> ## Documentation Index
> Fetch the complete documentation index at: https://docs.d0pam1ne.blackhatethicalhacking.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OSINT

> Map the target's public exposure before you touch it: ASNs, people, exposed assets, dorks, email security, and breach data, stage by stage.

**OSINT** maps what the target exposes to the world, before any active testing. It is the stage below recon: autonomous systems, people and emails, assets exposed on the internet, search-engine dorks, email-security posture, and breach and infostealer data, gathered from public sources and filed into the OSINT area of Project Data. Everything stays in scope and nothing here touches a client host.

![The OSINT plan: stages, tools and what each needs](https://mintcdn.com/black-hat-ethical-hacking/RPEWzJ10O7hxCV8s/images/osint/osint-setup.webp?fit=max\&auto=format\&n=RPEWzJ10O7hxCV8s\&q=85\&s=9d28a890d2981af7fc180a2448e14760)

The OSINT plan: stages, tools and what each needs

## The stages

Each stage runs only if its tool is installed (or runs in-process), and lists itself as skipped otherwise.

| Stage | What it finds | Tool | Needs |
| - | - | - | - |
| **ASN and ranges** | The client's autonomous systems and owned IP ranges | asnmap | free PDCP key |
| **People and emails** | Emails, names and hostnames across public sources | theHarvester | nothing |
| **Subdomains from code** | Hostnames leaked in public GitHub code | github-subdomains | `GITHUB_TOKEN` |
| **Exposed assets** | Hosts, IPs and services exposed on the internet | uncover | one of Shodan / Censys / FOFA / ZoomEye |
| **Dorks and passive OSINT** | Search-engine dorks and passive discovery | d0rkerr3con (BHEH) | nothing |
| **Email security** | SPF, DMARC and DKIM posture over DNS | in-process | nothing |
| **Breach and infostealer exposure** | Machines and credentials in infostealer logs, per-email exposure | Hudson Rock Cavalier, holehe, optional HIBP | nothing (HIBP key optional) |

![OSINT running, streaming results](https://mintcdn.com/black-hat-ethical-hacking/RPEWzJ10O7hxCV8s/images/osint/osint-running.webp?fit=max\&auto=format\&n=RPEWzJ10O7hxCV8s\&q=85\&s=c95e8563768f830e66f65b47618efc58)

OSINT running, streaming results

## Private and keyless where it counts

* **Email security** runs entirely in-process over DNS: nothing leaves your machine.
* **Breach and infostealer** exposure uses Hudson Rock's keyless Cavalier API and `holehe`; leaked passwords and logins are **never stored**.
* The **people and emails** stage queries long-standing public sources only.

## Running it

Start OSINT and the pipeline runs stage by stage, streaming items filed and output lines, exactly like recon and attacks. Results land in Project Data's OSINT tab, where you can flag items and carry them into a report.

> [!NOTE]
>
> OSINT is a Pro feature and works from your in-scope domains. Add the optional API keys under [Settings](/admin/api-keys.md) to reach more sources; without them, the keyless stages still run.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.