Asset Inventory & OSINT

Scoping MED v1.0.0 updated 2026-06-17

Build a comprehensive inventory of the target's digital assets using OSINT techniques — domains, acquisitions, IP ranges, cloud infrastructure, employee data, and technology stack.

Tools

Machine-readable JSON available at:

https://reconatlas.pages.dev/api/checklists/asset-inventory

// checklist steps

asset-01

Gather corporate OSINT

Research the target organisation's structure, acquisitions, subsidiaries, and public filings to identify related domains and infrastructure.

curl -s 'https://autocomplete.clearbit.com/v1/companies/suggest?query=target' | jq .
whois target.com | grep -iE 'registrant|org|email|name server'

Check Crunchbase, SEC EDGAR filings, and Wikipedia for acquisitions. Acquired companies often retain their original infrastructure and become forgotten attack surface.

asset-02

Fingerprint the technology stack

Identify web technologies, frameworks, and third-party services running on the target's primary domains using passive fingerprinting.

whatweb -a 3 https://target.com
curl -sI https://target.com | grep -iE 'server|x-powered|x-aspnet|x-generator'

Wappalyzer browser extension and BuiltWith provide complementary results. Cross-reference findings to confirm technology versions before searching for CVEs.

asset-03

Perform Google dorking

Use advanced search operators to discover exposed files, directories, login portals, and sensitive documents indexed by search engines.

echo 'site:target.com filetype:pdf' > dorks.txt
echo 'site:target.com inurl:admin' >> dorks.txt
echo 'site:target.com intitle:"index of"' >> dorks.txt
echo 'site:target.com ext:sql | ext:env | ext:log' >> dorks.txt

Rate-limit your Google searches to avoid CAPTCHAs. Use tools like GoogleDorker or pagodo to automate queries, but manually review every result for false positives.

asset-04

Run Shodan and Censys reconnaissance

Query internet-wide scan databases to discover exposed services, open ports, SSL certificates, and IoT devices associated with the target.

shodan search 'ssl.cert.subject.cn:target.com' --fields ip_str,port,org,hostnames
censys search 'services.tls.certificates.leaf.names: target.com' | jq '.[] | {ip, services}'

Shodan and Censys results are historic snapshots. Always verify findings against the live target to confirm services are still exposed and in scope.

asset-05

Hunt for source code leaks

Search GitHub, GitLab, and other code repositories for accidentally committed secrets, internal documentation, and exposed source code.

GitDorker -d dorks/medium_dorks.txt -t ghp_YOUR_TOKEN -q target.com -o gitdorker-results.txt
trufflehog github --org target-org --json > trufflehog-results.json

Look for API keys, database credentials, internal URLs, and .env files. Report credential leaks promptly — they are often high-severity findings.

asset-06

Discover cloud assets

Enumerate cloud storage buckets, containers, and serverless endpoints across AWS, Azure, and GCP that belong to the target.

cloud_enum -k target -k target.com -l cloud-enum-results.txt
python3 -m S3Scanner --bucket-file wordlist.txt --out-file s3-results.txt

Try common naming patterns like target-prod, target-backup, target-dev. Misconfigured buckets with public list or read permissions are high-impact findings.

asset-07

Collect social media and employee OSINT

Gather employee names, email formats, and social media profiles to identify potential phishing targets and internal system naming conventions.

theHarvester -d target.com -b all -f harvester-results.html
LinkedInt -e target.com -o linkedin-employees.txt

Use employee data responsibly and within programme rules. Many bug bounty programmes explicitly prohibit social engineering. Focus on email format discovery for credential stuffing or password spray lists.

asset-08

Enumerate ASN and IP ranges

Identify the target's Autonomous System Numbers and allocated IP ranges to discover infrastructure beyond their primary domains.

amass intel -org 'Target Inc' -asn
whois -h whois.radb.net -- '-i origin AS12345' | grep route
nmap -sL -n 192.168.1.0/24 | awk '/scan report/{print $NF}'

ASN enumeration reveals IP ranges that may host services not linked to the main domain. Cross-reference with reverse DNS to find hidden hostnames.

Overview

Asset inventory goes far beyond subdomain enumeration. Before you scan anything, you need to understand the target as a business: what companies they have acquired, which cloud providers they use, what code they have inadvertently published, and what employee information is available to an attacker with nothing more than a browser.

This phase is entirely passive. You should not send a single packet to the target’s infrastructure. Everything here relies on publicly available data sources, search engines, and third-party databases.

What to look for

Focus on assets that expand the attack surface beyond the obvious:

Acquired companies whose domains still resolve to active services
Cloud storage buckets with permissive ACLs
GitHub repositories containing hardcoded secrets or internal documentation
Employee email patterns that enable credential attacks
IP ranges registered to the organisation but not listed in the programme scope

Correlating findings

Cross-reference OSINT data to build a complete picture. An ASN lookup may reveal IP ranges that host staging environments discovered via Google dorking. A leaked GitHub repository may reference internal API endpoints found through Shodan. The more you correlate, the deeper your recon becomes.

// references

← All checklists JSON ↗