Jun 23, 2026, 07:55 AM
The Unethical Side of Digital Reconnaissance
Written by [COLOR=rgb(184, 49, 47)]XvC[/COLOR]
Before We Start
Let me be real with you. What I'm about to lay out is not for harassing people, leaking private info, or being a menace. This is for pentesters, red teamers, and security researchers who need to understand how much of someone's digital life is sitting out in the open. If you're using this, you better have permission, a signed contract, or at least a damn good educational reason. Don't be stupid with it. -- Just kidding ROFL ^_^
---
Step 1: Start With What You Know
You usually start with one thing. A name. An email. A username. A domain. That's your entry point. From there, you pull threads.
The mindset: Everything leaves traces. People reuse usernames. They use the same email for their LinkedIn that they used for a forum back in 2012. They post their work email in a GitHub commit message. Your job is to connect the dots.
---
Step 2: Username Recon
This is the lowest hanging fruit. If you have a username, run it across platforms.
Tools to use:
sherlock [username]
whatsmyname -u [username]
maigret [username]
These will check hundreds of sites and tell you where that username exists. You'd be shocked how many accounts pop up from one Reddit username. People use the same handle on Twitter, GitHub, Discord, Steam, a random chess forum, and their old Myspace from 2007.
Manual method: Just Google the username in quotes. "xvcofficial" or whatever. Look at the results. Sometimes you find things the automated tools miss.
---
Step 3: Email Enumeration
An email address is a goldmine. It's usually tied to everything.
Check for breaches first:
- Have I Been Pwned
- DeHashed (if you have access)
- IntelX
If the email shows up in breaches, you now know the person's passwords (or at least old ones), which gives you pattern recognition. A lot of people use variations of the same password.
Validate email format:
- Hunter.io — tells you the email pattern for a domain
- Phonebook.cz — dumps all known emails for a domain
- EmailRep.io — gives a risk score for an email
Google dork:
"[email protected]" filetype:pdf
"[email protected]" site:github.com
"[email protected]" site:pastebin.com
You'd be surprised what shows up in PDF metadata, public Trello boards, or Slack invite links.
---
Step 4: Social Media Deep Dive
This is where you build the profile. Not just what they post, but what they reveal without realizing it.
LinkedIn:
- Look at their work history. Every job tells you something.
- Check their skills section — that tells you what tech stacks they use.
- Look at mutual connections. Sometimes the target isn't the person, but someone connected to them.
- Company pages show org structure.
GitHub:
- Check commit history. People paste credentials in code and forget.
- Look at their profile README. Sometimes full contact info is there.
- Check their email in commits: git log --format='%ae' | sort -u
- Look at repos they starred — tells you their interests, tech preferences.
Twitter / Reddit / Discord:
- Scrape their posts for personal details disclosed casually.
- "Just moved to Austin!" — now you know their location.
- "Started at Google this week" — now you know their employer.
- "My birthday is tomorrow" — now you have a DOB.
All of this from public posts. They gave it away. You just collected it.
---
Step 5: Domain & Infrastructure Recon
If you're researching an organization (or someone who owns a domain):
DNS enumeration:
dig any target.com
whois target.com
dnsrecon -d target.com
Subdomain discovery:
subfinder -d target.com
amass enum -d target.com
Check certificate transparency logs at crt.sh — this finds subdomains that aren't in public DNS.
Shodan:
Search the domain or IP range. Find exposed services. RDP, databases, cameras, whatever. You'd be shocked what orgs leave on the public internet.
---
Step 6: Metadata Mining
Documents leak information. PDFs, Word docs, images — they all carry metadata.
Google dorks for finding documents:
site:target.com filetype:pdf
site:target.com filetype:docx
site:target.com filetype:xlsx
Once you download them:
exiftool document.pdf
pdfinfo document.pdf
You get author names, company names, software versions, sometimes usernames, sometimes full paths that reveal internal network structure like C:\Users\jsmith\Documents\.
---
Step 7: Pastebin, Gists & Leak Sites
People dump all kinds of things publicly.
