OSINT Research Hub › Defensive Privacy
Mapping Your Organization’s Attack Surface with OSINT
Passive, open-source reconnaissance a business can run on its own domains, services, documents and staff exposure to find weaknesses before attackers do.
Your organization only
Attackers start with open-source reconnaissance, so defenders should too. This guide covers passive techniques: reading public information about domains and services you own or are authorized to assess. It does not cover scanning, probing or logging in to anything. Testing systems without written authorization can be an offence under section 342.1 of the Criminal Code.
Domains and subdomains
Certificate transparency logs record every public TLS certificate, so a search on crt.sh for your domain reveals subdomains you may have forgotten: old test sites, staging servers and abandoned campaign pages. Review your DNS records and the RDAP or WHOIS registration details for each domain, and make sure renewal contacts are current.
Exposed services
Search engines for internet-connected devices, such as Shodan and Censys, show what your public IP addresses expose: remote desktop, databases, cameras, outdated web servers. Look, do not touch. Anything there that should not be public goes to the top of your fix list.
Email and impersonation
- Check that every domain has SPF, DKIM and a DMARC policy, including domains that never send email.
- Use a tool such as dnstwist to find lookalike domains that could be used to phish your customers or staff.
Leaks and documents
- Have I Been Pwned’s domain search shows which staff addresses appeared in breaches.
- Search public code repositories for your company name and domains to catch leaked keys or internal URLs.
- Search your own site with
site:yourdomain.com filetype:pdf(and docx, xlsx) and check document metadata, which often reveals usernames, software versions and internal paths.
People exposure
Staff lists, job postings and org charts tell attackers who to phish and what software you run. You do not need to hide your team, but train staff to expect targeted phishing, keep job postings free of internal system details, and have a clear way to report suspicious messages.
Turn findings into fixes
Record each finding in a risk register with its severity, owner and fix date. Fix the exposed services and missing email protections first, then retire forgotten subdomains. Repeat the mapping every quarter.