OSINT for Red Teams: Building the Attack Narrative
Every good red team engagement starts before a single packet hits the target. OSINT builds the narrative — who to pretext, what tech stack to expect, and which leaked credential gets you the first foothold.
Map the organization
LinkedIn org charts, job postings (they leak tech stack), and press releases tell you who holds privileged access and what tools they use day to day.
Hunt leaked credentials
Breach corpora and paste sites often already have valid creds for the target domain. Password reuse against SSO is still one of the highest-yield initial access paths.
- Check breach databases for the target domain
- Look for credentials reused against corporate SSO
- Monitor GitHub/GitLab for leaked tokens and internal URLs
Build the pretext
The best phishing pretext mirrors something real: a vendor the company actually uses, a tool mentioned in a job posting, an event on the company calendar.
Document responsibly
OSINT touches real people's data. Scope it in the ROE, minimize what you retain, and report findings as risk — not as a trophy.
Tools mentioned
Recon is the engagement. Everything after the first OSINT pass — the pretext, the initial access, the story in the report — is downstream of how well you mapped the target.