OSINT Recon Techniques & Tools for 2026

In early 2026, threat actors compromised a mid-sized logistics firm by pivoting from a single exposed Jenkins instance discovered through passive OSINT — no scanning, no noise, just public data. The entire initial access phase took under 20 minutes. That’s the gap this post closes.

Harvesting Emails and Subdomains with theHarvester

theHarvester is a command-line tool that pulls emails, subdomains, IPs, and URLs from public sources like Google, Bing, and LinkedIn. It’s the first tool most red teamers run against a target domain — and it’s free.

Here’s a real-world style run against a fictional target, nexalogix.com:

$ theHarvester -d nexalogix.com -b google,bing,linkedin,certspotter -l 200 -f nexalogix_harvest

[*] Target: nexalogix.com
[*] Sources: google, bing, linkedin, certspotter

[*] Emails found:
  j.mercer@nexalogix.com
  devops@nexalogix.com
  support@nexalogix.com
  admin@nexalogix.com

[*] Subdomains found:
  vpn.nexalogix.com
  jenkins.nexalogix.com
  staging.nexalogix.com
  mail.nexalogix.com
  api-dev.nexalogix.com

[*] IPs found:
  192.0.2.44
  192.0.2.107
  192.0.2.212

That output is a goldmine. jenkins.nexalogix.com and api-dev.nexalogix.com are high-value targets — both suggest internal tooling exposed to the internet. admin@nexalogix.com and devops@nexalogix.com are likely service accounts worth targeting in a phishing or credential-stuffing scenario.

Your next move: feed those subdomains into a DNS resolver like dnsx to confirm which are live, then pass the live IPs to Shodan or Censys for service fingerprinting. Don’t touch the hosts yet — stay passive.

Finding Exposed Services with Shodan CLI

Shodan is a search engine for internet-connected devices. The CLI lets you query it programmatically — no browser needed. Install it with pip install shodan and initialize with your API key.

Let’s say you confirmed jenkins.nexalogix.com resolves to 192.0.2.107. Here’s what a Shodan host lookup returns:

$ shodan host 192.0.2.107

IP: 192.0.2.107
Organization: NexaLogix Inc.
Operating System: Ubuntu 22.04
Ports:
  22/tcp   OpenSSH 8.9p1
  443/tcp  nginx 1.24.0
  8080/tcp Jetty 9.4.51 (Jenkins 2.387.1)

Vulnerabilities:
  CVE-2024-23897  (Jenkins arbitrary file read, CVSS 9.8)
  CVE-2023-27898  (Jenkins XSS)

Last Updated: 2026-10-11T14:22:03

CVE-2024-23897 is a critical Jenkins arbitrary file read vulnerability — publicly weaponized, with PoC exploit code available on GitHub since early 2024. Shodan has already fingerprinted this host and flagged it. An attacker sees this and knows they have a near-certain path to credential extraction from Jenkins config files.

A defender seeing this output needs to act in the next hour, not the next sprint. The host is already indexed. Patch Jenkins immediately, restrict port 8080 to VPN-only access via firewall rules, and rotate any secrets stored in Jenkins credentials store. Run shodan alert create --name nexalogix-monitor 192.0.2.0/24 to get notified the moment Shodan re-scans your range and detects changes.

Mapping Relationships with Maltego and Public Data

Maltego is a visual link-analysis platform that transforms raw OSINT data — emails, domains, IPs, usernames — into relationship graphs. The Community Edition is free and handles most recon tasks.

Starting from j.mercer@nexalogix.com, a Maltego run using built-in transforms might produce this entity chain:

j.mercer@nexalogix.com
  └─ [HaveIBeenPwned Transform]
       └─ Breach: LinkedIn 2021, Gravatar 2023
            └─ Username: jmercer_nx
                 └─ [Social Links Transform]
                      ├─ GitHub: github.com/jmercer-nx
                      │    └─ Repos: nexalogix-infra (public!)
                      └─ Twitter/X: @jmercer_devops
                           └─ Post: "finally got our K8s dashboard
                                     working on port 10902 🚀" (2026-08-14)

This is how attackers pivot without ever touching the target network. A public GitHub repo named nexalogix-infra likely contains Terraform configs, internal hostnames, and possibly hardcoded secrets. The tweet leaks an internal Kubernetes dashboard port. Both findings require zero exploitation — just observation.

Defenders should run this exact workflow against their own organization quarterly. If you find a public employee repo containing infrastructure code, treat it as a critical finding. Archive it privately, rotate any exposed secrets immediately, and brief the employee. GitHub’s secret scanning alerts help, but they miss context that human review catches.

What To Do Now

Pick your own domain and run theHarvester against it right now: theHarvester -d yourdomain.com -b google,certspotter -l 100. Look at what comes back. Check every subdomain against Shodan. If you see anything unexpected — an old staging server, a forgotten admin panel, an unpatched service — that’s your attacker’s entry point before it becomes a breach report. Fix it today.