Post cover image

August 26, 2026

Practical OSINT for Penetration Testers: External Active Directory Footprinting Walkthrough

A step-by-step technical guide on ASN mapping, DNS enumeration, document metadata extraction, and breach data hunting during external…

By Adithya Venkatraman

4 min read

A step-by-step technical guide on ASN mapping, DNS enumeration, document metadata extraction, and breach data hunting during external Active Directory assessments.

Before an adversary or penetration tester attempts initial access against an Active Directory (AD) environment, they must understand the target's external footprint. External Active Directory enumeration focuses on mapping an organization's publicly exposed assets, naming conventions, and security posture without triggering internal alerts.

Conducting thorough external reconnaissance serves three critical objectives

  1. Credential Identification — Uncovering leaked or exposed credentials that can alter the test outcome.
  2. Scope Validation — Verifying the accuracy of the target list provided by the client
  3. Accidental Target avoidance — Ensures that no third party shared infrastructure or out-of-scope assets are tested.

In this guide, we will walk through a comprehensive methodology for external Active Directory recon based on hands-on lab exercises from the Hack The Box (HTB) Active Directory Enumeration and Attacks module

Target Domain : 'inlanefreight.com'

What We Search For: The External Target Profile

When assessing an organization from the outside, reconnaissance targets five primary data categories:

  1. IP Space and Netblocks: Validate Autonomous system numbers (ASN), netblocks in use, public cloud presence (AWS, Azure, GCP), and hosting providers.
  2. Domain & DNS Data: Is there any secondary domain, subdomains, publicly exposed domain services (like SMB, mail servers, kerberos endpoints ,etc,) and what perimeter defence is present.
  3. Username & Schema Formats: Uncovering employee email structures and AD username conventions to build target lists for password spraying and credential stuffing.
  4. Data Disclosures: Publicly hosted files (.pdf, .docx, .xlsx, .ppt) containing author names, software versions, or internal network paths.
  5. Breached Data: Historical data that are exposed which contains corporate emails, cleartext password and password hashes.

Phase 1: Finding Address Spaces & ASN Mapping

Large organizations frequently operate self-hosted infrastructure under their own Autonomous System Number (ASN), whereas smaller entities rely on shared cloud hosting (AWS, Cloudflare, DigitalOcean).

BGP & Netblock Lookup

We start by querying network registries (ARIN, RIPE, IANA) and BGP toolkits to identify IP blocks assigned to the target organization.

Target Domain: inlanefreight.com
Primary Public IP: 134.209.24.248
Mail Server: mail1.inlanefreight.com
Nameservers: NS1.inlanefreight.com, NS2.inlanefreight.com
It is the output of the bgp took showing the mailservers info

⚠️ CAUTION: Cloud Authorization & Multi-Tenant Infrastructure When performing external reconnaissance against target assets hosted on shared cloud providers (e.g., AWS, GCP, Azure, Oracle Cloud), operators must strictly adhere to the provider's Rules of Engagement to avoid impacting co-hosted tenants. While providers like AWS permit security testing on specific services without prior authorization, others such as Oracle Cloud require submitting a formal Cloud Security Testing Notification before initiating any active probes. Always verify hosting providers during ASN mapping and ensure third-party authorization is secured prior to testing.

Phase 2: DNS Sleuthing & Scope Validation

Client scope documents are often incomplete. DNS enumeration allows us to discover reachable hosts that the client may have omitted.

Reverse IP Lookup & Verification

Using tools like ViewDNS.info or DomainTools, we run reverse IP lookups against the primary host IP (134.209.24.248) to uncover co-hosted sites or related subdomains.

None

We then perform manual DNS queries against public resolvers to uncover secondary hosts and mail servers. using nslookup

None 
nslookup ns1.inlanefreight.com

nslookup ns2.inlanefreight.com

Through DNS resolution, we discover additional internal/external endpoints:

  • 178.128.39.165
  • 206.189.119.186

⚠️ Rule of Engagement: Always cross-check newly discovered IP addresses against the client's scope agreement before performing active probes.

Phase 3: Public Data Leakage & Tech Stack Footprinting

public files and recruitment pages leak valuable information about internal software configurations and organizational structures.

Analyzing Job Postings

Example:

A job listing requiring experience with "SharePoint 2013/2016 migration and troubleshooting".

  • Legacy SharePoint implementations are active in the environment.
  • Software upgrades may be incomplete, leaving known CVEs exposed internally.

Google Dorking & Document Scraping

We use search engine operators to locate publicly exposed files containing corporate metadata:

filetype:pdf inurl:inlandefreight.com

None

intext:"@inlanefreight.com" inurl:inlanefreight.com

Exctracted documents can be analyzed using 'exiftool' to recover author names, software versions and internal file paths. Additionally developer repositories can be analyzed using 'trufflehog' or 'greyhat warfare' to recover accidental secret exposure.

Phase 4: Target Username Harvesting & Breach Data Mining

Once domain infrastructure is mapped, we build target user lists formatted for future password spraying or initial access attempts.

Username Scraping with 'linkedin2username'

python3 linkedin2username.py -c "InLaneFreight"

Breach Data Hunting with Dehashed

We query breach databases like Dehashed using API scripts

sudo python3 dehashed.py -q 'inlanefreight.local' -p
None
  • Breached data can take advantage of corporate employees reusing passwords for personal services.

Defensive Remediation & Hardening Strategies

  1. Strict metadata Sanitization: Strip author names, path names and software versions from all file uploads in web servers.
  2. Job Posting Guidlines: Ensure job listings describe broad skill requirements rather than specific legacy software versions or internal network configurations.
  3. Continuous Breach Monitoring: Leverage threat intelligence services to monitor breach dumps for corporate domain emails and enforce mandatory password resets for compromised accounts.
  4. Perimeter DNS Hardening: Restrict DNS zone transfers (AXFR), block unnecessary public service exposure (SMB, RPC, LDAP), and enforce MFA across all external portals.

References & Tools