> For the complete documentation index, see [llms.txt](https://michel-disbergen.gitbook.io/hack-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://michel-disbergen.gitbook.io/hack-notes/osint/1.-osint-checklist.md).

# 1. OSINT checklist

### 1. General OSINT

* [ ] **1.1. OSINT - shodan / censys**

```bash
# 1. shodan
https://www.shodan.io/search?query={{RHOST}}

# 2. censys
https://search.censys.io/search?resource=hosts&q={{RHOST}}
```

* [ ] **1.2. OSINT - Google Dork**

```shellscript
# use the built-in tool/ query the following commands
# use the following resource: https://dorksearch.com/

# find exposed directories
site:{{RHOST}} intitle:"index of"

# search for specific file types
site:{{RHOST}} (filetype:pdf OR filetype:doc OR filetype:xls)

# locate configuration files
site:{{RHOST}} (ext:conf OR ext:cnf OR ext:config OR ext:ini OR ext:env)

# find pages containing sensitive keywords
site:{{RHOST}} (intext:"password" OR intext:"username" OR intext:"login")

# discover publicly accessible backup and old files
site:{{RHOST}} (ext:bak OR ext:old OR ext:backup OR ext:sql)
```

* [ ] **1.3. OSINT - Metadata extraction**

```shellscript
# Use tools like ExifTool to extract metadata from images or files found on the website, which may reveal usernames, software versions, or internal paths.
exiftool <file>
```

* [ ] **1.4. OSINT - Public Code Repositories**

```bash
# Search GitHub for repositories belonging to the target organization
# Replace 'exampleorg' with the organization's GitHub username
https://github.com/exampleorg

# Use GitHub's advanced search to find mentions of the target domain
https://github.com/search?q={{RHOST}}&type=Code

# Clone a repository of interest
git clone https://github.com/exampleorg/repository-name.git

# Use tools like 'gitdumper' to dump exposed '.git' directories from websites
# Install GitTools: https://github.com/internetwache/GitTools
gitdumper http://{{RHOST}}/.git/ /path/to/dump/
```

* [ ] **1.5. OSINT - Public Code Repositories (Github copilot)**

```bash
# 1. navigate to https://cs.github.com

# 2. search for a specific term, e.g.: for OPEN_AI api keys:
"OPENAI_API_KEY" "sk-" "T3BlbkFJ"
```

* [ ] **1.6. OSINT - tool/ resource collection**

```bash
# 1. osint framework
https://osintframework.com/

# 2. osint sh
https://osint.sh

# 3. start.me OSINT resources
https://start.me/p/gy1BgY/osint-tools-and-resources

# 4. OSINT resources for each country
http://cybdetective.com/osintmap/
```

* [ ] **1.7. OSINT - spiderfoot**

```bash
# 1. Spiderfoot is by default installed on kali. Start spiderfoot with the following command:
spiderfoot -l 127.0.0.1:4000

# 2. Navigate with your browser to the target webapp
# 3. create a new scan. e.g. on the domain {{RHOST}}
```

### 2. DNS OSINT

* [ ] **2.1. OSINT - whois**

```bash
# whois query
whois {{RHOST}}

##### look at fields that can tell you more about the target, e.g.:
# - Registrar
# - Registrant Organization
# - Registrant Name
# - DNS Name Server
# - e-mail addresses

# online webapp whois
https://whois.domaintools.com/example.com

```

* [ ] **2.2. OSINT - Gather subdomains**

```bash
# More tools can be found at the following link:
# Navigate to https://crt.sh to find subdomains.
# Navigate to https://osint.sh/subdomain/ to find subdomains.

# Subfinder
subfinder -d {{RHOST}}

# Sublist3r
sublist3r -d {{RHOST}}

# BBOT (https://github.com/blacklanternsecurity/bbot)
# Active Enumeration
bbot -t {{RHOST}} -f subdomain-enum

# Passive Enumeration Only
bbot -t {{RHOST}} -f subdomain-enum -rf passive

# theHarvester
theHarvester -d {{RHOST}} -b all -l 200
```

* [ ] **2.3. OSINT - Gather SPF/DKIM/DMARC records of the target domain(s)**

```bash
# Using dig to check DNS records
domain="{{RHOST}}"

# Check SPF record
dig +short TXT ${{{RHOST}}} | grep 'v=spf1'

# Check DMARC record
dig +short TXT _dmarc.${{{RHOST}}} | grep 'v=DMARC1'

# Check DKIM record
dig +short TXT default._domainkey.${{{RHOST}}} | grep 'v=DKIM1'

# Using MXToolbox
# Visit the following link for DNS lookups:
# https://mxtoolbox.com/
```

* [ ] **2.4. OSINT - Gather email addresses/ passwords**

```bash
# anymailfinder
https://newapp.anymailfinder.com/search/single

# using theHarvester
theHarvester -d {{RHOST}} -b all -l 200

# gather e-mail addresses based on a domain
https://prospeo.io/domain-search

# tool that has a DB leak of username/password combinations
https://www.proxynova.com/tools/comb/

# check for leaked database breaches or stealer logs
https://www.leackcheck.io

# using intelbase.is for looking up specific e-mail addresses
https://intelbase.is/
```

### 3. Website OSINT

* [ ] **3.1. OSINT - Waybackurls & GAU**

```bash
# 1. use GAU (Get All URLs) to retrieve all URLS available and verify if they exist
gau {{RHOST}} | httpx
                
# 2. use waybackurls for urls and verify with httpx if they exist
waybackurls {{RHOST}} | httpx

# 3. Alternatively, use the following bash one-liner if you don't have httpx installed
# Retrieve all URLS using waybackurls and (optional) 
# validate if they exist
for url in $(echo "http://{{RHOST}}" | waybackurls); do status_code=$(curl -s -o /dev/null -w "%{http_code}" --max-time 0.5 "$url"); [[ "$status_code" != "404" && "$status_code" != "000" ]] && echo "$url"; done
```

* [ ] **3.2. OSINT - urlquery.net**

```bash
# 1. navigate to https://urlquery.net/ and insert the target URL
```

* [ ] **3.3. OSINT - Check technologies used**

```bash
# builtwith
https://builtwith.com/
```

* [ ] **3.4. OSINT - Security headers**

```bash
# 1. navigate to https://securityheaders.com

# 2. fill in the relevant domain
http://{{RHOST}}
```

* [ ] **3.5. OSINT - SSL labs**

```bash
# 1. navigate to https://www.ssllabs.com/ssltest/
...

# 2. fill in the relevant domain
https://{{RHOST}}
```