OSINT Reconnaissance Mapper (2D)

OSINT Reconnaissance

Inspect Source

Scan speed 1.0×

Sources queried

0 / 4

Fragments found

Attack-surface coverage

Direct contact w/ target

How it works

OSINT (Open-Source Intelligence) is the practice of assembling a picture of an organization purely from information that is already public — no probing, no login attempts, no packets sent to the target itself.

exposure = Σ fragments(source_i)
attack_surface = merge(subdomains, staff, tech_stack, hostnames)
detectability_by_target ≈ 0   // no request ever reaches them

DNS & subdomains — passive resolvers enumerate hostnames under a domain; a forgotten staging.example.com often runs unpatched software.
Document metadata — published PDFs/Office files embed author names, usernames, and the software that produced them.
Social media profiles — job listings & employee profiles reveal org structure and technology stack.
Certificate Transparency — every public TLS certificate is logged; searching CT logs surfaces internal-sounding subdomains.

Defensive takeaway: none of these techniques touch the target directly — run this same process against yourself to see what an outside observer sees first.

Target organization DNS / subdomains Document metadata Social profiles Certificate Transparency