Course 8 - Penetration Testing OSINT Gathering with Recon-ng | Episode 3: Harvesting Data, Optimizing Contacts, Geolocation
Update: 2025-11-17
Description
In this lesson, you’ll learn about: Conducting a Multi‑Stage OSINT Campaign Using Recon‑ng 1. Initial Data Harvesting & Database Population The OSINT campaign begins by creating a dedicated workspace and planning the stages of information gathering. The first objective is to populate core database tables—contacts and hosts. Contact Gathering
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
- whois_pocs module collects domain registration information, extracting email addresses and owner details.
- PGP search modules identify additional contacts by searching for PGP keys associated with the target domain.
- bing_domain_web module scans the domain to enumerate subdomains and hostnames.
- brute_hosts module brute‑forces common hostnames to uncover additional active hosts not found through search engines.
- Once the hosts table is filled, the interesting_files module scans discovered hosts for publicly accessible files such as:
- sitemap.xml
- phpinfo.php
- Test files
These files may contain operational details useful for further analysis.
- The mangle module builds complete email addresses using partial names and organizational naming patterns.
- It combines first/last names with the domain to produce likely valid addresses.
- hibp_breach module checks if collected or constructed emails were exposed in known credential leaks.
- hibp_paste module searches paste sites for leaked emails or credentials.
- Any hits are stored in the credentials table for responsible reporting and remediation.
- The resolve module converts hostnames into IP addresses and updates host entries.
- The free_geoip module geolocates IPs, revealing the server’s approximate city, region, and country.
- Location details are appended to the host’s database record.
- When a Shodan API key is available:
- Latitude/longitude data is used by the shodan module to gather additional OSINT such as services, banners, and exposed ports.
- The BuiltWith module identifies:
- Web technologies (e.g., Apache, Nginx, Ubuntu)
- Infrastructure providers (e.g., AWS)
- Associated tools (jQuery, New Relic, Analytics services)
- For large domains, the scan may return hundreds of data points, greatly enriching the OSINT profile.
- Administrative contacts
- Social media integrations
- CDN details
- Heat‑mapping and analytics tools (e.g., Mouseflow)
- Optimization platforms (e.g., Optimizely)
- Populate key database tables
- Form accurate contact and host profiles
- Identify data breaches ethically
- Geolocate infrastructure
- Profile the full technology stack of a target domain
You can listen and download our episodes for free on more than 10 different platforms:
https://linktr.ee/cybercode_academy
Comments
In Channel
Download from Google Play
Download from App Store
United States00:00
00:00
x
