recon-osint

# Reconnaissance & OSINT ## When to Activate - A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs. - Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate. - Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets. - Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure). - Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage. - Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization. ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Passive subdomain enum (subfinder/amass/CT logs) | T1590.002, T1596.001 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py | | DNS brute / permutation / resolution (puredns/alterx/dnsx) | T1595.002, T1590.002 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py | | ASN → CIDR → reverse-DNS expansion | T1590.005, T1596.005 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py | | HTTP probing + tech fingerprint (httpx) | T1595.002, T1592.002 | CWE-200 | references/attack-surface-mapping.md | scripts/recon_orchestrator.py | | Headless crawling + archive URLs (katana/gau) | T1595.002, T1593.003 | CWE-200 | references/att...