Post cover image

July 23, 2026

Complete OSINT Investigation Setup and Process In HomeLab Part-1

Make sure you have legal authorization to perform OSINT on your target domain.

By MainEkHacker

3 min read

**Before you begin:**Only investigate domains you own, have permission from the owner, or are conducting authorized security testing on. OSINT itself is legal, but unauthorized testing can violate computer fraud laws.

Hey hackers👋

I'm a passionate cybersecurity enthusiast and ethical hacker. I love solving CTFs Finding Weakness in system & vulnerabilities, while also diving into recently discovered vulnerabilities to enhance my skills.

Home Lab Environment Setup

Your VM Configuration:

Kali Linux VM — primary penetration testing and OSINT tools

Network — isolated lab network (recommended) or air-gapped for maximum safety

Initial Steps:

Create a dedicated folder on your host machine for storing OSINT findings

Take snapshots of both VMs before starting (allows you to revert if needed)

Ensure both VMs have internet access (or use a proxy/VPN for privacy)

None

OSINT Investigation Phases:

Phase 1: Domain & DNS Reconnaissance

Tools & Commands on Kali:

# Install/update toolssudo apt-get update && sudo apt-get install dnsrecon whois curl wget dig
# WHOIS lookup - reveals registrant info, registrar, nameserverswhois example.com
# DNS enumeration with dnsrecondnsrecon -d example.com -t std
# Manual DNS queriesdig example.com ANYnslookup example.comhost example.com
# Query specific DNS record typesdig example.com MX          # Mail serversdig example.com NS          # Nameserversdig example.com TXT         # Text records (SPF, DKIM, etc.)dig example.com A           # IPv4 addressesdig example.com AAAA        # IPv6 addresses

What you'll find:

  • Registrant information (name, organization, contact details from WHOIS)
  • Registrar and registration date
  • Nameservers used by the domain
  • Mail servers (MX records)
  • IP addresses associated with the domain
  • SPF/DKIM records (email security info)

Phase 2: IP Address & Infrastructure Analysis

Tools & Commands:

# GeoIP and IP info lookupwhois [IP_ADDRESS]curl ipinfo.io/[IP_ADDRESS]
# Reverse DNS lookupnslookup [IP_ADDRESS]dig -x [IP_ADDRESS]
# Check if IP has multiple domains (reverse lookup)dig -x [IP_ADDRESS] @8.8.8.8
# Subnet and range discoverynmap -sL [IP_RANGE]        # List IPs in range without scanning

Use Passive DNS Tools:

  • VirusTotal (virustotal.com) — upload domain, see DNS history and IPs
  • SecurityTrails (securitytrails.com) — extensive DNS and IP history
  • Censys (censys.io) — search internet-connected devices and certificates
  • Shodan (shodan.io) — search for internet-facing services by IP

Phase 3: Subdomain Enumeration:

# Passive subdomain enumeration (no scanning)sudo apt-get install sublist3rsublist3r -d example.com -o subdomains.txt
# DNS brute force (careful – generates traffic)dnsrecon -d example.com -D /usr/share/wordlists/dnsmap.txt -t brt
# Using amass (comprehensive subdomain discovery)sudo apt-get install amassamass enum -d example.com -o amass_results.txt
# Reverse whois to find related domainsecho "example.com" | whois -H | grep -i "domain:

Record findings: Create a list of all discovered subdomains and their IPs.

Phase 4: Web Technology & Server Analysis

# Identify web server technologiescurl -I https://example.com                    # Check headerswhatweb example.com                            # Identify CMS, frameworks, etc.
# SSL/TLS certificate analysisopenssl s_client -connect example.com:443 -showcertscurl -s https://example.com | head -50        # Check for certificate errors
# Certificate transparency logs (find all certs issued for domain)curl "https://crt.sh/?q=%25.example.com&output=json" | jq '.'
# HTTP security headers analysiscurl -I -H "User-Agent: OSINT" https://example.com

On Ubuntu (using online tools):

  • Shodan CLI — search by domain
  • Built With (builtwith.com) — identify tech stack
  • BuiltWith — CMS, frameworks, analytics platforms used

Phase 5: Email & Personnel Discovery

# Find email addresses associated with domainsudo apt-get install theharvestertheHarvester -d example.com -l 500 -b google,bing,yahoo,linkedin
# Check for email breaches# (Use haveibeenpwned.com in browser on Ubuntu VM)
# OSINT on found email addresses# (Tools like phonebook.cz, hunter.io, clearbit.com)

Phase 6: Social Media & Personnel OSINT

On Ubuntu VM (using browser):

  • Search for company name/domain owner on LinkedIn, Twitter, GitHub
  • Check Google Search for press releases and news
  • Look for employee directories or company information
  • Search GitHub for source code leaks or company repositories
  • Review Twitter/X for company announcements, tech stack mentions

Command-line tools on Kali:

# Search for GitHub repositoriescurl -s "https://api.github.com/search/repositories?q=example.com" | jq '.'
# Automated OSINT gatheringsudo apt-get install sherlocksherlock username@example.com            # Find social media accounts

Phase 7: Wayback Machine & Historical Data

# Automated wayback machine accesswget -q -O - "https://archive.org/wayback/available?url=example.com&output=json" | jq '.'
# Or browse manually on Ubuntu:# wayback-machine.com or archive.org

What you'll discover:

  • Old versions of the website
  • Forgotten admin panels or endpoints
  • Outdated technology listings
  • Previous directory structures

Phase 8: Google Dorking

Use on Ubuntu browser or Kali (via curl):

# Search for sensitive information indexed by Google# Examples (never execute against unauthorized targets):
site:example.com filetype:pdf        # PDFs on domainsite:example.com "admin"             # Admin pagessite:example.com inurl:backup        # Backup filessite:example.com inurl:config         # Config filessite:example.com inurl:database       # Database files

Phase 9: Passive Reconnaissance Automation

All-in-One Tools on Kali:

# Recon-ng (comprehensive OSINT framework)sudo apt-get install recon-ngrecon-ng> marketplace search whois> marketplace install whois-pocs/whois_get_registrant> workspace create osint_workspace> db insert domains> run
# OSINT Framework integration# Download: https://github.com/lockfale/OSINT-Framework# Or use online version
# Maltego (visual OSINT mapping)sudo apt-get install maltego# (Requires free community edition registration)

Data Organization & Analysis

Create a structured report:

  1. DOMAIN INFORMATION - Registrant: - Registrar: - Registration Date: - Nameservers:
  2. IP ADDRESSES & INFRASTRUCTURE - Primary IP: - Geolocation: - Hosting Provider: - Other Domains on Same IP:
  3. SUBDOMAINS - [List discovered subdomains]
  4. WEB TECHNOLOGIES - Server: - CMS/Framework: - Analytics:
  5. PERSONNEL & SOCIAL PRESENCE - Identified Employees: - Social Accounts:
  6. INTERESTING FINDINGS - [Key discoveries]
  7. RECOMMENDATIONS - [For security assessment]EOF