{
  "slug": "asset-inventory",
  "title": "Asset Inventory & OSINT",
  "phase": "Scoping",
  "description": "Build a comprehensive inventory of the target's digital assets using OSINT techniques — domains, acquisitions, IP ranges, cloud infrastructure, employee data, and technology stack.",
  "difficulty": "medium",
  "tags": [
    "scoping",
    "osint",
    "asset-discovery",
    "passive-recon",
    "corporate-intelligence"
  ],
  "tools": [
    "Shodan",
    "Censys",
    "theHarvester",
    "SpiderFoot",
    "Recon-ng",
    "GitDorker",
    "truffleHog",
    "cloud_enum",
    "LinkedInt"
  ],
  "steps": [
    {
      "id": "asset-01",
      "title": "Gather corporate OSINT",
      "description": "Research the target organisation's structure, acquisitions, subsidiaries, and public filings to identify related domains and infrastructure.",
      "commands": [
        "curl -s 'https://autocomplete.clearbit.com/v1/companies/suggest?query=target' | jq .",
        "whois target.com | grep -iE 'registrant|org|email|name server'"
      ],
      "notes": "Check Crunchbase, SEC EDGAR filings, and Wikipedia for acquisitions. Acquired companies often retain their original infrastructure and become forgotten attack surface."
    },
    {
      "id": "asset-02",
      "title": "Fingerprint the technology stack",
      "description": "Identify web technologies, frameworks, and third-party services running on the target's primary domains using passive fingerprinting.",
      "commands": [
        "whatweb -a 3 https://target.com",
        "curl -sI https://target.com | grep -iE 'server|x-powered|x-aspnet|x-generator'"
      ],
      "notes": "Wappalyzer browser extension and BuiltWith provide complementary results. Cross-reference findings to confirm technology versions before searching for CVEs."
    },
    {
      "id": "asset-03",
      "title": "Perform Google dorking",
      "description": "Use advanced search operators to discover exposed files, directories, login portals, and sensitive documents indexed by search engines.",
      "commands": [
        "echo 'site:target.com filetype:pdf' > dorks.txt",
        "echo 'site:target.com inurl:admin' >> dorks.txt",
        "echo 'site:target.com intitle:\"index of\"' >> dorks.txt",
        "echo 'site:target.com ext:sql | ext:env | ext:log' >> dorks.txt"
      ],
      "notes": "Rate-limit your Google searches to avoid CAPTCHAs. Use tools like GoogleDorker or pagodo to automate queries, but manually review every result for false positives."
    },
    {
      "id": "asset-04",
      "title": "Run Shodan and Censys reconnaissance",
      "description": "Query internet-wide scan databases to discover exposed services, open ports, SSL certificates, and IoT devices associated with the target.",
      "commands": [
        "shodan search 'ssl.cert.subject.cn:target.com' --fields ip_str,port,org,hostnames",
        "censys search 'services.tls.certificates.leaf.names: target.com' | jq '.[] | {ip, services}'"
      ],
      "notes": "Shodan and Censys results are historic snapshots. Always verify findings against the live target to confirm services are still exposed and in scope."
    },
    {
      "id": "asset-05",
      "title": "Hunt for source code leaks",
      "description": "Search GitHub, GitLab, and other code repositories for accidentally committed secrets, internal documentation, and exposed source code.",
      "commands": [
        "GitDorker -d dorks/medium_dorks.txt -t ghp_YOUR_TOKEN -q target.com -o gitdorker-results.txt",
        "trufflehog github --org target-org --json > trufflehog-results.json"
      ],
      "notes": "Look for API keys, database credentials, internal URLs, and .env files. Report credential leaks promptly — they are often high-severity findings."
    },
    {
      "id": "asset-06",
      "title": "Discover cloud assets",
      "description": "Enumerate cloud storage buckets, containers, and serverless endpoints across AWS, Azure, and GCP that belong to the target.",
      "commands": [
        "cloud_enum -k target -k target.com -l cloud-enum-results.txt",
        "python3 -m S3Scanner --bucket-file wordlist.txt --out-file s3-results.txt"
      ],
      "notes": "Try common naming patterns like target-prod, target-backup, target-dev. Misconfigured buckets with public list or read permissions are high-impact findings."
    },
    {
      "id": "asset-07",
      "title": "Collect social media and employee OSINT",
      "description": "Gather employee names, email formats, and social media profiles to identify potential phishing targets and internal system naming conventions.",
      "commands": [
        "theHarvester -d target.com -b all -f harvester-results.html",
        "LinkedInt -e target.com -o linkedin-employees.txt"
      ],
      "notes": "Use employee data responsibly and within programme rules. Many bug bounty programmes explicitly prohibit social engineering. Focus on email format discovery for credential stuffing or password spray lists."
    },
    {
      "id": "asset-08",
      "title": "Enumerate ASN and IP ranges",
      "description": "Identify the target's Autonomous System Numbers and allocated IP ranges to discover infrastructure beyond their primary domains.",
      "commands": [
        "amass intel -org 'Target Inc' -asn",
        "whois -h whois.radb.net -- '-i origin AS12345' | grep route",
        "nmap -sL -n 192.168.1.0/24 | awk '/scan report/{print $NF}'"
      ],
      "notes": "ASN enumeration reveals IP ranges that may host services not linked to the main domain. Cross-reference with reverse DNS to find hidden hostnames."
    }
  ],
  "references": [
    "https://github.com/laramies/theHarvester",
    "https://github.com/smicallef/spiderFoot",
    "https://github.com/obheda12/GitDorker",
    "https://github.com/trufflesecurity/trufflehog",
    "https://shodan.io"
  ],
  "version": "1.0.0",
  "updatedAt": "2026-06-17"
}