collecting-open-source-intelligence

# Collecting Open-Source Intelligence ## When to Use Use this skill when: - Investigating external infrastructure associated with a phishing campaign targeting your organization - Enriching threat actor profiles with publicly observable indicators (WHOIS, ASN data, SSL certificates) - Conducting authorized attack surface discovery to understand your organization's external exposure **Do not use** this skill for active scanning against targets without explicit written authorization — OSINT collection must remain passive (no packets sent to target systems) unless scope permits active recon. ## Prerequisites - Maltego CE or commercial license for graph-based link analysis - Shodan API key (https://shodan.io) for internet-wide device/service discovery - OSINT Framework familiarity (https://osintframework.com) for tool selection - SpiderFoot HX or open-source SpiderFoot for automated OSINT correlation ## Workflow ### Step 1: Define Collection Requirements Establish the intelligence requirement (IR) before collecting. Document: - Target: threat actor group, malicious domain, IP range, or organization - Priority Intelligence Requirements (PIRs): What specific questions need answering? - Legal authority: Passive OSINT is legal; active probing requires authorization - Data handling: TLP classification for collected intelligence ### Step 2: Passive DNS and WHOIS Investigation ```bash # Passive DNS via SecurityTrails API curl "https://api.securitytrails.com/v1/domain/evil-doma...