You’ve picked your target, and you're staring at a massive corporate structure. Thousands of employees, dozens of subdomains, and likely a bunch of forgotten servers tucked away in corners you don't even know exist yet. If you're wondering "Where do I even start?", the truth is, everything is hidden in that first tiny breadcrumb.
I remember a project not too long ago where I mapped out a company’s entire internal network structure just by finding a small snippet of code a senior dev had shared on his personal GitHub. That’s exactly what OSINT (Open Source Intelligence) is: connecting the dots that are visible to everyone but noticed by no one.
If you think OSINT is just "Google dorking," you’re only seeing one side of the coin. For me, this process is no different from a detective story. Once you get into it, you realize it’s the most exciting—yet patience-demanding—phase of a pentest.
Those Forgotten Subdomains Are Always Goldmines
A company’s main website is probably built like a fortress. But what about test-campaign.company.com that was set up five years ago for a marketing push and then forgotten? That’s our goldmine.
It’s a situation I run into constantly: the main systems are guarded by WAFs (Web Application Firewalls) and every security measure imaginable, while these side addresses are crawling with old PHP versions or frameworks with debug modes left wide open.
When it comes to subdomain discovery, my go-to tools are usually Subfinder or Amass. But the secret isn't just running the tool; it’s making sense of the results. For example, when you scan SSL certificates via crt.sh, you can even spot "staging" environments that the company hasn't even taken live yet.
If you want to speed things up with a simple bash script, you could use something like this:
#!/bin/bash
# Let's get the target domain
TARGET=$1
echo "[+] Starting subdomain hunt for $TARGET..."
# Fast scan with subfinder
subfinder -d $TARGET -o subdomains.txt
# Check which found domains are actually live (using httpx)
cat subdomains.txt | httpx -title -tech-detect -status-code -o live_subdomains.txt
echo "[+] Live domains saved to live_subdomains.txt."
Small automations like this are lifesavers. But here’s the thing you need to watch out for: if you don’t manually inspect the results, you’ll miss that one critical "hidden" folder that holds the keys to the kingdom.
GitHub: A Developer’s Best Friend (And Their Worst Nightmare)
Developers sometimes get rushed, or they think "no one will ever see this," and they end up uploading some seriously sensitive stuff to GitHub. During a pentest last year, I found a dev who had accidentally committed their .bash_history file to a repo. Inside that file, AWS keys and database passwords were just sitting there in plain sight.
When you’re doing OSINT on GitHub, don't just look at the official company organization. Crawl the personal accounts of the employees too. A guy might come home from work, tinker with a piece of a project, and accidentally hardcode a company API key into the code. In my opinion, this is where tools like trufflehog or gitleaks really shine to catch those accidental secrets before the bad guys do.