OSINT for Red Teamers: Mapping People and Infrastructure

Mobile API OSINT
2025.08.21
Time it takes to read this article 5 minutes.

Introduction / Overview

Legal & ethical disclaimer. Everything below is for education and authorized engagements only. Reconnaissance against assets you do not own or lack written permission to test can violate computer-misuse laws (CFAA, Computer Misuse Act 1990, and equivalents). Always operate within a signed scope and rules of engagement.

Reconnaissance is where every red-team engagement is won or lost. Before a single payload is sent, you want a high-fidelity map of the target's people (employees, emails, roles) and infrastructure (domains, hosts, exposed services). This article walks through a repeatable open-source intelligence (OSINT) workflow that maps to MITRE ATT&CK's pre-attack phases, primarily T1589 Gather Victim Identity Information and T1590 Gather Victim Network Information.

How it works / Background

Passive recon collects data from third-party sources (search engines, certificate logs, breach corpora) without touching the target directly. Active recon (DNS brute-forcing, banner grabbing) sends traffic but is generally low-noise. The goal is to fuse three data planes:

  • People plane — names, emails, job titles. Useful for phishing pretexts and password spraying.
  • Domain/DNS plane — apex domains, subdomains, mail records.
  • Service plane — open ports, software versions, exposed admin panels via Shodan.

The art is correlation: a LinkedIn job title plus a breached password plus an exposed VPN portal is a credible attack path.

Prerequisites / Lab setup

Use a disposable VM (Kali or a Debian container). Install the core tooling:

# theHarvester, dnsx, subfinder
sudo apt update && sudo apt install -y theharvester
go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
go install github.com/projectdiscovery/dnsx/cmd/dnsx@latest

# Shodan CLI
pip install shodan
shodan init <YOUR_API_KEY>
Bash

Set API keys for theHarvester in ~/.theHarvester/api-keys.yaml (Shodan, Hunter, etc.). For this walkthrough we use example.com as a stand-in for an authorized target.

Walkthrough / PoC

1. Email and name harvesting

theHarvester aggregates emails, subdomains, and hostnames across many passive sources. Note the source name is now lowercase crtsh, not certspotter, in recent releases.

theHarvester -d example.com -b crtsh,bing,duckduckgo,hackertarget -l 500 -f recon_example
Bash

This produces recon_example.json / recon_example.xml containing discovered emails and hosts. Cross-reference role data from LinkedIn to build a likely username scheme. If john.smith@example.com appears, the org almost certainly uses first.last. Tooling like linkedin2username can derive candidate logins from a company page (respect LinkedIn's ToS and your scope):

python3 linkedin2username.py -c "Example Corp" -n example.com
Bash

2. Breach data correlation

Harvested emails become far more valuable once enriched with breach data. The legal way to do this is the Have I Been Pwned (HIBP) API, which tells you which breaches an address appears in (it does not return plaintext passwords):

curl -s -H "hibp-api-key: $HIBP_KEY" \
  "https://haveibeenpwned.com/api/v3/breachedaccount/john.smith@example.com?truncateResponse=false"
Bash

For password reuse hunting, HIBP's Pwned Passwords range API uses k-anonymity — you send only the first 5 chars of a SHA-1 hash, never the full credential:

# Check a candidate password's SHA-1 prefix safely
echo -n 'Summer2025!' | sha1sum | awk '{print toupper($1)}' | \
  cut -c1-5 | xargs -I{} curl -s "https://api.pwnedpasswords.com/range/{}"
Bash

Match the returned suffixes against your full hash. This drives a targeted, low-lockout-risk password-spray list.

3. DNS recon and subdomain mapping

Enumerate the attack surface with DNS recon. Combine passive subdomain discovery with resolution and record pulls:

# Passive subdomain enumeration
subfinder -d example.com -all -silent -o subs.txt

# Resolve live hosts and grab A/CNAME records
dnsx -l subs.txt -a -cname -resp -silent

# Pull MX, TXT (SPF/DMARC) and NS records directly
dig +short MX example.com
dig +short TXT example.com
dig +short NS example.com
Bash

Certificate transparency is a goldmine — crt.sh reveals internal-looking hostnames (e.g., vpn., dev., jira.):

curl -s "https://crt.sh/?q=%25.example.com&output=json" | jq -r '.[].name_value' | sort -u
Bash

4. Service exposure with Shodan

Once you have resolved IPs, pivot to Shodan to inventory exposed services without touching the target:

# Hosts associated with the org's domain
shodan search "hostname:example.com" --fields ip_str,port,product

# Everything Shodan knows about a single IP
shodan host 203.0.113.10
Bash

Useful filters for finding weak points: org:"Example Corp" port:3389, ssl.cert.subject.cn:example.com, and vuln:CVE-2023-3519 (the Citrix NetScaler RCE). Spotting an unpatched Citrix ADC or an exposed Apache Tomcat manager is exactly the kind of correlation that converts OSINT into initial access.

Mermaid diagram

OSINT for Red Teamers: Mapping People and Infrastructure diagram 1

The diagram shows how people-plane and infrastructure-plane data converge into a single decision: whether the correlated intelligence justifies an attack path, looping back to collection if not.

Detection & Defense (Blue Team)

OSINT is hard to block at the source, but exposure can be minimized and active probing detected. Treat the following as equal in weight to the offensive steps above.

  • Reduce email exposure. Avoid publishing role-based addresses on the website. Monitor your own domains in HIBP (Domain Search / breach notification) so you learn about exposed credentials before attackers operationalize them.
  • Enforce phishing-resistant MFA. Breach-data password reuse is only fatal without MFA. FIDO2/WebAuthn defeats spraying and AiTM proxies that bypass OTP.
  • Harden DNS & CT hygiene. Use wildcard certs where appropriate so individual internal hostnames (vpn., dev.) are not leaked into certificate transparency logs. Audit crt.sh for your own domains regularly.
  • Mail authentication. Publish strict SPF, DKIM, and a DMARC policy of p=reject. This blunts the spoofing that follows people-plane recon. Verify with dig +short TXT _dmarc.example.com.
  • Shrink the Shodan footprint. Continuously scan yourself: shodan domain example.com and Censys queries reveal what attackers see. Close exposed RDP/3389, SMB/445, and unpatched edge appliances (Citrix, Fortinet, Ivanti). Map findings to CISA KEV.
  • Detect active recon. Subdomain brute-forcing and rapid DNS resolution can be caught via authoritative-server query analytics. Canary subdomains and DNS canary tokens flag enumeration attempts.
  • Threat-model your people. Train high-visibility staff (executives, IT, finance) identified via LinkedIn — they are the ones recon prioritizes for pretexting. See our notes on phishing infrastructure for how attackers weaponize this data.

ATT&CK references for defenders: detections for T1589/T1590 live under the Reconnaissance tactic; the primary mitigation is M1056 (Pre-compromise) — accept that recon happens and minimize the value of what is discoverable.

Conclusion

Effective red-team OSINT is not about one magic tool — it is correlation across the people, DNS, and service planes. theHarvester and LinkedIn build the human map, HIBP-driven breach data adds credential context, subfinder/dnsx/crt.sh expose the domain surface, and Shodan finishes the picture with live, vulnerable services. Defenders win by minimizing exposure, enforcing phishing-resistant MFA, hardening mail/DNS, and continuously scanning their own footprint with the same tools attackers use. Run reconnaissance only within an authorized scope, document every source, and turn your findings into prioritized, defensible attack paths.

References

You Might Also Like

If you found this useful, these related deep-dives cover adjacent techniques and their defenses:

Comments

Copied title and URL