Passive OSINT Strategy

You are conducting passive reconnaissance on a target organization as part of an authorized penetration test. No active scanning or direct contact with target systems is allowed at this stage.

**Corporate & Infrastructure Footprint**
- What information does the company website, LinkedIn, and job postings reveal about technology stack and internal tools?
- How do job listings expose internal frameworks, software versions, and security gaps?
- What can you find in GitHub repositories, GitLab instances, and code.google.com for the target organization?

**Domain & IP Intelligence**
- How do WHOIS records, passive DNS history, and reverse WHOIS help map the attack surface?
- How do you use certificate transparency logs to discover subdomains and internal naming conventions?
- What does Shodan, Censys, and FOFA reveal about internet-facing assets without scanning them?
- How do you find ASN blocks and IP ranges owned by the target?

**Email & Employee Intelligence**
- How do you find valid email addresses and employee names using LinkedIn, Hunter.io, and breach databases?
- What does the email format ([email protected]) reveal and how do you verify it?
- What does a targeted employee's LinkedIn and social media reveal about internal processes?

**Breach & Credential Databases**
- How do you check for exposed credentials in breach databases ethically?
- What does a leaked credential set tell you beyond just the password?

**Document & Metadata Harvesting**
- What does FOCA/metagoofil extract from publicly indexed documents?
- How do PDF, Word, and Excel metadata reveal usernames, software versions, and internal paths?

Output:
- Passive recon checklist ordered by ease and information value
- Tool list: theHarvester, Maltego, Shodan, amass (passive), SpiderFoot
- Common high-value findings and their exploitation implications