AI-Powered OSINT Reconnaissance

How large language models transform open-source intelligence gathering from tedious manual work into rapid, structured reconnaissance.

OSINT Reconnaissance LLM Red Team

Before We Begin

Throughout this course, always operate under these principles:

• Scope — only target systems and organizations you have explicit written authorization to assess
• Proportionality — collect only the data needed for the assessment objective
• Privacy — handle personal data according to applicable regulations (GDPR, CCPA, etc.)
• Disclosure — report findings through proper channels, never publicly leak sensitive data

What Is OSINT?

Open-Source Intelligence is the collection and analysis of information from publicly available sources to produce actionable intelligence.

Classic OSINT Sources

• Web presence — corporate websites, blogs, press releases
• Social media — LinkedIn, Twitter/X, GitHub, forums
• Public records — WHOIS, DNS, certificate transparency logs
• Code repositories — commit history, issues, CI/CD configs
• Documents & metadata — PDFs, images, office files with embedded metadata

Why AI Supercharges OSINT

Traditional OSINT is manual, slow, and error-prone. LLMs change the equation in three fundamental ways:

The AI OSINT Workflow

A structured four-phase approach to AI-assisted reconnaissance:

1. Scope & seed — define the target and collect seed identifiers (domain, company name, key personnel)
2. Collect — use traditional tools (WHOIS, DNS, Shodan, Google) to gather raw data
3. Analyze with AI — feed raw data into an LLM to extract entities, relationships, and anomalies
4. Synthesize — have the LLM produce a structured recon dossier with prioritized findings

Technique: Domain Recon with AI

Combine traditional DNS/WHOIS tools with LLM analysis to map an organization's external footprint.

Step 1 — Gather Raw Data

# Collect DNS records
dig +short example-corp.com ANY
# WHOIS lookup
whois example-corp.com
# Certificate transparency
curl -s "https://crt.sh/?q=%25.example-corp.com&output=json" | jq '.[].name_value'
# Subdomain enumeration
subfinder -d example-corp.com -silent

Step 2 — Feed to Claude for Analysis

prompt = """Analyze these DNS and WHOIS records for example-corp.com.
Extract: hosting providers, mail services, CDNs, cloud platforms,
geographic locations, registration patterns, and any anomalies.

Raw data:
{raw_data}

Output as structured JSON with confidence scores."""

Technique: Social Media Profiling

LLMs excel at synthesizing scattered social media data into coherent organizational profiles.

prompt = """From these LinkedIn profiles and GitHub contributions,
build an organizational technology map:
- Key engineers and their specialties
- Programming languages and frameworks in use
- Cloud infrastructure indicators
- Potential attack surface insights

Data: {social_data}"""

Technique: Metadata Extraction

Documents published online often contain hidden metadata that reveals internal usernames, software versions, file paths, and network information.

Extracting Metadata with ExifTool

# Extract metadata from downloaded PDFs
exiftool -json downloaded_docs/*.pdf > metadata.json

# Key fields to look for:
# Author, Creator, Producer, ModifyDate,
# Company, Manager, LastSavedBy

AI-Powered Metadata Analysis

prompt = """Analyze this document metadata from files published
by the target organization. Identify:
1. Internal usernames and naming conventions
2. Software and version numbers (potential vuln targets)
3. Internal file paths and network shares
4. Timeline of document creation (org activity patterns)
5. Any metadata that suggests security posture

Metadata JSON:
{metadata_json}"""

Technique: Google Dorking with AI

Instead of memorizing hundreds of dork operators, let the LLM generate targeted search queries for you.

prompt = """Generate 15 Google dork queries to find sensitive
information exposed by example-corp.com. Include dorks for:
- Exposed configuration files
- Login portals and admin panels
- Directory listings
- Database dumps or backups
- API documentation and keys
- Internal documents indexed by Google

Format each as: PURPOSE: dork_query"""

Example AI-Generated Dorks

ADMIN PANELS:  site:example-corp.com inurl:admin OR inurl:login OR inurl:dashboard
CONFIG FILES:  site:example-corp.com ext:env OR ext:yml OR ext:conf
EXPOSED DOCS:  site:example-corp.com ext:pdf OR ext:docx "confidential"
API KEYS:      site:github.com "example-corp" "api_key" OR "secret" OR "token"
DIR LISTINGS:  site:example-corp.com intitle:"index of" "parent directory"

Live Demo: Organizational Mapping

Feeding public GitHub and LinkedIn data to Claude to build an organizational intelligence map.

import anthropic

client = anthropic.Anthropic()

# Combine all collected OSINT data
recon_data = {
    "github_repos": github_org_data,
    "linkedin_profiles": linkedin_data,
    "dns_records": dns_data,
    "job_postings": job_data,
}

response = client.messages.create(
    model="claude-sonnet-4-20250514",
    max_tokens=4096,
    messages=[{
        "role": "user",
        "content": f"""Build a comprehensive organizational map from this
public data. Structure your output as:

## Technology Stack
## Key Personnel & Roles
## Infrastructure Footprint
## Potential Attack Surface
## Recommended Next Steps

Data: {recon_data}"""
    }]
)
print(response.content[0].text)

Building the Recon Dossier

The final output of AI-powered OSINT is a structured recon dossier that feeds directly into attack planning.

Dossier Template

OSINT Tool Ecosystem

Combine these tools with AI analysis for maximum coverage:

Shodan theHarvester SpiderFoot subfinder ExifTool crt.sh

Common Pitfalls

Avoid these mistakes when performing AI-assisted OSINT:

• Trusting AI output without verification — LLMs can hallucinate connections that do not exist. Always verify key findings against raw data.
• Scope creep — AI makes it easy to collect far more data than authorized. Stay within your Rules of Engagement.
• Leaking target data to AI providers — sending sensitive recon data to cloud APIs creates a data handling risk. Consider local models for classified engagements.
• Ignoring timestamps — OSINT data decays fast. Always note when data was collected and flag stale findings.
• Single-source bias — correlate across multiple sources before drawing conclusions.

CTF Challenge: Recon Dossier

Challenge Objectives

1. Domain enumeration — identify all subdomains, IP ranges, and hosting providers
2. Technology profiling — map the complete tech stack from public sources
3. Personnel mapping — build an org chart with roles and contact patterns
4. Attack surface inventory — enumerate exposed services, login portals, and APIs
5. AI-generated dossier — produce a structured report using Claude with confidence ratings

Scoring Criteria

Summary & Next Steps

Key Takeaways

• OSINT is the foundation of every red team engagement — AI makes it faster and more thorough
• LLMs excel at entity extraction, correlation, query generation, and structured reporting
• The workflow: seed → collect → analyze with AI → synthesize into a dossier
• Always verify AI findings against raw data and respect scope boundaries