Chapter 42: Advanced OSINT & Attack Surface Mapping¶

Overview¶

Open Source Intelligence (OSINT) is the collection and analysis of publicly available information to support security assessments, threat intelligence, and attack surface management. For red teams, OSINT forms the foundation of the Reconnaissance tactic (TA0043) in the MITRE ATT&CK framework — every engagement begins with understanding what an adversary can learn about the target without ever touching a firewall. For blue teams, OSINT is equally critical: understanding your own external exposure is the first step in reducing attack surface. This chapter covers advanced OSINT techniques, tooling concepts, and the defensive implications of information exposure.

Learning Objectives

1. Apply structured OSINT methodologies to map an organization's external attack surface
2. Enumerate domains, subdomains, email addresses, and technology stacks using passive and active reconnaissance techniques
3. Leverage certificate transparency logs, DNS records, and code repositories for intelligence gathering
4. Assess corporate exposure through employee profiling, document metadata, and third-party data leaks (synthetic examples only)
5. Implement attack surface management programs that continuously monitor for new exposure
6. Understand the defensive countermeasures for each OSINT technique

Prerequisites: Chapter 16 (penetration testing methodology), Chapter 41 (red team methodology). Familiarity with DNS, HTTP, TLS, and basic command-line tools.

Curiosity Hook¶

OSINT Methodology¶

The Intelligence Cycle Applied to OSINT¶

OSINT follows the same intelligence cycle used by military and government intelligence agencies, adapted for cybersecurity assessments.

flowchart TD
    A[1. Planning &\nDirection] --> B[2. Collection]
    B --> C[3. Processing &\nExploitation]
    C --> D[4. Analysis &\nProduction]
    D --> E[5. Dissemination]
    E --> F[6. Feedback &\nRe-tasking]
    F --> A

    style A fill:#1e3a5f,color:#e6edf3
    style B fill:#2a4a6f,color:#e6edf3
    style C fill:#36597f,color:#e6edf3
    style D fill:#1a3a1a,color:#e6edf3
    style E fill:#1a3a1a,color:#e6edf3
    style F fill:#4a1a6f,color:#e6edf3

Passive vs. Active Reconnaissance¶

ATT&CK Technique Mapping — Reconnaissance Tactic (TA0043)¶

Domain and Infrastructure Enumeration¶

DNS Enumeration Techniques¶

DNS records are one of the richest sources of OSINT data. A thorough DNS enumeration reveals the organization's infrastructure topology.

# Conceptual example — querying CT logs for acmecorp.example.com (synthetic)
# This represents the TYPE of data available, not a working command

Results from Certificate Transparency logs:
- acmecorp.example.com
- www.acmecorp.example.com
- mail.acmecorp.example.com
- vpn.acmecorp.example.com
- dev.acmecorp.example.com
- staging.acmecorp.example.com
- api.acmecorp.example.com
- jenkins.acmecorp.example.com    ← CI/CD exposure
- grafana.acmecorp.example.com    ← Monitoring exposure
- owa.acmecorp.example.com        ← Outlook Web Access

OSINT Tools — Conceptual Overview¶

Tool Comparison Matrix¶

Shodan — Internet Device Intelligence¶

Shodan indexes internet-connected devices by actively scanning the IPv4 address space and recording service banners. For OSINT, Shodan reveals what an organization exposes to the internet without requiring the assessor to perform their own scanning.

Conceptual Search Operators:

# Synthetic examples — educational purposes only
# These demonstrate search concepts, not targeting instructions

# Find web servers belonging to an organization (synthetic)
org:"ACME Corp Example" port:443

# Find exposed RDP services in a specific network (synthetic — RFC 5737)
port:3389 net:198.51.100.0/24

# Find exposed industrial control systems (conceptual awareness)
port:502 product:"Modbus"

# Find default credential pages (defensive awareness)
http.title:"Login" org:"ACME Corp Example"

Maltego — Link Analysis and Entity Mapping¶

Maltego visualizes relationships between entities (people, domains, IPs, organizations) through automated data collection ("transforms").

