Technical OSINT Fundamentals

Code Examples: Work with Domains and Names

Connecting to LMS... Progress: in progress

Code Examples

Collect Basic Domain Records for In-Scope Names

# scope_domains.txt contains one approved domain per line.
while read -r domain; do
  test -z "$domain" && continue
  printf "### %s\n" "$domain"
  dig +time=3 +tries=1 +noall +answer NS "$domain"
  dig +time=3 +tries=1 +noall +answer SOA "$domain"
done < scope_domains.txt > domain-naming-observations.txt

Normalize Candidate Hostnames Without Rewriting Meaning

from urllib.parse import urlparse


def normalize_hostname(value: str) -> str:
    value = value.strip()
    parsed = urlparse(value if "://" in value else f"//{value}")
    hostname = (parsed.hostname or "").lower().rstrip(".")
    return hostname


candidates = [
    "https://App.EXAMPLE.org/login",
    "mail.example.org.",
    "dev-vendor.example.net",
]

for candidate in candidates:
    hostname = normalize_hostname(candidate)
    interpretation = "name contains dev" if ".dev" in hostname or "dev-" in hostname else "literal name only"
    print(hostname, interpretation, sep="\t")