Search paste sites:
site:pastebin.com "target.com"
site:gist.github.com "target.com"
Some people push internal configs, API keys, or credentials to these sites for "quick sharing" and forget to delete them.
Telegram channels:
Some leak channels post credential dumps. Not saying you should use them, but for a red team engagement, knowing what's already out there is valuable intel.
---
Step 8: Putting It All Together
Now you have:
Data Point | Source
--------------------|------------------------------
Full name | LinkedIn, WHOIS
Email | Breach data, Hunter
Username(s) | Sherlock
Employer | LinkedIn
Location | Social media, WHOIS
Tech stack | GitHub, LinkedIn skills
Password patterns | Breach data
Subdomains | crt.sh, Amass
Exposed services | Shodan
From one username and a domain, you just built a profile. That's the game.
---
What You Do With This
In a legal, authorized engagement, you:
1. Document everything in your report
2. Show the client what an attacker can find
3. Recommend mitigations (lock down LinkedIn, remove metadata from public docs, monitor paste sites, etc.)
4. Delete all data when the engagement is over
You do not share it. You do not post it. You do not use it for personal gain.
---
Final Word From [COLOR=rgb(184, 49, 47)]XvC[/COLOR]
This isn't magic. It's just knowing where to look and being patient. The internet is a giant archive of bad decisions. People forget that "public" means "anyone can see it." Your job as a researcher is to remind them of that — by finding it first, before someone with bad intentions does.
Stay unethical. Stay unauthorized. And don't be a dick.
---------------- ([COLOR=rgb(184, 49, 47)]XvC's Picks[/COLOR]) ----------------
Username Recon:
- Maigret — by far the best. More sites checked, better results, actively maintained. Sherlock is fine but Maigret is king.
- Honorable mention: WhatsMyName (web version at whatsmyname.app)
Email Enumeration:
- theHarvester — does email, subdomain, and IP all in one. A beast.
- Holehe — checks if an email is registered on specific sites without alerting the user.
- Honorable mention: Hunter.io (web, rate limited but solid)
Breach Checking:
- DeHashed — paid but worth every penny. Best breach database available.
- IntelX — good free alternative, has a Telegram bot too.
- Honorable mention: Have I Been Pwned (limited but free)
Social Media Scraping:
- Twayback — downloads someone's entire deleted tweet history from Wayback Machine. Nasty but effective.
- Twint (if still working) — scrapes Twitter without API.
- GitDorker — automated GitHub dorking for secrets.
Domain & Infrastructure:
- Amass — the GOAT for subdomain enumeration. Takes a while but finds everything.
- Shodan — no explanation needed. Internet scanning engine.
- CertSpotter / crt.sh — certificate transparency log monitoring.
- dnsdumpster.com — web-based DNS recon, great for quick checks.
Metadata:
- ExifTool — the one and only. Nothing else comes close.
- FOCA (Windows) — GUI tool that finds and extracts metadata from documents automatically. Underrated.
Paste & Leak Monitoring:
- PasteHunter — scrapes paste sites automatically. Great for continuous monitoring.
- GitGuardian (public) — checks GitHub for leaked secrets.
All-in-One OSINT Frameworks:
- SpiderFoot — the ultimate OSINT automation tool. Feed it a target, let it run for hours, get a full report.
- Recon-ng — modular recon framework, tons of modules.
- Sn0int — Rust-based, fast, supports custom modules.
Browser Extensions (Quick Wins):
- Wappalyzer — see what tech a site runs immediately.
- BuiltWith — deeper tech profiling.
- Hunter.io extension — one-click email finding from any LinkedIn page.
Phone Recon:
- PhoneInfoga — phone number OSINT. Country, carrier, line type, sometimes social media links.
Image OSINT:
- ExifTool (yes, again) — extracts GPS coordinates from photos.
- Google Images / Yandex — reverse image search.
- Forensically — browser-based image analysis.
Final note from [COLOR=rgb(184, 49, 47)]XvC[/COLOR]: You don't need every tool. Pick one from each category, learn it inside out, and you'll outperform someone who has 50 tools you barely understand. Depth > breadth every time.