Conceptual Entity Types:

flowchart TD
    A[ACME Corp\nOrganization] --> B[acmecorp.example.com\nDomain]
    A --> C[John Smith\nSynthetic Employee]
    B --> D[198.51.100.10\nWeb Server]
    B --> E[198.51.100.20\nMail Server]
    B --> F[dev.acmecorp.example.com\nSubdomain]
    C --> G[john.smith@acmecorp.example.com\nEmail]
    C --> H[LinkedIn Profile\nSynthetic]
    F --> I[203.0.113.50\nDev Server IP]
    G --> J[Credential Breach\nSynthetic - 2023]

    style A fill:#1e3a5f,color:#e6edf3
    style J fill:#8b1a1a,color:#e6edf3
    style I fill:#8b4513,color:#e6edf3

Corporate Intelligence Gathering¶

Employee Profiling (Synthetic Example)¶

Synthetic Example — ACME Corp Employee Discovery:

Technology Fingerprinting¶

Identifying an organization's technology stack through OSINT enables targeted vulnerability research and attack planning.

HTTP/1.1 200 OK
Server: nginx/1.21.4
X-Powered-By: Express
X-AspNet-Version: 4.0.30319
Set-Cookie: ASP.NET_SessionId=abc123; path=/; HttpOnly
Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY

# SPF Record
acmecorp.example.com TXT "v=spf1 include:_spf.google.com include:spf.protection.outlook.com -all"

# DMARC Record
_dmarc.acmecorp.example.com TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@acmecorp.example.com; pct=100"

# DKIM Selector
google._domainkey.acmecorp.example.com TXT "v=DKIM1; k=rsa; p=MIGfMA0GCS..."

Synthetic Exercise: Attack Surface Mapping — ACME Corp¶

Scenario¶

You are conducting authorized OSINT for ACME Corp (acmecorp.example.com), a mid-size technology company with 500 employees, headquartered in a fictional city. The engagement objective is to map the external attack surface and identify exposure that could be leveraged by a threat actor.

Phase 1 — Domain Discovery¶

# Synthetic results — passive subdomain enumeration

Primary domain: acmecorp.example.com
Discovered subdomains (via CT logs, DNS, search engines):

  www.acmecorp.example.com         198.51.100.10    Web server (nginx)
  mail.acmecorp.example.com        198.51.100.20    Email (Exchange Online)
  vpn.acmecorp.example.com         198.51.100.30    VPN gateway (Cisco AnyConnect)
  api.acmecorp.example.com         198.51.100.40    API gateway (Kong)
  dev.acmecorp.example.com         203.0.113.10     Development server
  staging.acmecorp.example.com     203.0.113.11     Staging environment
  jenkins.acmecorp.example.com     203.0.113.12     CI/CD (Jenkins)
  grafana.acmecorp.example.com     203.0.113.13     Monitoring dashboard
  legacy.acmecorp.example.com      198.51.100.50    Legacy application
  careers.acmecorp.example.com     198.51.100.60    Careers portal (WordPress)

Phase 2 — Exposure Assessment¶

Phase 3 — Attack Surface Map¶

flowchart TD
    A[ACME Corp\nAttack Surface] --> B[External Infrastructure]
    A --> C[People & Culture]
    A --> D[Third-Party\nExposure]

    B --> E[Web: 198.51.100.10\nnginx - Low Risk]
    B --> F[VPN: 198.51.100.30\nCisco AnyConnect]
    B --> G[Jenkins: 203.0.113.12\nCRITICAL EXPOSURE]
    B --> H[Legacy App: 198.51.100.50\nASP.NET 2.0 - HIGH]
    B --> I[Dev Server: 203.0.113.10\nHIGH EXPOSURE]

    C --> J[47 LinkedIn Profiles\nOrg Chart Visible]
    C --> K[3 GitHub Repos\nEmail Format Confirmed]
    C --> L[CTO Conference Talk\nAWS EKS Confirmed]

    D --> M[WordPress Careers\nPlugin Exposure]
    D --> N[SPF Soft Fail\nSpoofing Possible]

    style G fill:#8b1a1a,color:#e6edf3
    style H fill:#8b4513,color:#e6edf3
    style I fill:#8b4513,color:#e6edf3
    style E fill:#1a3a1a,color:#e6edf3

Dark Web Monitoring Concepts¶

What Dark Web Monitoring Detects¶

Attack Surface Management (ASM)¶

Attack Surface Management is the continuous process of discovering, inventorying, classifying, and monitoring an organization's external-facing assets.

Blue Team Detection Correlation¶

Every OSINT technique reveals something about your organization that a defender should monitor and minimize.

Exam Prep & Certifications¶

Review Questions¶

Key Takeaways¶