OSINT-Only Engagement

Passive OSINT reconnaissance with no active scanning.

Tool Chain

OSift → Prometheus

Steps

Full OSINT Reconnaissance OSift

All 11 OSINT phases: DNS enum, subdomain discovery, email harvesting, breach data, WHOIS, certificate transparency, social media, document metadata, technology fingerprinting, DNS enrichment.

Input	Client domain names
Output	`targets_osint.json, findings_vantage.json, findings_report.json`
Usage	`osift.py -d <domain> -o <output_dir>`
Notes	Pure passive recon. No active probes sent to targets. Manage via Crucible.

Reporting Prometheus

Generate OSINT report with discovered assets, exposures, and breach data.

Input	OSift run directory
Output	`OSINT report`
Usage	`prometheus.py -i <run_dir> -o <report_dir>`
Notes	OSINT findings use confidence field for validation state.