Reconnaissance and OSINT: what you leak and how to reduce it
In short: Reconnaissance is the information-gathering stage before an attack or test. Open source intelligence (OSINT) uses public sources such as websites, DNS, certificate logs and social media. Defenders should look at their own footprint the same way and reduce what is exposed.
Why reconnaissance matters
Attackers rarely start by attacking. They start by learning: who works where, what technology is used, which systems face the internet and how emails are formatted. This stage is called reconnaissance or footprinting. Good reconnaissance makes later attacks quicker and more convincing, so understanding it helps you defend.
Open source intelligence (OSINT) is information collected from publicly available sources. "Open source" here means publicly accessible, not open source software.
Passive and active
Passive reconnaissance uses sources that never touch the target's systems: search engines, company websites, social media, public DNS datasets, business registries and certificate transparency (CT) logs, which publicly record every certificate issued and therefore reveal many subdomain names. Active reconnaissance interacts with the target, for example querying its DNS servers, browsing its web servers or scanning ports. Active work can be detected and logged, and against systems you do not own it needs permission.
In an authorised test, the scope document should say whether active techniques and people-focused OSINT are allowed.
What organisations leak
- People: staff profiles on professional networks reveal names, roles and reporting lines, ideal for crafting phishing emails.
- Technology: job adverts asking for experience with specific firewall or VPN products tell an attacker what to research.
- Infrastructure: DNS records, CT logs and old subdomains reveal forgotten test servers.
- Documents: PDFs and Office files often keep metadata such as usernames, software versions and internal paths.
- Code: public code repositories sometimes contain API keys, passwords or internal hostnames.
- Breach data: email addresses and passwords from other sites' breaches are reused in credential stuffing.
A few safe, passive lookups you can run against your own domain:
dig example.com NS +short
dig example.com MX +short
dig example.com TXT +short
whois example.com
exiftool report.pdfReducing your footprint
- Run OSINT against your own organisation regularly, ideally before attackers do.
- Remove unused DNS records and decommission old subdomains properly.
- Strip metadata from documents before publishing them.
- Scan code repositories for secrets and rotate any that leak.
- Give staff guidance on what to share publicly about their work.
- Use generic role addresses for public contacts where possible.
- Monitor breach notification services for company email addresses.
Tip: you cannot hide everything, and you should not try. Assume attackers know your staff names and email format, and make sure MFA and phishing defences cope with that.
Practice
Is looking up a company in certificate transparency logs passive or active reconnaissance?
Why might a job advert be useful to an attacker?
Name two actions that reduce what an organisation leaks publicly.
Key takeaways
- Reconnaissance gathers information to plan an attack or a test.
- Passive methods use public sources; active methods touch the target and need permission.
- Common leaks: staff details, technology choices, DNS, certificates, metadata and code.
- Defenders should run OSINT on themselves and reduce what is exposed.
- Assume basic details are public and build defences that cope.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.