— [COLOR=rgb(184, 49, 47)]XvC[/COLOR]
Written by [COLOR=rgb(184, 49, 47)]XvC[/COLOR]
Before We Start
Let me be real with you. What I'm about to lay out is not for harassing people, leaking private info, or being a menace. This is for pentesters, red teamers, and security researchers who need to understand how much of someone's digital life is sitting out in the open. If you're using this, you better have permission, a signed contract, or at least a damn good educational reason. Don't be stupid with it. -- Just kidding ROFL ^_^
---
Step 1: Start With What You Know
You usually start with one thing. A name. An email. A username. A domain. That's your entry point. From there, you pull threads.
The mindset: Everything leaves traces. People reuse usernames. They use the same email for their LinkedIn that they used for a forum back in 2012. They post their work email in a GitHub commit message. Your job is to connect the dots.
---
Step 2: Username Recon
This is the lowest hanging fruit. If you have a username, run it across platforms.
Tools to use:
sherlock [username]
whatsmyname -u [username]
maigret [username]
These will check hundreds of sites and tell you where that username exists. You'd be shocked how many accounts pop up from one Reddit username. People use the same handle on Twitter, GitHub, Discord, Steam, a random chess forum, and their old Myspace from 2007.
Manual method: Just Google the username in quotes. "xvcofficial" or whatever. Look at the results. Sometimes you find things the automated tools miss.
---
Step 3: Email Enumeration
An email address is a goldmine. It's usually tied to everything.
Check for breaches first:
- Have I Been Pwned
- DeHashed (if you have access)
- IntelX
If the email shows up in breaches, you now know the person's passwords (or at least old ones), which gives you pattern recognition. A lot of people use variations of the same password.
Validate email format:
- Hunter.io — tells you the email pattern for a domain
- Phonebook.cz — dumps all known emails for a domain
- EmailRep.io — gives a risk score for an email
Google dork:
"[email protected]" filetype:pdf
"[email protected]" site:github.com
"[email protected]" site:pastebin.com
You'd be surprised what shows up in PDF metadata, public Trello boards, or Slack invite links.
---
Step 4: Social Media Deep Dive
This is where you build the profile. Not just what they post, but what they reveal without realizing it.
LinkedIn:
- Look at their work history. Every job tells you something.
- Check their skills section — that tells you what tech stacks they use.
- Look at mutual connections. Sometimes the target isn't the person, but someone connected to them.
- Company pages show org structure.
GitHub:
- Check commit history. People paste credentials in code and forget.
- Look at their profile README. Sometimes full contact info is there.
- Check their email in commits: git log --format='%ae' | sort -u
- Look at repos they starred — tells you their interests, tech preferences.
Twitter / Reddit / Discord:
- Scrape their posts for personal details disclosed casually.
- "Just moved to Austin!" — now you know their location.
- "Started at Google this week" — now you know their employer.
- "My birthday is tomorrow" — now you have a DOB.
All of this from public posts. They gave it away. You just collected it.
---
Step 5: Domain & Infrastructure Recon
If you're researching an organization (or someone who owns a domain):
DNS enumeration:
dig any target.com
whois target.com
dnsrecon -d target.com
Subdomain discovery:
subfinder -d target.com
amass enum -d target.com
Check certificate transparency logs at crt.sh — this finds subdomains that aren't in public DNS.
Shodan:
Search the domain or IP range. Find exposed services. RDP, databases, cameras, whatever. You'd be shocked what orgs leave on the public internet.
---
Step 6: Metadata Mining
Documents leak information. PDFs, Word docs, images — they all carry metadata.
Google dorks for finding documents:
site:target.com filetype:pdf
site:target.com filetype:docx
site:target.com filetype:xlsx
Once you download them:
exiftool document.pdf
pdfinfo document.pdf
You get author names, company names, software versions, sometimes usernames, sometimes full paths that reveal internal network structure like C:\Users\jsmith\Documents\.
---
Step 7: Pastebin, Gists & Leak Sites
People dump all kinds of things publicly.
Search paste sites:
site:pastebin.com "target.com"
site:gist.github.com "target.com"
Some people push internal configs, API keys, or credentials to these sites for "quick sharing" and forget to delete them.
