The OSINT Framework: Legal and Ethical Reconnaissance for Pentesters

Before any penetration tester touches a port scanner or vulnerability fuzzer, reconnaissance sets the stage. In fact, seasoned security researchers spend upwards of 70% of their assessment time in discovery and asset mapping.

Open Source Intelligence (OSINT) refers to any intelligence gathered strictly from public, openly accessible sources—such as public registries, code repositories, DNS zone files, and digital footprints.

Active reconnaissance involves interacting directly with the target's infrastructure (e.g., port scanning with Nmap, running web vulnerability spiders). Active probes generate network logs and require formal written authorization.

Passive reconnaissance gathers data from intermediaries and public records without directly querying the target. Querying Google cache, DNS resolvers, Shodan, or GitHub search never sends a single TCP SYN packet to the organization's firewall.

Whenever an SSL/TLS certificate is issued for a domain by a public Certificate Authority, it must be logged in public, append-only Certificate Transparency (CT) logs.

Security analysts query CT search engines (such as crt.sh) to instantly reveal historical and newly minted subdomains, including staging environments, test APIs, and legacy customer portals that may lack modern defenses.

One of the highest-yield OSINT vectors involves scanning public GitHub, GitLab, and Pastebin archives. Developers occasionally commit hardcoded API keys, database credentials, or staging configuration files accidentally.

Tools like GitGuardian and Trufflehog help organizations proactively scan commits and automate secret revocation before adversaries can exploit leaked credentials.