Passive OSINT reconnaissance for a single domain: subdomain enumeration, live host discovery, subdomain takeover checks, WHOIS, IP geolocation, and JavaScript secret scanning, all from public sources. Nothing in this script sends exploit traffic or actively probes target services.

OSINT RECON

What it does

  1. Subdomain enumeration — subfinder + certificate transparency logs via crt.sh, merged and deduplicated
  2. Live host discovery — httpx checks each subdomain for status code, title, detected tech, and resolved IP
  3. Subdomain takeover check — subzy flags dangling CNAMEs and known takeover fingerprints
  4. JS secret scanning — pulls historical JS files from the Wayback Machine and greps them for exposed API keys, tokens, and credentials
  5. WHOIS — registrar, registrant org, address, phone (when not redacted by the registrar/privacy proxy), creation/expiry dates
  6. Passive IP geolocation — every live host's IP (plus the domain's main IP) is deduplicated and geolocated in a single batched request to ip-api.com — city, region, country, ISP, and ASN

Everything lands in a per-domain output directory as both raw files and a formatted summary.txt.

Requirements

Tool Purpose Install
subfinder Subdomain enumeration go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest
httpx Live host probing go install github.com/projectdiscovery/httpx/cmd/httpx@latest
subzy Takeover detection go install github.com/PentestPad/subzy@latest
waybackurls Wayback Machine URL pull go install github.com/tomnomnom/waybackurls@latest
curl HTTP requests apt install curl
jq JSON parsing apt install jq
dig DNS resolution apt install dnsutils
whois Domain registration lookup apt install whois

All of the above ship in Kali Linux by default or install in one line. toilet is optional — the banner falls back to plain text if it's not installed.

Installation

git clone https://github.com/th3cyb3rguy/osint-recon.git
cd osint-recon
chmod +x recon.sh

Usage

./recon.sh <domain> [output_dir]
  • domain — target domain to scan (required)
  • output_dir — where to save results (optional). If you skip it, the script will prompt you at runtime with a generic default (./osint-recon-output) — no path is hardcoded.
./recon.sh example.com
./recon.sh example.com /home/user/recon-results

Sample output

══════════════════════════════════════════════════════════════════
                  Passive OSINT Recon Summary
══════════════════════════════════════════════════════════════════

Target               : example.com
Output Directory     : ./osint-recon-output/example.com
Scan Duration        : 00m 56s

Registrar            : Example Registrar, LLC
Registrant Org       : Redacted/Unknown
Registrant Address   : Redacted/Unknown
Registrant Phone     : Redacted/Unknown

Main IP Address      : 93.184.216.34
Geolocation          : Norwell, Massachusetts, United States
ISP / ASN            : Edgecast Inc. (AS15133 Edgecast Inc.)
Unique Live IPs      : 14 (see ip_geolocation.txt)

Subfinder Results    : 41
crt.sh Results       : 0
Unique Subdomains    : 22
Live Hosts           : 14

Takeover Candidates  : ✓ None
JavaScript Files     : 136
Secrets Found        : ✓ None

Overall Status       : PASS
════════��═════════════════════════════════════════════════════════

Output files

File Contents
target_info.txt Domain, main IP, WHOIS summary, geolocation
whois.txt Full raw WHOIS response
ip_geolocation.txt Every unique live IP, which hostnames share it, and its geolocation/ISP
subdomains.txt Deduplicated subdomain list (subfinder + crt.sh)
live_hosts.txt Live hosts with status, title, tech, IP
takeover_vuln.txt Potential subdomain takeover candidates
takeover_subzy_raw.log Raw subzy output
js_files.txt JS file URLs pulled from the Wayback Machine
secrets.txt / secrets_unique.txt Potential secrets found in JS files
summary.txt The formatted dashboard shown above
recon.log Full run log

Ethical use

This tool is built for passive reconnaissance only — it queries public data sources (DNS, certificate transparency, WHOIS, the Wayback Machine, third-party IP databases) and never sends exploit traffic, brute-forces directories, or actively probes target infrastructure beyond a standard HTTP request to check if a host is live. Only run this against domains you own or are explicitly authorized to test.

Roadmap

Planned for a future release: expanded DNS records (MX/TXT/NS/CAA), email security checks (SPF/DMARC/DKIM), security header analysis, TLS certificate details, robots.txt/sitemap collection, favicon hashing, and an HTML report.

Author

Built by th3cyb3rguy

AI was used as an engineering assistant for:

  • brainstorming ideas
  • improving documentation
  • reviewing code
  • suggesting project architecture
  • refining templates

All concept, implementation, testing, and validation were completed manually.