OSINT Tools & Frameworks

# Start SpiderFoot web UI
spiderfoot -l 127.0.0.1:5001
# Navigate to http://localhost:5001

# CLI scan
spiderfoot -s target.com -t all -o html -H report.html

# Specific module scan
spiderfoot -s target.com -m sfp_dnsresolve,sfp_shodan -o json

# Scan with API keys (configure in ~/.spiderfoot/settings)
spiderfoot -s target.com -t all

# Docker deployment
docker run -p 5001:5001 spiderfoot

# Start Recon-ng
recon-ng

# Create workspace for target
workspaces create target_company
db insert domains target.com

# Set API keys
keys add shodan_api YOUR_KEY
keys add censys_id YOUR_ID
keys add censys_secret YOUR_SECRET

# Load and run modules
modules load recon/domains-hosts/hackertarget
run

modules load recon/domains-hosts/certificate_transparency
run

modules load recon/domains-contacts/whois_pocs
run

# Search for modules
modules search subdomain
modules search email

# Export results
modules load reporting/html
options set FILENAME /tmp/report.html
run

# List gathered data
show hosts
show contacts

# Passive enumeration (safe, no direct contact)
amass enum -passive -d target.com -o passive_subs.txt

# Active enumeration (includes DNS resolution)
amass enum -active -d target.com -o active_subs.txt

# Brute force subdomain discovery
amass enum -brute -d target.com -w /path/to/wordlist.txt

# Intel gathering (reverse WHOIS)
amass intel -d target.com -whois

# Track changes over time
amass track -d target.com

# Visualize results
amass viz -d3 -d target.com

# Full configuration file scan
amass enum -config config.ini -d target.com

# Output to database for later analysis
amass enum -d target.com -dir ./amass_output

# Full reconnaissance
./reconftw.sh -d target.com -r

# Subdomain enumeration only
./reconftw.sh -d target.com -s

# Full recon with all modules
./reconftw.sh -d target.com -a

# Multiple targets from file
./reconftw.sh -l targets.txt -r

# Output in specific directory
./reconftw.sh -d target.com -r -o /path/to/output

# Custom configuration
./reconftw.sh -d target.com -r -c custom_config.cfg