Telegram channels:
Some leak channels post credential dumps. Not saying you should use them, but for a red team engagement, knowing what's already out there is valuable intel.
---
Step 8: Putting It All Together
Now you have:
Data Point | Source
--------------------|------------------------------
Full name | LinkedIn, WHOIS
Email | Breach data, Hunter
Username(s) | Sherlock
Employer | LinkedIn
Location | Social media, WHOIS
Tech stack | GitHub, LinkedIn skills
Password patterns | Breach data
Subdomains | crt.sh, Amass
Exposed services | Shodan
From one username and a domain, you just built a profile. That's the game.
---
What You Do With This
In a legal, authorized engagement, you:
1. Document everything in your report
2. Show the client what an attacker can find
3. Recommend mitigations (lock down LinkedIn, remove metadata from public docs, monitor paste sites, etc.)
4. Delete all data when the engagement is over
You do not share it. You do not post it. You do not use it for personal gain.
---
Final Word From [COLOR=rgb(184, 49, 47)]XvC[/COLOR]
This isn't magic. It's just knowing where to look and being patient. The internet is a giant archive of bad decisions. People forget that "public" means "anyone can see it." Your job as a researcher is to remind them of that — by finding it first, before someone with bad intentions does.
Stay unethical. Stay unauthorized. And don't be a dick.
---------------- ([COLOR=rgb(184, 49, 47)]XvC's Picks[/COLOR]) ----------------
Username Recon:
- Maigret — by far the best. More sites checked, better results, actively maintained. Sherlock is fine but Maigret is king.
- Honorable mention: WhatsMyName (web version at whatsmyname.app)
Email Enumeration:
- theHarvester — does email, subdomain, and IP all in one. A beast.
- Holehe — checks if an email is registered on specific sites without alerting the user.
- Honorable mention: Hunter.io (web, rate limited but solid)
Breach Checking:
- DeHashed — paid but worth every penny. Best breach database available.
- IntelX — good free alternative, has a Telegram bot too.
- Honorable mention: Have I Been Pwned (limited but free)
Social Media Scraping:
- Twayback — downloads someone's entire deleted tweet history from Wayback Machine. Nasty but effective.
- Twint (if still working) — scrapes Twitter without API.
- GitDorker — automated GitHub dorking for secrets.
Domain & Infrastructure:
- Amass — the GOAT for subdomain enumeration. Takes a while but finds everything.
- Shodan — no explanation needed. Internet scanning engine.
- CertSpotter / crt.sh — certificate transparency log monitoring.
- dnsdumpster.com — web-based DNS recon, great for quick checks.
Metadata:
- ExifTool — the one and only. Nothing else comes close.
- FOCA (Windows) — GUI tool that finds and extracts metadata from documents automatically. Underrated.
Paste & Leak Monitoring:
- PasteHunter — scrapes paste sites automatically. Great for continuous monitoring.
- GitGuardian (public) — checks GitHub for leaked secrets.
All-in-One OSINT Frameworks:
- SpiderFoot — the ultimate OSINT automation tool. Feed it a target, let it run for hours, get a full report.
- Recon-ng — modular recon framework, tons of modules.
- Sn0int — Rust-based, fast, supports custom modules.
Browser Extensions (Quick Wins):
- Wappalyzer — see what tech a site runs immediately.
- BuiltWith — deeper tech profiling.
- Hunter.io extension — one-click email finding from any LinkedIn page.
Phone Recon:
- PhoneInfoga — phone number OSINT. Country, carrier, line type, sometimes social media links.
Image OSINT:
- ExifTool (yes, again) — extracts GPS coordinates from photos.
- Google Images / Yandex — reverse image search.
- Forensically — browser-based image analysis.
Final note from [COLOR=rgb(184, 49, 47)]XvC[/COLOR]: You don't need every tool. Pick one from each category, learn it inside out, and you'll outperform someone who has 50 tools you barely understand. Depth > breadth every time.
— [COLOR=rgb(184, 49, 47)]XvC[/COLOR]