osint-recon-automationlisted

# OSINT Recon Automation ## Authorization Boundary - Restrict to your own assets, bug bounty programs with explicit scope, or assignments with written authorization. - No social engineering, doxing, harassment, or targeting individuals. - Respect rate limits and provider terms; never weaponize discovered credentials. ## Recon Workflow 1. Seed: registered domains, ASNs, org names, GitHub orgs, app store handles. 2. Expand passively: cert transparency, passive DNS, reverse WHOIS, ASN ranges, code search, leaked credential repos, archive snapshots. 3. Resolve and validate: `dnsx`, `httpx`, screenshot with `gowitness` or `aquatone`. 4. Pivot: shared favicons (`favfreak`), Google Analytics IDs, S3 bucket naming, JS endpoints, ASN neighbors. 5. Dedupe and graph: build a node-edge model `(asset)-[relation]->(asset)` and store in Neo4j or JSONL. 6. Monitor: diff snapshots; alert on new subdomain, new exposed service, leaked secret, or impersonation domain. ## Exposure Signals - Exposed admin panels, dev/stage hosts, open S3/Blob/GCS, leaked `.env`, `.git/`, `.DS_Store`, swagger, GraphQL introspection, package registry takeover candidates, dangling DNS. ## Output Contract - `seeds.yaml`, `assets.jsonl`, `graph.json`, `screenshots/`, `exposures.csv`, `diff/<date>.md`. - `report.md`: new exposures since last run with severity and owner. - `takedowns.md`: impersonation domains and reporting paths.