================================================================================ COMBINED OSINT RECONNAISSANCE REPORT Target: MegaCorp Industries (megacorp-industries.com) Date: 2026-03-15 Classification: CONFIDENTIAL - Red Team Eyes Only ================================================================================ 1. WHOIS RECORD -------------------------------------------------------------------------------- Domain Name: megacorp-industries.com Registrar: NameCheap, Inc. Registration Date: 2019-06-12 Expiration Date: 2027-06-12 Updated Date: 2025-11-03 Registrant Organization: MegaCorp Industries, LLC Registrant Street: 4500 Innovation Parkway, Suite 300 Registrant City: Austin Registrant State: Texas Registrant Postal Code: 78759 Registrant Country: US Registrant Email: domains@megacorp-industries.com Name Server: ns1.cloudflare.com Name Server: ns2.cloudflare.com DNSSEC: unsigned Note: Cloudflare DNS indicates CDN/WAF in front of primary web properties. Real origin IP may be discoverable through historical DNS records or misconfigured subdomains. 2. SUBDOMAIN ENUMERATION -------------------------------------------------------------------------------- Source: Subfinder + crt.sh + DNS brute force (common wordlist) SUBDOMAIN IP ADDRESS STATUS ------------------------------------ ---------------- -------- www.megacorp-industries.com 104.21.45.112 Active (CF) mail.megacorp-industries.com 52.14.88.203 Active vpn.megacorp-industries.com 52.14.88.210 Active dev.megacorp-industries.com 18.220.134.77 Active staging.megacorp-industries.com 18.220.134.78 Active jenkins.megacorp-industries.com 18.220.134.79 Active gitlab.megacorp-industries.com 18.220.134.80 Active api.megacorp-industries.com 104.21.45.112 Active (CF) blog.megacorp-industries.com 104.21.45.112 Active (CF) careers.megacorp-industries.com 76.76.21.21 Active (Vercel) Key Observations: - mail, vpn resolve to AWS us-east-2 (52.14.x.x) -- NOT behind Cloudflare - dev, staging, jenkins, gitlab all in same AWS subnet (18.220.134.x) - Dev/CI infrastructure appears to lack WAF protection - jenkins and gitlab subdomains suggest self-hosted CI/CD pipeline 3. EMPLOYEE INFORMATION (LinkedIn / Public Sources) -------------------------------------------------------------------------------- NAME ROLE NOTES -------------------- ---------------------------- ---------------------------- David Chen CTO Posts about Kubernetes, Go Sarah Mitchell VP Engineering Shared conference talk on microservices migration James Rodriguez Senior DevOps Engineer GitHub profile shows Docker, Terraform, Jenkins expertise Priya Patel Security Engineer Only security hire visible; small security team likely Alex Thompson Full-Stack Developer Active on Stack Overflow; answered questions about Django REST Framework Maria Gonzalez HR Director LinkedIn shows open positions for 3 more engineers Kevin O'Brien Systems Administrator Certified AWS Solutions Architect; manages infra Lisa Wang Frontend Developer GitHub repos show React/Next.js Tom Baker Junior Developer Hired 2 months ago; likely still onboarding Phishing Target Assessment: - Tom Baker (junior, new) -- high susceptibility, low-privilege access - James Rodriguez (DevOps) -- moderate susceptibility, high-value target - Kevin O'Brien (SysAdmin) -- moderate susceptibility, highest-value target 4. TECHNOLOGY STACK INDICATORS -------------------------------------------------------------------------------- Source: Wappalyzer, HTTP headers, job postings, GitHub repos, conference talks LAYER TECHNOLOGY EVIDENCE SOURCE ------------------ --------------------------- ------------------------- Frontend React 18, Next.js 14 Job postings, GitHub Backend Python 3.11, Django 4.2 Stack Overflow answers API Framework Django REST Framework 3.14 Alex Thompson's SO posts Database PostgreSQL 15 Job postings Cache Redis 7.x Job postings CI/CD Jenkins 2.4xx Subdomain + job postings Source Control GitLab CE (self-hosted) Subdomain discovery Container Runtime Docker, Kubernetes David Chen's blog posts Cloud Provider AWS (us-east-2) IP geolocation CDN/WAF Cloudflare (Free/Pro tier) DNS + HTTP headers VPN OpenVPN vpn subdomain banner grab Mail Microsoft 365 MX record analysis CMS (Blog) WordPress /wp-login.php detected Monitoring Unknown No indicators found 5. PUBLIC-FACING SERVICES SUMMARY -------------------------------------------------------------------------------- SERVICE URL / ENDPOINT NOTES ------------------- ------------------------------------- ------------------- Corporate Website https://www.megacorp-industries.com Behind Cloudflare REST API https://api.megacorp-industries.com Behind Cloudflare Blog (WordPress) https://blog.megacorp-industries.com Behind Cloudflare Careers Portal https://careers.megacorp-industries.com Hosted on Vercel Email (O365) mail.megacorp-industries.com:443 OWA login page VPN Gateway vpn.megacorp-industries.com:1194 OpenVPN, UDP Jenkins jenkins.megacorp-industries.com:8080 HTTP, no redirect GitLab gitlab.megacorp-industries.com:443 HTTPS, login page Dev Environment dev.megacorp-industries.com:8000 Django dev server? Staging Environment staging.megacorp-industries.com:443 HTTPS Critical Findings: [!] Jenkins on port 8080 over HTTP (unencrypted) -- no WAF protection [!] Dev environment appears to run Django dev server on port 8000 [!] Dev/staging/CI infrastructure in same subnet -- flat network segment [!] Only one security engineer identified -- likely understaffed 6. ADDITIONAL OSINT NOTES -------------------------------------------------------------------------------- - Company GitHub organization (github.com/megacorp-industries) has 3 public repos: - megacorp-design-system (React component library) - megacorp-api-docs (OpenAPI specs -- reveals endpoint structure) - mc-interview-challenge (coding challenge -- reveals tech preferences) - Google dorking results: - site:megacorp-industries.com filetype:pdf -- Employee handbook found (2024) - "megacorp-industries.com" "password" -- No credential leaks in paste sites - Shodan: Jenkins instance indexed, shows version in HTTP headers - The OpenAPI spec in the public repo reveals: - /api/v2/users/ endpoint (user enumeration possible) - /api/v2/admin/ endpoint (admin panel exists) - JWT authentication in use - API versioning suggests v1 may still be active (legacy endpoints) ================================================================================ END OF RECON REPORT Next Phase: Vulnerability Scanning (see vulnerability-scan.txt) ================================================================================