Recon Osint

This is a full reconnaissance workflow that chains together subdomain enumeration, port scanning, breach lookups, and CVE correlation into one coordinated phase. It's built around tools like subfinder, amass, nmap, h8mail, and nuclei, moving methodically from passive intel gathering through active service discovery to credential hunting. The GitHub dorking section is especially thorough, with specific search patterns for leaked AWS keys and historical secrets in git logs. Use this at the start of an engagement when you need a complete attack surface map, or when you're preparing a target profile before exploitation. It outputs structured reports with prioritized attack vectors, which is helpful for deciding where to focus next. The social engineering recon techniques are a nice addition that goes beyond pure technical enumeration.