Security+ Hub
Objective 1 — Exposed Documents on Target Domain
The penetration test engagement letter authorizes passive OSINT against veridian-health.example. Your first task: discover any PDF documents indexed under the target domain. PDFs often contain patient intake forms, policy docs, and staff directories that were never meant to be public.
veridian-health.example. A too-broad query returns noise from other domains and fails the objective.
Authorized assessment — fictional target only. All results come from a simulated in-page index; no real network requests are made.
Show hint
site:target.com filetype:extOSINT context — SY0-701 2.x (Threat Intelligence): passive recon gathers data from publicly available sources without touching the target's systems. Indexed documents are a common OSINT finding in real assessments.
Objective 2 — Map Authentication Portals
Now identify every login and admin interface exposed on the target domain. Knowing the attack surface of authentication portals is a key deliverable in a penetration test scoping phase. A target may have multiple login pages (patient portal, staff portal, admin panel) that each represent a potential entry point.
veridian-health.example. A correct dork must match pages with "login" in the URL OR "admin" in the title, scoped to the target domain.
Authorized assessment — fictional target. Mapping auth surfaces is a standard passive recon step before any active testing begins.
Show hint
site:target.com inurl:login OR intitle:adminAttack surface mapping — identifying auth portals during passive recon avoids touching the target prematurely. This data feeds the scoping section of a pen test report (PTES / OSSTMM).
Objective 3 — Find Open Directory Listings
Web servers with directory browsing enabled expose their entire folder tree. These "Index of" pages are a gold mine: backup archives, unlinked scripts, database dumps, and SSH keys frequently appear in improperly secured directories. This is one of the most commonly exploited OSINT findings.
veridian-health.example. The page title of such pages is always "Index of /..." — construct a dork that matches this exact title pattern scoped to the target.
Authorized assessment. Directory enumeration is passive when performed via search engine cache — no direct web server contact.
Show hint
site:target.com intitle:"index of"Misconfiguration class — open directory listing is a CWE-548 exposure. In a real engagement this finding goes into the report as an information disclosure vulnerability, often rated MEDIUM severity.
Objective 4 — Locate Exposed Backup and Config Files
Configuration and backup files left in web-accessible locations are critical findings. A .env file contains database credentials and API keys; a .bak file is typically a copy of a live config or database. These file types should never be served over HTTP.
.env OR .bak files on veridian-health.example. Your dork must use a filetype/ext operator with OR logic to match both types, scoped to the target domain. Queries that omit the domain scope or target only one type fail.
Authorized assessment. Credential exposure via misconfigured file serving is a HIGH severity finding in most pen test frameworks.
Show hint
site:target.com filetype:env OR ext:bak. Both filetype: and ext: are accepted by this engine and are equivalent. OR must be uppercase.Credential exposure via file serving — classified as CWE-200 (Exposure of Sensitive Information). A real .env file typically contains DB_PASSWORD, API_SECRET, and cloud storage keys in plaintext.
Objective 5 — Discover Subdomain Intelligence
The final objective maps a specific non-obvious subdomain of the target: the staging environment. Staging servers are frequently misconfigured, often running with debug mode on, and may share credentials with production. Passive OSINT via Google can surface subdomains that do not appear in DNS brute-force wordlists.
staging.veridian-health.example subdomain specifically, and confirm it contains the string "internal use only" in the page body. Your dork must use site: scoped to the specific subdomain AND intext: to match the content. A dork that only scopes to the root domain returns too many results and fails.
Authorized assessment. Staging environment discovery is a critical passive recon finding — shadow IT surfaces routinely bypass WAF and patch cadences.
Show hint
site:staging.target.com intext:"internal use only"Shadow infrastructure — staging environments that are exposed to Google indexing are a common HIGH severity finding. They often run older software versions and reuse production credentials without MFA enforcement.
OSINT Analyst Certified
You conducted a full passive reconnaissance assessment against a sanctioned target — mapping exposed documents, authentication portals, open directory listings, credential-bearing config files, and subdomain infrastructure — using only publicly available search engine operators and zero direct target contact. That is the discipline of passive OSINT.
