OSINT Recon Techniques & Tools That Work in 2026

In early 2026, attackers breached a mid-sized SaaS company without touching a single firewall — they built their entire initial access path from publicly available data: exposed subdomains, a developer's leaked credentials on a paste site, and an internet-facing Jenkins instance indexed by Shodan. The company had no idea how much of their attack surface was already mapped before the first payload fired. This post shows you the exact workflow they used — and how defenders can run it first.

Step 1: Surface Enumeration with theHarvester

theHarvester is a passive reconnaissance tool that pulls emails, hostnames, and IPs from public sources — search engines, DNS records, certificate transparency logs. It's the fastest way to see what an organization has left exposed without sending a single packet to the target.

Run it against your own domain before someone else does:

theHarvester -d acmecorp.io -b all -l 500 -f acmecorp_recon.html

[*] Searching across: Google, Bing, CertSpotter, DNSdumpster, OTX...

[*] Emails found: 14
  j.mercer@acmecorp.io
  devops-alerts@acmecorp.io
  m.chen@acmecorp.io

[*] Hosts found: 23
  staging.acmecorp.io       192.0.2.47
  jenkins.acmecorp.io       192.0.2.83
  api-internal.acmecorp.io  192.0.2.91
  vpn.acmecorp.io           192.0.2.12

That output is a prioritized attack list. jenkins.acmecorp.io and api-internal.acmecorp.io have naming conventions that scream "exposed internal tooling." The emails give you targets for credential stuffing or phishing — and j.mercer is probably Jamie Mercer on LinkedIn, with their full job history publicly listed.

A defender's next move: cross-reference every discovered hostname against your asset inventory. Anything that appears in theHarvester output but not in your CMDB is an unmanaged shadow asset. Those are your highest-risk items — patch or remove them before an attacker gets there.

Step 2: Deep Exposure Analysis with Shodan

Shodan is a search engine for internet-connected devices — it continuously scans the internet and indexes banners, certificates, and service fingerprints. If a service is exposed, Shodan has probably already found it.

Use the Shodan CLI to pivot off the IPs you discovered in step one:

shodan host 192.0.2.83

IP: 192.0.2.83
Hostnames: jenkins.acmecorp.io
Organization: ACME Corp
Operating System: Ubuntu 22.04

Ports:
  22/tcp   OpenSSH 8.9p1
  8080/tcp Jetty 10.0.13
             HTTP/1.1 200 OK
             X-Jenkins: 2.426.1
             X-Jenkins-Session: 3f8a1d
             Set-Cookie: JSESSIONID=node0abc...;

  443/tcp  nginx/1.24.0
             TLS Certificate: acmecorp.io (expires 2027-03-14)
             Subject Alt Names: jenkins.acmecorp.io, staging.acmecorp.io

Jenkins 2.426.1 on a public IP with no authentication wall in front of it is a critical finding. That specific version has known deserialization issues, and an unauthenticated attacker can check for exposed build logs and environment variables — which frequently contain AWS keys, GitHub tokens, and database passwords baked into CI/CD pipelines.

The TLS SAN field also just handed you staging.acmecorp.io for free — certificate transparency is an OSINT goldmine. Run shodan search ssl.cert.subject.cn:acmecorp.io to pull every certificate issued for that domain and discover subdomains that never appeared in DNS queries.

Defender action here: lock Jenkins behind a VPN or zero-trust gateway. Then run shodan search org:"ACME Corp" monthly and pipe results into your vulnerability management workflow. Automate it with the Shodan API — a 10-line Python script can alert you whenever a new port opens on your IP range.

Step 3: Credential and Leak Intelligence

OSINT in 2026 means checking paste sites, breach databases, and dark web leak indexes — all without touching anything illegal. Tools like Dehashed, LeakCheck, and the open-source h8mail automate this against your target emails.

h8mail -t j.mercer@acmecorp.io -bc ~/breach-compilation/ --output mercer_leaks.csv

[+] j.mercer@acmecorp.io
    [HIBP]        Adobe 2013 breach — password hash exposed
    [BreachComp]  Source: LinkedIn2021
                  Password: Mercer2021!
    [Paste]       pastebin.com/xK9mRv3 — posted 2025-11-02
                  Contains: j.mercer@acmecorp.io:Acmecorp#2024

Two passwords tied to a real employee, one posted publicly just nine months ago. An attacker tries Acmecorp#2024 against the VPN endpoint at vpn.acmecorp.io — and if MFA isn't enforced, they're in. Password pattern analysis also reveals that this company likely uses CompanyName+Year+Symbol as a corporate standard, making the next credential guess trivial.

Defenders: run h8mail or a commercial equivalent against every employee email in your directory on a quarterly schedule. Any match goes straight to a forced password reset and an MFA enrollment check. This one workflow catches more real threats than most endpoint tools.

What To Do Now

Run theHarvester against your own primary domain right now — use -b google,bing,certspotter,dnsdumpster if you want a quick first pass. Export the HTML report and spend 20 minutes reviewing every hostname it returns. Flag anything you don't recognize, anything with "dev," "staging," "jenkins," or "internal" in the name, and every email address tied to a real employee. That list is your attacker's starting point — and now it's yours too.