⚠ Experiencing a security incident right now? Urgent contact — (813) 321-2006 · Send urgent message
URGENT: Under attack?Free Risk Assessment
Free PDF · 44 pages

A Pentester's Guide: OSINT, Breach Dumps & External Footholds

The full external attack chain — from passive recon and LinkedIn OSINT to breach dumps, hash capture, and WAF bypass. Written by NaviSec practitioners from real-world engagements.

What's inside the guide

A five-chapter walkthrough of the full external attack chain — from open-source intelligence gathering to capturing credentials and bypassing edge security.

  • Passive Recon & Asset Discovery
  • LinkedIn OSINT — Building Target Email Lists
  • Breach Dumps & Password Spraying
  • Hash Capture & External Footholds
  • Unmasking WAFs & Finding the Origin Server

44 pages. No filler. Techniques our team uses on real engagements.

Free PDF · 44 pages

The External Attack Chain

1 · OSINT: passive recon & asset discovery
2 · OSINT: LinkedIn is not just for jobs
3 · Breach dumps & password spraying
4 · Grabbing hashes & forging footholds
5 · Unmasking WAFs & finding the source

Get the free guide

Enter your email and we'll send the PDF straight to your inbox.

Sample

A look inside the guide.

Here's a sample from Chapter 3 — the kind of practical, step-by-step technique you'll find across all five chapters.

# Query Dehashed for breached credentials associated with a target domain
curl -s -u "your@email.com:API_KEY" \
  "https://api.dehashed.com/search?query=domain:target.com&size=100" \
  | jq '.entries[] | .email + ":" + .password' > creds.txt

# Spray extracted credentials against OWA / M365
spray.sh -u creds.txt -p Summer2024 -t owa.target.com -o results.txt

The full guide covers 5 attack phases with tool walkthroughs, command references, and screenshots from live testing environments.

Who it's for

Built for the field.

Penetration Testers

Looking for a structured methodology to follow on external assessments.

Red Teamers

Refining their OSINT and initial access workflows for adversary simulation engagements.

Security Students

Preparing for OSCP, CEH, or their first professional engagement.

Built by penetration testers

For penetration testers.

NaviSec is a Tampa-based offensive and defensive cyber security firm. Our engineers run penetration tests for Internal, External, Web Applications, IoT/Hardware devices, Physical security penetration testing, Red Team, Purple Team and more. NaviSec provides defensive services such as SOC/SIEM, Managed Detection and Response (MDR), and secure infrastructure design. We operate in nearly every industry including government, healthcare, finance, and manufacturing. We have pen tested jails, pasta factories and everything in between!

We've used this cheat sheet internally for many years and are releasing it now to the community.

Straight answers

Common questions.

What is OSINT in penetration testing?
OSINT (Open-Source Intelligence) is the practice of collecting publicly available information about a target — domains, IP addresses, employee names, email formats, and more — before any active testing begins. It's the first phase of every external engagement and often the most underestimated.
What is password spraying and why is it used instead of brute-forcing?
Password spraying tries a single common password (like “Summer2024”) against many accounts rather than many passwords against one account. This avoids triggering lockout policies that most organizations have enabled. When combined with breach credential data, it’s one of the highest-yield techniques in external assessments.
What are breach dumps and how are they used in pentesting?
Breach dumps are datasets of credentials exposed in past data breaches. Pentesters use services like Dehashed to identify whether target employees’ emails and passwords have been previously leaked. Reused passwords are extremely common — credentials from a 2018 breach frequently still work today.
How do penetration testers find the origin server behind a WAF?
Common techniques include checking historical DNS records (before the WAF was added), searching Shodan and Censys for the server’s SSL certificate, analyzing email headers, and triggering server-side requests to a Burp Collaborator listener. Chapter 5 of this guide walks through each method.
Is this guide free?
Yes. Enter your email above and we'll send it directly to your inbox. No credit card, no catch. You'll also receive occasional emails from NaviSec about new resources and guides — unsubscribe any time.
Does NaviSec offer penetration testing services?
Yes. NaviSec provides Black Box and White Box penetration testing, Red Team engagements, and CMMC compliance operations. Contact us to discuss an engagement.
Security is a journey, not a destination

Find out where you stand — free.

Take the free online risk assessment, or start with a confidential conversation about your risk, threats, and current cybersecurity posture.

Take the Free Risk Assessment
// online · confidential · no obligation