
git clone https://github.com/TargetCorp/repo.git /tmp/target-repo
gitleaks detect --source /tmp/target-repo --report-format json --report-path /tmp/leaks.json

A single exposed AWS key can be the whole engagement. GitHub recon should be standard on every red team op where code repositories are in scope.

LinkedIn and Social Media Recon

LinkedIn is an OSINT goldmine. It tells you:

  • Org structure (who reports to whom)
  • Technology stack (job postings ask for specific tools)
  • Internal project names (people put them in their experience)
  • Employee names and roles (for phishing target lists)
  • Recent hires (often less security-aware, worth targeting)

Collecting Employee Lists

# Using theHarvester with LinkedIn source
theHarvester -d target.com -b linkedin -l 500

# CrossLinked for targeted email harvesting
pip install crosslinked
crosslinked -f '{first}.{last}@target.com' -j 5 -t 10 "Target Company"

Reading Job Postings

This sounds basic. It’s not. A job posting for a “Senior Security Engineer” that asks for experience with “CrowdStrike Falcon, Splunk, and Palo Alto Networks” just told you exactly what their security stack looks like.

Job postings reveal:

  • EDR solutions in use
  • SIEM platforms
  • Network security products
  • Cloud providers
  • Internal tooling (“experience with our proprietary SOAR”)

Search LinkedIn Jobs, Indeed, and the company’s own careers page.

Email Format Discovery

Once you have employee names, you need the email format. Several methods:

# Hunter.io CLI
pip install hunter-cli
hunter domain-search target.com --api-key YOUR_KEY

# Verify format manually
# Check SMTP header in a test bounce, LinkedIn export, or email sig scraping

# Common formats to test
[email protected]
[email protected]  
[email protected]
[email protected]

Hunter.io shows you the dominant email format for a domain plus example addresses. Combine this with employee names from LinkedIn and you have a phishing target list.

Certificate Transparency Logs

Every TLS certificate issued is logged publicly. This means every subdomain an org has gotten a certificate for — including internal-sounding ones — is in the CT logs.

# crt.sh (no install needed — web or curl)
curl -s "https://crt.sh/?q=%.target.com&output=json" | python3 -m json.tool | grep "name_value"

# amass uses CT logs automatically
amass enum -d target.com -src

# certspotter
# https://sslmate.com/certspotter/

CT logs surface:

  • Staging and dev subdomains (dev.target.com, staging-api.target.com)
  • Internal tool subdomains (jira.target.com, jenkins.target.com, vpn2.target.com)
  • Recently issued certificates (signals new infrastructure)

OSINT for Physical Security (If In Scope)

Red team engagements sometimes include physical access. OSINT supports that too:

  • Google Street View / Maps — Building entrances, camera positions, parking access
  • LinkedIn/company website — Badge photos, office photos showing access control hardware
  • Job postings — “Experience with Lenel/Software House/HID” reveals access control systems
  • Social media — Employees post photos from inside offices (whiteboards with internal info, visible cable runs, server room glimpses)
  • Google Earth historical imagery — See how a site has changed over time

OPSEC While Doing OSINT

Passive OSINT leaves no target-side logs. But you can still get burned:

Use a dedicated OSINT workstation or VM — separate from your personal machine, behind a VPN or dedicated IP. Shodan, Maltego, and other tools hit third-party APIs that log your queries.

Don’t query the target directly — During passive recon, all your queries should go to third-party databases (Shodan, Censys, crt.sh, Google). The moment you run Nmap against the target or browse their internal portal, you’re in active territory.

Rotate your infrastructure — If you’re doing extended OSINT from multiple sessions, use different IPs. Shodan, Hunter.io, and other platforms log query patterns.

Clean your metadata — Any documents you download from the target (PDFs, Word docs) contain metadata. Parse it, don’t open it on your main workstation.

# Extract document metadata
exiftool downloaded-file.pdf

# Strip metadata before sharing
exiftool -all= output-file.pdf

Be careful with web-based OSINT tools — Tools like Maltego CE and some SpiderFoot modules make requests that can notify the target (e.g., HaveIBeenPwned notifications, domain monitoring alerts).

Putting It Together: A Sample OSINT Workflow

Here’s how a systematic OSINT pass looks in practice:

# Step 1: Initial domain recon
theHarvester -d target.com -b google,bing,shodan,hunter -l 500 -f /tmp/initial-harvest

# Step 2: Subdomain enumeration
amass enum -d target.com -passive -src -o /tmp/amass-subs.txt

# Step 3: Certificate transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" | python3 -c "
import sys, json
data = json.load(sys.stdin)
names = set()
for cert in data:
    for name in cert['name_value'].split('\n'):
        names.add(name.strip())
for n in sorted(names):
    print(n)
" | tee /tmp/ct-subs.txt

# Step 4: Merge and sort unique subdomains
cat /tmp/amass-subs.txt /tmp/ct-subs.txt | sort -u > /tmp/all-subs.txt
wc -l /tmp/all-subs.txt

# Step 5: Check what's alive
cat /tmp/all-subs.txt | httpx -silent -status-code -title -tech-detect | tee /tmp/alive-hosts.txt

# Step 6: Shodan for exposed services
shodan search "org:\"Target Corp\"" --fields ip_str,port,hostnames,product | tee /tmp/shodan-results.txt

# Step 7: GitHub recon
trufflehog github --org=TargetCorp --json | tee /tmp/github-leaks.json

# Step 8: Build target list for phishing (if in scope)
# Combine emails from theHarvester + LinkedIn + CrossLinked

At this point you have:

  • Full subdomain map
  • Exposed service inventory
  • Technology stack profile
  • Employee names and email format
  • Potential leaked credentials
  • GitHub exposure

That’s your attack surface. Now you plan.

Before you run these tools against live targets (which requires authorization), practice in controlled environments:

  • TryHackMe — Has dedicated OSINT rooms (Searchlight OSINT, OhSINT, Advent of Cyber challenges)
  • OSINT Framework — Organized collection of OSINT tools and resources by category
  • Trace Labs CTFs — OSINT competitions focused on finding missing persons (real-world, ethical practice)
  • Your own infrastructure — Run OSINT against a domain you own. See what’s exposed about you.

Key Takeaways

OSINT isn’t optional on a red team op — it’s the foundation everything else is built on.

The basics:

  1. Start passive — theHarvester, Amass, crt.sh, Shodan. No direct target contact.
  2. Map the full attack surface — subdomains, IPs, people, technologies, third-party relationships.
  3. Check GitHub — Secrets get committed. Always check.
  4. Read the job postings — They’ll tell you the security stack.
  5. Protect yourself — Dedicated OSINT VM, VPN, don’t query the target directly.

The red teamers who do this well don’t necessarily have the best exploit code. They have the most complete picture before the engagement starts. That’s what turns a good operator into a great one.

Ready to practice? Set up a dedicated OSINT lab with a VPS — Vultr and DigitalOcean both offer affordable instances you can spin up and tear down as needed.

Need pentest-ready content for your business? CipherWrite delivers professional cybersecurity articles, whitepapers, and reports.