Reconnaissance passive — OSINT

# WHOIS
whois {{TARGET_DOMAIN}} | tee {{OUTPUT_DIR}}/whois.txt
# DNS records
dig {{TARGET_DOMAIN}} ANY
dig {{TARGET_DOMAIN}} A
dig {{TARGET_DOMAIN}} MX
dig {{TARGET_DOMAIN}} NS
dig {{TARGET_DOMAIN}} TXT
dig {{TARGET_DOMAIN}} AXFR ns1{{TARGET_DOMAIN}}  # Zone transfer (si vulnérable)
# Historique DNS
host {{TARGET_DOMAIN}}
nslookup -type=any {{TARGET_DOMAIN}}

# Subfinder (passif)
subfinder -d {{TARGET_DOMAIN}} -o {{OUTPUT_DIR}}/subdomains.txt -silent
# Amass (passif)
amass enum -passive -d {{TARGET_DOMAIN}} -o {{OUTPUT_DIR}}/amass-subs.txt
# theHarvester
theHarvester -d {{TARGET_DOMAIN}} -b googlebingcrtshshodan -f {{OUTPUT_DIR}}/harvester
# Certificate Transparency (crt.sh)
curl -s "https://crt.sh/?q=%25.{{TARGET_DOMAIN}}&output=json" | jq -r '.[].name_value' | sort -u > {{OUTPUT_DIR}}/crt-subs.txt

# Index complet du domaine
site{{TARGET_DOMAIN}}
# Sous-domaines
site{{TARGET_DOMAIN}}
# Fichiers sensibles exposés
site{{TARGET_DOMAIN}} extpdf OR extxlsx OR extdocx OR extsql
site{{TARGET_DOMAIN}} extenv OR extbak OR extconfig OR extini
# Pages de login
site{{TARGET_DOMAIN}} intitle"login" OR intitle"admin" OR inurl"/admin"
# Erreurs et info disclosure
site{{TARGET_DOMAIN}} intext"error" OR intext"warning" OR intext"stack trace"
# Credentials leakés
site{{TARGET_DOMAIN}} intext"password" OR intext"passwd" OR intext"credential"
# Caméras / IoT
intitle"webcam" site{{TARGET_DOMAIN}}

# Recherche par domaine
shodan search "hostname:{{TARGET_DOMAIN}}"
# Recherche par IP/org
shodan host {{TARGET}}
shodan search "org:{{TARGET_DOMAIN}}"
# Services spécifiques
shodan search "hostname:{{TARGET_DOMAIN}} port:22"
shodan search "hostname:{{TARGET_DOMAIN}} http.title:admin"
# Avec shodan CLI
shodan init YOUR_API_KEY
shodan domain {{TARGET_DOMAIN}}

# theHarvester pour emails
theHarvester -d {{TARGET_DOMAIN}} -b googlelinkedinhunter -f {{OUTPUT_DIR}}/emails
# Hunter.io (API)
curl "https://api.hunter.io/v2/domain-search?domain={{TARGET_DOMAIN}}&api_key=YOUR_KEY"
# Recherche LinkedIn manuelle
sitelinkedincom "{{TARGET_DOMAIN}}"
sitelinkedincom/in "{{TARGET_DOMAIN}}" "IT" OR "security" OR "admin" OR "network"

# WhatWeb
whatweb {{TARGET_DOMAIN}} -v
# Wappalyzer CLI
wappalyzer {{TARGET_DOMAIN}}
# BuiltWith (web)
# https://builtwith.com/{{TARGET_DOMAIN}}
# Netcraft (web)
# https://sitereport.netcraft.com/?url={{TARGET_DOMAIN}}

# GitHub search (manuel)
# site:github.com "{{TARGET_DOMAIN}}"
# site:github.com "{{TARGET_DOMAIN}}" password
# site:github.com "{{TARGET_DOMAIN}}" secret
# GitLeaks sur repo cloné
gitleaks detect --source /repo --report-path {{OUTPUT_DIR}}/gitleaks.json
# TruffleHog
trufflehog github --org={{TARGET_DOMAIN}} --token=YOUR_TOKEN