Blog · Engineering
🔧 Engineering & Security

OSINT for Cybersecurity Recon: Mapping Your External Attack Surface

Daniel Ehrlich · May 2026 · 12 min read

The first principle of defending a network is knowing what's actually on it. The second principle is knowing what the rest of the world can see of it. OSINT is the discipline that answers the second question, and for a defender it's not optional — an attacker is already doing this work, and if your inventory is worse than theirs, you're already behind.

This post is for blue teams, security engineers, IT managers, and founders who own the security of a real system. It's about turning the public OSINT toolkit inward — finding what an external attacker would find about your organization before they do.

Why defenders need OSINT

Three forces have pushed external reconnaissance from "occasional pentest activity" to "continuous defensive practice":

The discipline that addresses this is Attack Surface Management (ASM). Commercial ASM platforms exist; the OSINT toolkit accomplishes a large portion of the same job manually.

External attack surface management

Conceptually, ASM has four loops:

  1. Discovery — find all assets owned by the organization (domains, subdomains, IPs, cloud resources, code repos, mobile apps, social-media presences).
  2. Enumeration — for each asset, identify open ports, services, technologies, certificates, and exposed content.
  3. Risk scoring — correlate against known vulnerabilities, misconfigurations, and exposure patterns.
  4. Continuous monitoring — re-run all of the above on a schedule and alert on deltas.

The OSINT side covers loops 1 and 2 thoroughly, and contributes data to 3 and 4.

Asset discovery workflow

Start with what you know and pivot outward.

Domain inventory

IP space inventory

Brand and infrastructure pivots

Subdomain enumeration

This is where most defensive ASM gaps appear. The typical enterprise has 5-20x more subdomains than the security team thinks. Approaches in order of yield:

  1. Certificate transparency. crt.sh or Censys CT for the parent domain. Every cert ever issued returns matching subjects + SANs. Often 80%+ of your real subdomain inventory.
  2. Passive DNS. Historical DNS data from SecurityTrails, PassiveTotal, Mnemonic, RiskIQ. Finds subdomains that have ever resolved, even if they no longer do.
  3. Wordlist brute-forcing. Tools like amass, subfinder, or massdns with a curated wordlist (e.g. SecLists) and a list of resolvers.
  4. JavaScript and source map analysis. Static analysis of your own public JavaScript often reveals API hostnames, CDN endpoints, and dev URLs hardcoded in the bundle.
  5. GitHub / GitLab dorking for your domain name turns up forgotten internal hostnames in code or config files.
  6. Cloud metadata — querying AWS Route 53, Azure DNS, GCP Cloud DNS APIs from inside your own accounts captures every record you've authoritatively published.

The combined list — dedupe across all sources — is your authoritative subdomain inventory. Compare it to your CMDB / asset database. The diff is your shadow IT.

Ports, services, and tech fingerprinting

For each discovered host, you want:

Three OSINT services cover most of this without you having to scan anything yourself:

When you need fresher data than these caches provide, you actively scan your own assets with permission — nmap, masscan, naabu for port discovery; nuclei for templated vuln checks; httpx for HTTP probing.

Leaked credentials and breach data

An attacker's first probe is usually credential reuse against your assets. Your defensive job is to know which credentials are out there before they try.

When a corporate credential surfaces in any of the above, the playbook is immediate: force a password rotation on that user, audit for session reuse in recent logs, check for MFA bypass attempts.

Threat intelligence feeds

Beyond your own attack surface, you want awareness of threats targeting your industry, region, or tech stack:

Continuous monitoring

Discovery once is not enough. The attack surface drifts every day — new subdomains spin up, certs expire, ports open, ports close. Continuous monitoring is the practice.

A workable cadence:

Alert on deltas, not totals. The signal is "this is new since yesterday," not "this exists." Otherwise you drown in noise.

Blue-team playbook

  1. Inventory all owned domains and IP blocks across registrars and cloud providers.
  2. Run CT-log subdomain discovery weekly. Diff vs last week.
  3. Cross-reference subdomain inventory against your CMDB. Investigate the diff.
  4. Run external port/service scans monthly against the full IP inventory.
  5. Match every service banner against current CVE feeds; prioritize KEV-list CVEs.
  6. Subscribe to a domain-monitoring breach feed.
  7. Subscribe to threat intelligence relevant to your industry and tech stack.
  8. Monitor for newly-registered domains that impersonate your brand.
  9. Establish a fast remediation path for findings — OSINT discovery without a remediation workflow is theater.
  10. Document the program. When the board asks "how do we know we don't have shadow IT," your answer is this program.

For the foundations, see What Is OSINT?. For specific tooling, see Shodan.io, Google Dorks, and the OSINT Toolkit. For pivoting from infrastructure to people, see Username & Email OSINT. For defending against OSINT done against you, see OSINT Privacy Defense.

Sources & References
  1. CISA — Known Exploited Vulnerabilities catalog
  2. MITRE — ATT&CK Framework
  3. SANS — SANS Internet Storm Center
  4. crt.sh — Certificate Transparency search
Keep Reading
Engineering
What Is OSINT?
Engineering
Shodan.io Explained
Engineering
OSINT Privacy Defense
Engineering
OSINT Legal & Ethics