OSINT in a penetration test: what can be found out about a company in advance

The abbreviation OSINT, short for open-source intelligence, covers three different disciplines and doesn’t distinguish between them by itself. A journalist calls it working with open sources to verify a fact. A company vetting a business partner calls it an analysis of public registers. In a penetration test it is reconnaissance before an attack. The method overlaps in places; the brief and the deliverable don’t.

This page describes only the third meaning. With us OSINT isn’t a separate service you could order on its own, but the first phase of a test or a red team operation. Vetting business partners and tracing people don’t follow from it and we don’t do them.

The line runs by whether the gathering touches the target infrastructure. Passive OSINT reads only what is published elsewhere: registers, website archives, certificate logs, public profiles. The target company never finds out about it, because nobody communicates with its systems.

Active OSINT does touch the target. A query to a name server, loading a login page, checking whether a particular email address exists. Every such step leaves a record in a log and can raise an alert, so reconnaissance turns into the first measurable contact with the defense.

The difference isn’t academic, because it decides from what point written authorization is needed. Passive gathering works with what is out there anyway. Active gathering already aims at someone else’s system and isn’t done without the owner’s consent. Where exactly the line falls for a given technique is for a lawyer to judge, not a tester.

The sources fall into six categories. Knowing the categories is more useful than knowing a list of tools: the tools change every year, the categories stay.

• DNS and certificate logs: the addresses the company runs, including those nobody has touched in years.
• Job ads and professional profiles: an ad for an administrator of a specific system reveals what runs inside more precisely than a scan from outside.
• Metadata in published documents: names, internal paths, and the versions of the programs a file was created in.
• The company website and marketing materials: the page introducing the team, photos from the offices, and recruitment videos. They show more than a register: the type of access card on a lapel, the model of the reader by the door, the layout of the reception desk. A check of access cards and on-site security picks up on those details.
• Public registers: company officers, ownership structure, contracts concluded, and their values.
• Credentials leaked from other services: employee addresses the company doesn’t know have been out for years; leaked credentials as a source have an entry of their own.

A single item means nothing on its own. The value lies in how they combine: two public documents and one profile are enough for a message to sound like it came from a colleague in the next department. What happens with such a map afterward is described by the reconnaissance we build the entry scenario from.

Reconnaissance does two jobs at once. It assembles a technical list of ways in, and it supplies material for a pretext. The first is a list of addresses, services, and login interfaces. The second is a detail the recipient of the message knows and has no reason to question.

A pretext built on a project the company itself announced in a public tender gets through where a generic request to renew a password doesn’t. That is exactly how a targeted message differs from a mass send: it isn’t better written, it is better prepared.

Banning social networks won’t solve it, because part of that footprint is created beyond the company’s reach. More usable is exercising the reaction to a targeted message: so that people know who to report a suspicious message to, and so that nobody gets told off for it.

It isn’t preparation that doesn’t count. Reconnaissance before an attack has its own tactic in MITRE ATT&CK, Reconnaissance (TA0043), meaning its own group of techniques with their own labels. It differs from reconnaissance inside the network, which comes only after a breach, in that it happens before anyone gets in. How the attacker’s tactics are ordered has an entry of its own.

Part of the footprint can’t be shrunk, and it is honest to say so straight away. The commercial register, the register of contracts, and the certificate logs are public by design and nobody will close them for one company. Trying to disappear from them is a waste of time.

The rest can be shrunk. Shut down subdomains and test instances nobody uses any more. Drop exact system versions from job ads and leave only the role. Clean metadata out of documents before they are published. And agree with people on what belongs in a public profile, instead of a ban nobody will keep anyway. Going through your own website with an attacker’s eyes is the cheapest of those steps, and a company has every right to it, because it produced that content itself.

The goal isn’t to disappear, that can’t be done. The goal is to know what is visible, and not to be surprised by it at the moment somebody uses it.