OSINT workflow from zero, with AI as a co-pilot

OSINT is the part of recon you do without touching the target: you read what is already public. A workflow keeps it repeatable. Write down the scope, collect in passes, keep every finding next to its source, correlate, then write it up. This track uses command-line tools with the NotHoly chat as a co-pilot that plans the passes, parses noisy output and drafts the write-up. Everything here runs against a domain you own or a bug bounty program you have joined.

#Fix the scope before the first command

A target you are allowed to look at is a list, not a feeling. Write down the root domains, the IP ranges, the brand names, the employee roles that matter and the things that are off limits. For a bug bounty program, copy the scope table from the program page into a file.

scope.txt
example.com
*.example.com
api.example.net
out-of-scope: corp VPN, third-party SaaS login

Everything you collect later gets checked against this file. A host that is not in scope gets a note and nothing else.

#Collect in passes, keep the source

Run recon in passes, from passive to light touch. A first pass with theHarvester pulls names, emails and subdomains from search engines and certificate data.

theHarvester -d example.com -b bing,crtsh,duckduckgo -f example-harvest

Save each tool's raw output with a date in the filename, and never overwrite an older run. Recon earns its keep when you can diff this week against last week. For a wider passive sweep, SpiderFoot runs many modules and stores what it finds in a database you can query.

#Let the chat plan the passes

Paste the scope file into the NotHoly chat and ask it to turn the scope into an ordered plan: which passes, in which order, and which steps to drop because they would touch the target. A prompt that works:

Here is my scope file. Draft a passive OSINT plan in passes,
from least to most intrusive. Flag any step that sends traffic
to the target so I can decide. Return a checklist.

The default model returns a checklist you can edit. It runs nothing by itself. The CLI runs commands on your own machine, and only after you approve each one. Keep the chat in the loop for parsing too: paste a messy block of output and ask for only the in-scope hosts as a plain list.

#Correlate, do not just collect

Three hundred subdomains are not a finding. Correlation is the work: this subdomain shares an IP with that one, this address turns up in a breach-notification source, this employee's public commits land in a repo named like an internal service. Keep one notes file with a single line per fact and the source beside it. The rest of this track walks each collection step and ends with the report.

#Scope and privacy

OSINT reads data about real people. Collect only what the scope needs, hold it no longer than the engagement, and keep breach records and personal details out of any screenshot you share. When a source is a leak, the people in it are subjects to protect, not targets. See OSINT ethics and privacy.

#Frequently asked questions

#Is passive recon really invisible to the target?

Mostly, but not entirely. Reading a target's own site, DNS and certificates sends it ordinary traffic. The truly passive sources, search engines, certificate logs and web archives, never reach the target. Decide per step and mark the ones that do.

#Can the AI do the OSINT for me?

No. The server runs no scans against third parties, and the chat has no line into your target. It plans, parses and summarises. You run the tools on your machine.

Start with the scope file and one passive pass, then move on to subdomain enumeration. The map for the whole track is what is OSINT.