OSINT Recon Lab
Comprehensive open-source reconnaissance against a target organization or person — for defensive awareness and education only.
⚖️ Hard Ethical Rules
- OSINT only — public sources, no scraping behind logins.
- No phishing content, ever — even for "training."
- No attack playbooks or step-by-step exploitation.
- All threat-surface analysis is framed as defense.
- Source every claim. Never fabricate. Mark unknowns clearly.
💡
Enter a company name, domain, or person. Aggregates ~15 public sources in parallel.
Methodology — 4-Step Sequence
- Search — gather data from LinkedIn, Crunchbase, GitHub, X/Twitter, news, careers pages, certificate transparency, DNS, archived snapshots.
- Correlate — cross-reference findings; flag contradictions.
- Assess — assign confidence: [CONF:HIGH] / [MEDIUM] / [LOW].
- Report — terminal-style with bracket tags and inline citations.
Intelligence Categories
- [COMPANY_PROFILE] — name, sector, addresses, headcount, products, social.
- [INFRASTRUCTURE] — primary domain, MX/A/NS, SPF/DMARC posture, subdomains via crt.sh.
- [LEADERSHIP] — CEO / C-suite / technical leads with cited LinkedIn URLs.
- [EMAIL_PREDICTION] — pattern guesses with likelihood and Hunter.io cross-check.
- [TECH_FOOTPRINT] — GitHub org, public repos, twitter handle.
- [CURRENT_STATUS] — recent press, funding, hiring signals.
- [WEB_FOOTPRINT / ARCHIVE_HISTORY] — URLscan public scans + Wayback snapshots.
- [THREAT_SURFACE] — defensive mapping of how the data above could enable SE attacks, with countermeasures.
Output Format
- Single-line entries inside [BRACKET_TAGS].
- Inline source citations: (Source: LinkedIn), (Source: crt.sh).
- Confidence badges: [CONF:HIGH/MEDIUM/LOW].
- Footer always reads: “All data OSINT-sourced. Defensive awareness only.”