How large language models transform open-source intelligence gathering from tedious manual work into rapid, structured reconnaissance.
OSINT fundamentals, AI-assisted recon techniques, and how to build a complete target dossier using LLMs.
Build an AI-powered recon dossier for a target organization using only public data sources.
OSINT Reconnaissance LLM Red Team
OSINT techniques shown here are for authorized security assessments and CTF competitions only. Unauthorized surveillance or data collection may violate privacy laws.
Throughout this course, always operate under these principles:
Open-Source Intelligence is the collection and analysis of information from publicly available sources to produce actionable intelligence.
OSINT is often the first phase of any penetration test or red team engagement. The quality of your recon directly determines the success of later attack phases.
Traditional OSINT is manual, slow, and error-prone. LLMs change the equation in three fundamental ways:
| Capability | Traditional OSINT | AI-Powered OSINT |
|---|---|---|
| Data parsing | Manual reading, copy-paste | Structured extraction in seconds |
| Entity linking | Spreadsheets and mind maps | Automatic relationship graphs |
| Pattern recognition | Analyst intuition | Cross-reference thousands of data points |
| Query generation | Memorize dork syntax | LLM generates advanced search queries |
| Report writing | Hours of formatting | Structured dossier in minutes |
A structured four-phase approach to AI-assisted reconnaissance:
You gather the raw material. The LLM processes, correlates, and structures it. You make the tactical decisions.
Combine traditional DNS/WHOIS tools with LLM analysis to map an organization's external footprint.
# Collect DNS records
dig +short example-corp.com ANY
# WHOIS lookup
whois example-corp.com
# Certificate transparency
curl -s "https://crt.sh/?q=%25.example-corp.com&output=json" | jq '.[].name_value'
# Subdomain enumeration
subfinder -d example-corp.com -silentprompt = """Analyze these DNS and WHOIS records for example-corp.com.
Extract: hosting providers, mail services, CDNs, cloud platforms,
geographic locations, registration patterns, and any anomalies.
Raw data:
{raw_data}
Output as structured JSON with confidence scores."""LLMs excel at synthesizing scattered social media data into coherent organizational profiles.
prompt = """From these LinkedIn profiles and GitHub contributions,
build an organizational technology map:
- Key engineers and their specialties
- Programming languages and frameworks in use
- Cloud infrastructure indicators
- Potential attack surface insights
Data: {social_data}"""Documents published online often contain hidden metadata that reveals internal usernames, software versions, file paths, and network information.
# Extract metadata from downloaded PDFs
exiftool -json downloaded_docs/*.pdf > metadata.json
# Key fields to look for:
# Author, Creator, Producer, ModifyDate,
# Company, Manager, LastSavedByprompt = """Analyze this document metadata from files published
by the target organization. Identify:
1. Internal usernames and naming conventions
2. Software and version numbers (potential vuln targets)
3. Internal file paths and network shares
4. Timeline of document creation (org activity patterns)
5. Any metadata that suggests security posture
Metadata JSON:
{metadata_json}"""Instead of memorizing hundreds of dork operators, let the LLM generate targeted search queries for you.
prompt = """Generate 15 Google dork queries to find sensitive
information exposed by example-corp.com. Include dorks for:
- Exposed configuration files
- Login portals and admin panels
- Directory listings
- Database dumps or backups
- API documentation and keys
- Internal documents indexed by Google
Format each as: PURPOSE: dork_query"""ADMIN PANELS: site:example-corp.com inurl:admin OR inurl:login OR inurl:dashboard
CONFIG FILES: site:example-corp.com ext:env OR ext:yml OR ext:conf
EXPOSED DOCS: site:example-corp.com ext:pdf OR ext:docx "confidential"
API KEYS: site:github.com "example-corp" "api_key" OR "secret" OR "token"
DIR LISTINGS: site:example-corp.com intitle:"index of" "parent directory"The LLM can generate context-aware dorks based on the target's known tech stack, making queries far more precise than generic templates.
Feeding public GitHub and LinkedIn data to Claude to build an organizational intelligence map.
import anthropic
client = anthropic.Anthropic()
# Combine all collected OSINT data
recon_data = {
"github_repos": github_org_data,
"linkedin_profiles": linkedin_data,
"dns_records": dns_data,
"job_postings": job_data,
}
response = client.messages.create(
model="claude-sonnet-4-20250514",
max_tokens=4096,
messages=[{
"role": "user",
"content": f"""Build a comprehensive organizational map from this
public data. Structure your output as:
## Technology Stack
## Key Personnel & Roles
## Infrastructure Footprint
## Potential Attack Surface
## Recommended Next Steps
Data: {recon_data}"""
}]
)
print(response.content[0].text)The final output of AI-powered OSINT is a structured recon dossier that feeds directly into attack planning.
| Section | Contents |
|---|---|
| Executive Summary | Target overview, scope, key findings |
| Domain & Infrastructure | Subdomains, IPs, hosting, CDN, cloud providers |
| Technology Stack | Languages, frameworks, CMS, databases, third-party services |
| People & Organization | Org chart, key roles, email format, naming conventions |
| Attack Surface | Exposed services, login portals, APIs, leaked credentials |
| Prioritized Targets | Ranked list of promising entry points with rationale |
Use Claude to generate the dossier in Markdown, then convert to HTML/PDF for professional delivery. Include confidence levels for each finding.
Combine these tools with AI analysis for maximum coverage:
Shodan theHarvester SpiderFoot subfinder ExifTool crt.sh
Avoid these mistakes when performing AI-assisted OSINT:
Your OSINT activity itself leaves traces. Use VPNs, avoid logging into target platforms with personal accounts, and be aware of your own digital footprint during collection.
Given a target company name, use AI-assisted OSINT techniques to build a complete reconnaissance dossier. You will be scored on coverage, accuracy, and the quality of your AI-generated analysis.
| Category | Points |
|---|---|
| Domain & infrastructure coverage | 25 |
| Technology stack accuracy | 20 |
| Personnel and org mapping | 20 |
| Attack surface identification | 20 |
| Dossier quality and AI prompt design | 15 |
Build an AI-powered OSINT pipeline that takes a domain name and produces a structured recon dossier using Claude.
Lesson 02: AI-Assisted Log Analysis — using LLMs to detect anomalies and indicators of compromise in system logs.