> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# OSINT

## Passive Recon

Collect public-facing data without touching the target: emails, subdomains, exposed services, and leaked credentials all show up here.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
theHarvester -d <domain> -b all
shodan search hostname:<domain>
shodan host <IP>
```

## Google Dorks

Narrow search results to find exposed files, admin panels, and credentials indexed by Google: add `before:` date filters to find old cached pages.

```wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
site:<domain> filetype:pdf
site:<domain> inurl:admin
site:<domain> "index of"
site:github.com <company> password
site:github.com <company> api_key
```

## Certificate Transparency

CT logs record every issued certificate: a reliable way to find subdomains without touching the target at all.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
curl -s "https://crt.sh/?q=<domain>&output=json" | jq '.[].name_value' | sort -u
```