Open Source Intelligence (OSINT) Gathering
Map an organization's attack surface without ever touching it: Google dorking, DNS, WHOIS, data leaks, and OSINT tools.
4 hrs/week
🟩 Reconnaissance · Cycle: 2. Reconnaissance (passive) HTB Academy: Information Gathering – Web Edition, DNS Enumeration Using Python
Objectives
- Apply passive reconnaissance (without touching the target).
- Build an organization's attack surface from open sources.
What is OSINT?
OSINT (Open Source Intelligence) consists of collecting publicly available information: websites, DNS, social networks, public registries, previously disclosed data leaks, and search engines. You don't "hack" anything — you gather and cross-reference information left in plain sight. It is the first step of a pentest, because the more you know about the target, the more effective the next attack will be.
Passive vs. active reconnaissance
- Passive: you do not interact directly with the target's systems. You consult third-party sources (Google, WHOIS databases, certificates…). The target doesn't know you're looking at it. This is the focus of this week.
- Active: you send packets to the target (port scans, requests to its server). It yields richer results, but it leaves traces in the target's logs. This will be week 4.