Back to Details

domain-osint

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Domain OSINT

域名OSINT

Map a domain's attack surface and ownership from public sources. Input: a domain, hostname, or IP. Passive by default — no scanning of the target's systems without written authorization.
从公开来源映射域名的攻击面和所有权信息。输入：域名、主机名或IP。默认采用被动方式——未经书面授权，不得扫描目标系统。

Step 1 — Authorized scope

步骤1 — 授权范围

Read ../../ETHICS.md. Passive lookups (DNS, CT logs, archives) are generally fine; active scanning/probing needs authorization. Note the scope and stay on the passive side unless cleared. Done when noted.
阅读../../ETHICS.md。被动查询（DNS、CT日志、归档文件）通常是合规的；主动扫描/探测需要授权。记录范围，除非获得许可，否则仅进行被动操作。完成标志：已记录范围。

Step 2 — Ownership & records

步骤2 — 所有权与记录

Run 
whois-dns-recon
: WHOIS/RDAP registrant and dates, nameservers, MX, SPF/ DKIM/DMARC, and full DNS record set. Note the registrar and hosting ASN. Done when registration and DNS records are captured with lookup timestamps.
运行
whois-dns-recon
：获取WHOIS/RDAP注册人信息、日期、域名服务器、MX记录、SPF/DKIM/DMARC以及完整DNS记录集。记录注册商和托管ASN。完成标志：已捕获包含查询时间戳的注册信息和DNS记录。

Step 3 — Expand the surface

步骤3 — 扩展攻击面

Enumerate subdomains and related assets:
  • certificate-transparency
    — crt.sh and CT logs reveal subdomains and sibling domains sharing certs (often the strongest passive source).
  • Passive DNS and subdomain sources (SecurityTrails, 
    amass -passive
    , 
    subfinder
    ).
  • shodan-censys-recon
    — hosts, open ports, banners, and tech stack for the discovered IPs, all from third-party scan data.
Done when subdomains and associated IPs/services are listed.
枚举子域名和相关资产：
  • certificate-transparency
    — 通过crt.sh和CT日志发现共享证书的子域名和关联域名（通常是最可靠的被动数据源）。
  • 被动DNS和子域名数据源（SecurityTrails、
    amass -passive
    、
    subfinder
    ）。
  • shodan-censys-recon
    — 从第三方扫描数据中获取已发现IP的主机信息、开放端口、横幅和技术栈。
完成标志：已列出子域名及相关IP/服务。

Step 4 — Content, tech & history

步骤4 — 内容、技术栈与历史记录

  • Tech stack — Wappalyzer/BuiltWith, response headers, favicon hash.
  • History — 
    wayback-archives
    for old pages, staff, and exposed paths; 
    google-dorking
    for indexed sensitive files.
  • Code — 
    github-git-recon
    for repos, configs, and leaked secrets tied to the domain.
Done when the tech stack, notable historical content, and any code exposure are documented.
  • 技术栈 — 使用Wappalyzer/BuiltWith、响应头、图标哈希值。
  • 历史记录 — 通过
    wayback-archives
    获取旧页面、员工信息和暴露路径；通过
    google-dorking
    查找已索引的敏感文件。
  • 代码 — 通过
    github-git-recon
    查找与该域名关联的代码仓库、配置文件和泄露的密钥。
完成标志：已记录技术栈、重要历史内容以及任何代码暴露情况。

Step 5 — Pivot to owners

步骤5 — 关联至所有者

Pivot registrant emails/orgs to 
email-osint
/ 
company-osint
, and reused analytics/AdSense IDs or favicon hashes to find sibling sites. Done when owner-side selectors are followed or ruled out.
将注册人邮箱/组织关联至
email-osint
/
company-osint
，并通过重复使用的分析/AdSense ID或图标哈希值查找关联站点。完成标志：已追踪或排除所有者相关关联项。

Step 6 — Report

步骤6 — 生成报告

Run 
osint-report
. Include an asset inventory (domain → subdomains → IPs → services) and note anything that looks unintentionally exposed.
运行
osint-report
。包含资产清单（域名→子域名→IP→服务），并记录任何看似意外暴露的内容。