Passive Reconnaissance with OSINT Tools

Hello! Welcome to the third lesson in your journey to becoming a professional penetration tester.

In our last lesson, we established the critical importance of following a structured methodology like PTES. You learned that every professional engagement begins with a well-defined Intelligence Gathering phase. Today, we put that theory into action.

This lesson addresses the learning outcome: Perform passive reconnaissance using open-source intelligence (OSINT) techniques like Google dorking and public code repository analysis. We will explore how to uncover a wealth of information about a target without sending a single packet to their servers. This is the art of passive reconnaissance—finding what's already publicly available but hidden in plain sight. Mastering these techniques is fundamental for identifying initial attack vectors in both penetration tests and bug bounty hunting.

1. Passive Reconnaissance: The Art of Listening

Before we dive into the techniques, it's crucial to understand the principle of passive vs. active reconnaissance.

• Passive Reconnaissance (OSINT): Gathering information from publicly available sources. You are not interacting with the target's infrastructure directly. Think of it as researching a company using public records, news articles, and social media. It's stealthy and leaves no trace.
• Active Reconnaissance: Directly probing the target's systems. This includes activities like scanning their network for open ports or testing their web servers for responses. This is a "louder" activity that can be detected by the target's security systems.

Today, we focus exclusively on the passive approach. Our primary tools will be search engines and public code repositories.

2. Google Dorking: Advanced Searching for Secrets

Google's indexing capabilities are incredibly powerful, not just for finding information, but for uncovering security-relevant data that shouldn't be public. Google dorking (or Google hacking) is the technique of using advanced search operators to find this information.

To get started, watch the following video from NahamSec, a well-known figure in the bug bounty community. He provides a great practical introduction to the core concepts.

Core Google Dorking Operators

Based on the video and to build on it, here are the essential operators you need to master. You can combine them to create highly specific and powerful queries.

• site:[domain]: Restricts the search to a specific domain or TLD.
  • Example: site:example.com searches only within example.com.
  • Example: site:*.example.com searches all subdomains of example.com.
• inurl:[keyword]: Finds pages with a specific keyword in the URL.
  • Example: inurl:login finds pages with "login" in their URL.
• intitle:[keyword]: Finds pages with a specific keyword in their HTML title.
  • Example: intitle:"admin dashboard" finds pages with that exact phrase in the title.
• filetype:[extension] or ext:[extension]: Searches for specific file types.
  • Example: filetype:pdf finds PDF files.
  • Example: ext:sql finds SQL dump files.
• - (minus sign): Excludes a term from the search results.
  • Example: site:*.example.com -www excludes results from the www subdomain.
• "" (double quotes): Searches for an exact phrase.
  • Example: "Error connecting to database" finds pages with that exact error message.
• * (wildcard): Acts as a placeholder for one or more words.

The real power comes from combining these operators. The following article provides excellent, practical examples of dorks used in bug bounty hunting.

3. Public Code Repository Analysis

Developers often use version control systems like Git and host their code on public platforms like GitHub. Due to mistakes or a lack of awareness, they sometimes accidentally commit sensitive information directly into the codebase. This can include:

• API keys and authentication tokens
• Database connection strings with usernames and passwords
• Private SSH keys
• .env files containing application secrets

Finding these is a high-impact discovery for any bug bounty hunter. Your background in computer science and familiarity with reading code gives you a significant advantage here.

Manual and Automated GitHub Reconnaissance

The following video provides an excellent, up-to-date overview of how to hunt for secrets on GitHub, covering both manual searching and automated tools.

Key Techniques for GitHub Recon

As shown in the video, your approach to GitHub recon can be broken down into a few key areas.

1. Manual Searching with Keywords and Filters

GitHub's search functionality is your primary tool. You can search across all of GitHub or scope your search to a specific organization using org:[organization_name].

The key is to use a good list of search terms. For example:
"megacorp.com" password
"megacorp.com" api_key
"megacorp.com" secret_key
org:megacorp db_password
path:.env "DB_PASSWORD"

2. Understanding the Logic of Automated Scanners

Tools like TruffleHog, mentioned in the video, automate this process. They work by cloning repositories and searching the entire commit history for strings that match certain patterns.

Given your Python skills, it's valuable to understand how these tools work under the hood. The following article demonstrates building a simple Python scanner. You don't need to code this now, but understanding the logic is key.

Understanding this logic helps you create your own custom searches and tools later on. The goal is not just to find secrets, but to understand why they are being exposed. Often, it's because developers hardcode them instead of using a secure secret management system.

3. Discovering Exposed .git Directories

Sometimes, developers accidentally deploy an entire .git directory to a live web server. This directory contains the complete history of the repository. If you can access it (e.g., http://example.com/.git/), you can use tools like git-dumper (as shown in the video) to download the entire source code and its history, which may contain sensitive information removed in later commits.

This is a critical finding because it exposes not just the current code, but all previous versions, including any secrets that were ever committed.

Conclusion

You have now taken your first practical steps in the "Intelligence Gathering" phase. By mastering passive reconnaissance techniques, you can build a detailed picture of your target's potential weaknesses before you even make direct contact.

Key Takeaways:

• Passive reconnaissance is about gathering information from public sources without directly interacting with the target's systems.
• Google dorking uses advanced search operators to find sensitive files, login pages, and error messages that have been indexed by search engines.
• Public code repositories like GitHub can be a goldmine for leaked credentials, API keys, and other secrets accidentally committed by developers.
• Effective reconnaissance combines manual investigation with the use of automated tools to cover a wide attack surface efficiently.

Next Lesson Preview:
We've gathered intelligence from a safe distance. In the next lesson, we will move from passive to active reconnaissance. You will learn how to conduct active network discovery using tools like Nmap to identify live hosts and open ports. This is where we begin to "knock on the doors" of the target's network to see what's open and listening.