1. Introduction

Before launching an attack against an organization, the attacker needs information: domains, subdomains, employee emails, technologies used, IP addresses, social media profiles, public repositories… This phase is called reconnaissance, and the tools that feed it are collectively known as OSINT (Open Source Intelligence).

In this article we will explore the most effective OSINT techniques for Red Team Operations in 2026, with a step-by-step hands-on lab. We will cover everything from asset discovery to data correlation, using tools like Nmap, Subfinder, theHarvester and WFUZZ.

2. What is OSINT in Red Team?

OSINT consists of collecting information from public sources to build a detailed profile of the target. Unlike direct hacking, it does not require interacting with internal systems: everything we need is already published on the internet.

In the Red Team context, OSINT allows us to:

• Map the attack surface: domains, subdomains, open ports, exposed services.
• Identify key employees: CTO, developers, system administrators (the best targets for phishing).
• Detect technologies and versions: frameworks, CMS, libraries with known vulnerabilities.
• Find leaked credentials: on GitHub, Pastebin, Shodan, etc.
• Build employee profiles: for personalized social engineering attacks.

3. Setting up the scenario

We will use jaymonsecurity.com as our test target. All tools run from our local machine (Linux with Python 3).

# OSINT tool installation
pip install theHarvester subfinder wfuzz
sudo apt install nmap whois

# Verify installation
nmap --version
python3 -c "import theharvester; print('OK')"

Fig. 1 – Terminal with OSINT tools installed and verified.

4. Asset discovery: domains and subdomains

4.1. Search engine queries (Google Dorking)

The most powerful search engine for OSINT is Google. We use advanced operators:

> site:jaymonsecurity.com -www
# Main subdomains

> site:*.jaymonsecurity.com
# All subdomains

> site:jaymonsecurity.com filetype:pdf
# Public PDF documents

> site:jaymonsecurity.com intext:"password" OR intext:"secret"
# Files with credentials

> site:github.com jaymonsecurity
# Company GitHub repositories

Fig. 2 – Google Dorking results showing discovered subdomains and exposed files.

4.2. Subfinder — Automated discovery

Subfinder queries multiple sources (Shodan, Censys, SecurityTrails, etc.) to find subdomains:

# Run subfinder with all available sources
subfinder -d jaymonsecurity.com -o subdomains.txt -t 50

# View results
cat subdomains.txt | sort -u

This command returns a list of active subdomains discovered through passive databases. It is fast, silent, and requires no authentication.

4.3. Nmap — Port and service scanning

Once we have the subdomains, we scan for open ports:

# Quick scan of common ports
nmap -sV --top-ports 1000 jaymonsecurity.com -oN nmap_quick.txt

# Full scan (slower but exhaustive)
nmap -sS -sV -O -p- jaymonsecurity.com -oN nmap_full.txt

# Scan with detection scripts
nmap --script=vuln,http-enum jaymonsecurity.com -oN nmap_scripts.txt

The -sV flag detects service versions, -O attempts OS detection, and --script=vuln runs vulnerability detection scripts.

5. Employee identification and email discovery

5.1. theHarvester — Emails and names

theHarvester collects email addresses, subdomains, hostnames and IPs from multiple public sources:

# Search emails on LinkedIn, Google, Bing, Shodan
python3 theharvester.py -d jaymonsecurity.com -b all -l 500

# Typical results:
# Emails: admin@jaymonsecurity.com, mike@jaymonsecurity.com...
# Hosts: www.jaymonsecurity.com, blog.jaymonsecurity.com...

Fig. 3 – theHarvester output showing discovered emails and subdomains.

5.2. LinkedIn and social media

We search LinkedIn for profiles with the company name:

> site:linkedin.com/company/jaymon-security
# Company page

> site:linkedin.com "Jaymon Security" employee
# Listed employees

> site:twitter.com jaymonsecurity
> site:github.com jaymonsecurity

From LinkedIn we can extract:

• Full names of employees (for personalized phishing)
• Roles and departments (CTO, DevOps, Security Lead)
• Technologies mentioned in profiles (AWS, Docker, Kubernetes)
• Geographic location

6. Searching for leaked credentials

Developers often leave credentials in public repositories:

# Search GitHub with Google Dorking
> site:github.com jaymonsecurity password OR api_key OR secret

# Use GF (GitHub Fields) to extract credential patterns
gf patterns < subdomains.txt | grep -iE "password|api_key|secret|token"

# Search Pastebin
> site:pastebin.com jaymonsecurity

We can also use Shodan (free with limit) to search for exposed services with default credentials:

# Search on Shodan (API key required)
curl "https://api.shodan.io/shodan/host/search?key=YOUR_API_KEY&query=jaymonsecurity" | python3 -m json.tool

7. Directory and hidden file fuzzing

With WFUZZ we can discover hidden endpoints:

# Basic directory fuzzing
wfuzz -c -z file,/usr/share/wordlists/dirb/common.txt \
  http://jaymonsecurity.com/FUZZ

# Fuzzing with specific extension
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  -H "User-Agent: Mozilla/5.0" \
  http://jaymonsecurity.com/FUZZ

# Filter only 200 responses (existing directories)
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt \
  --hc 404,403 http://jaymonsecurity.com/FUZZ

Fig. 4 – WFUZZ results showing discovered hidden directories.

8. Correlation and reporting

The real value of OSINT lies in correlating the data found:

1. Cross-reference emails with subdomains: if we find mike@jaymonsecurity.com and a subdomain dev.jaymonsecurity.com, Mike is likely a developer.
2. Cross-reference technologies with vulnerabilities: if Nmap detects Apache 2.4.49, search for known CVEs (Log4Shell, etc.).
3. Cross-reference credentials with services: if we find an API key in GitHub and Shodan shows a service exposed on the corresponding port.

The final result is a report that includes:

• Inventory of discovered assets (domains, subdomains, IPs)
• Detect services and versions
• Emails and identified employees
• Leaked credentials
• Hidden directories and files
• Prioritization of targets for the exploitation phase

9. Conclusions

OSINT is the foundation of every successful Red Team operation. With free tools like Nmap, Subfinder, theHarvester and WFUZZ we can build a complete target profile in less than an hour. The key lies in correlation: cross-referencing data from multiple sources to identify the most promising attack vectors.

At Jaymon Security we integrate automated OSINT into every Red Team engagement, using custom tools and CI/CD pipelines to keep asset inventories always up to date. The best defense is knowing your attack surface before the attacker does.

10. References

• Nmap Documentation
• Subfinder — Fast Subdomain Enumeration Tool
• theHarvester — OSINT Gathering Tool
• WFUZZ — Web Fuzzer
• Shodan Search Engine
• MITRE ATT&CK Framework — Reconnaissance (TA0043)

Need help with your security strategy?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.

Contact us for a free infrastructure assessment.