1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Run Active Network Scans using Nmap
Perform port scanning and service version detection using terminal commands in your Kali VM.
$ nmap -sV -sC -p- 192.168.56.20
This command runs a full port scan on all 65535 ports of target 192.168.56.20, detecting service versions and executing default validation scripts.
| Part | What It Does |
|---|
-sV | Service/Version detection — probes open ports to determine what service and version is running |
-sC | Script scan — runs default NSE (Nmap Scripting Engine) scripts for additional vulnerability information |
-p- | Scans ALL 65,535 TCP ports instead of just the default 1,000 |
$ nmap --script http-enum -p 80,8080,3000 192.168.56.10
This command executes the http-enum NSE script against specific web server ports to discover hidden directory routes.
| Part | What It Does |
|---|
--script | Specifies which NSE script(s) to run against the target |
-p | Port specification — defines which ports to scan (e.g., -p 80 or -p 1-1000) |
STEP 2
Harvest Public Domain OSINT Data
Use passive WHOIS and DNS lookup queries to compile target profiles without direct scanning.
$ whois example.com
This command queries public domain registration databases to gather DNS registrar records and contact records.
$ dig example.com MX
This command queries the domain name server system to retrieve Mail Exchange records, identifying target mail servers.
4. Part 2: Complete Deliverable Assets & Production Templates
To automate the passive OSINT harvesting process, we will write a local Python script named osint_recon.py:
$ python osint_recon.py example.com
This command runs the passive recon utility on a target domain, logging host IP records and nameservers.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# osint_recon.py - Passive OSINT Domain Harvester
Line 2: This is a comment that describes what the code does: "osint_recon.py - Passive OSINT Domain Harvester". Comments start with # and are ignored by Python.
import socket
Line 3: Imports the socket module/library, making its functions available for use in this script.
import sys
Line 4: Imports the sys module/library, making its functions available for use in this script.
def harvest_domain(domain):
Line 5: Defines a new function called harvest_domain that accepts parameters: domain. Functions are reusable blocks of code.
print(f"[*] Auditing domain OSINT profiles for: {{domain}}")
Line 6: Prints output to the terminal so the user can see the result or status of the operation.
try:
Line 7: Starts a try block — attempts to run the code inside. If an error occurs, execution jumps to the except block instead of crashing.
ip = socket.gethostbyname(domain)
Line 8: Creates a variable called ip and assigns a value to it. Variables store data for use later in the program.
print(f"[+] Active IP Address: {{ip}}")
Line 9: Prints output to the terminal so the user can see the result or status of the operation.
except socket.gaierror:
Line 10: Catches errors from the try block and handles them gracefully instead of crashing the program.
print("[FAIL] Could not resolve host IP.")
Line 11: Prints output to the terminal so the user can see the result or status of the operation.
sys.exit(1)
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
if __name__ == "__main__":
Line 13: A conditional check — the code inside this block only runs if the condition evaluates to True.
if len(sys.argv) < 2:
Line 14: A conditional check — the code inside this block only runs if the condition evaluates to True.
print("Usage: python osint_recon.py <domain>")
Line 15: Prints output to the terminal so the user can see the result or status of the operation.
sys.exit(1)
Line 16: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
harvest_domain(sys.argv[1])
Line 17: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
# osint_recon.py - Passive OSINT Domain Harvester
import socket
import sys
def harvest_domain(domain):
print(f"[*] Auditing domain OSINT profiles for: {{domain}}")
try:
ip = socket.gethostbyname(domain)
print(f"[+] Active IP Address: {{ip}}")
except socket.gaierror:
print("[FAIL] Could not resolve host IP.")
sys.exit(1)
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python osint_recon.py <domain>")
sys.exit(1)
harvest_domain(sys.argv[1])
5. Deliverables Summary
Created Files / Templates
osint_recon.py - OSINT parser script- Phishing pretext draft (social engineering simulation text)
Verification Artifacts
- Output of Nmap service scans listing open ports and versions.
- OSINT domain briefing dossier compiled in Markdown.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
