<h1>Reconnaissance with Osmedeus</h1>

Osmedeus is a fully automated offensive security framework for reconnaissance and vulnerability scanning. Like all the other tools in the category, Osmedeus allows you to automate some of the boring stuff like footprinting and scanning a target using a collection of awesome tools.

Osmedeus installation

Osmedeus doesn’t ship with Kali Linux, so you will have to install it from the official repository.

The generic steps to install Osmedeus on Kali Linux are as follow:

• Choose a directory of your liking (I install these external tools to /opt)
• Clone the GitHub repository:

git clone https://github.com/j3ssie/Osmedeus

• Install the application

cd Osmedeus

./install.sh

You can now start the application either from the CLI or from the menu if you take two minutes to add there. I’ve previously mentioned alacarte and you can use it again to add another icon to your list of Info Gathering tools.

Using Osmedeus

Unlike most of the other OSINT tools, Osmedeus does not require you to configure any API keys. Therefore, this application is fairly simple to use.

The results will be saved in separate folders, inside a general folder for each target also referred to as a workspace like in Recon-ng.

Running Osmedeus to scan for subdomains

The tool currently has eight modules with different goals:

• subdomain - Scanning subdomain and subdomain takeover
• portscan - Screenshot and Scanning service for list of domains
• screenshot - Screenshot list of hosts
• vuln - Scanning version of services and checking vulnerable service
• git - Scanning for git repo
• burp - Scanning for burp state
• dirb - Do directory search on the target
• ip - IP discovery on the target

I will run only the subdomain because I want to gather additional information on a previous target. For this kind of information request, Osmedeus runs the following apps:

• Amass
• subfinder
• massdns
• assetfinder
• gobuster
• findomain
• goaltdns

The command is very simple.

• Just type:

./osmedeus.py -m subdomain -t sans.org

And the final results will be written in a single text file under the aforementioned folder.

Running Osmedeus in report mode

Osmedeus has a text report mode and a Web UI.

• Just type :

/osmedeus.py --report help

(will start the Web UI)

Open the link in your favorite browser:

Conclusions:

Osmedeus is a good application to add to your OSINT toolbox. Specially because it automates the use of a different set of tools and therefore it might get some extra results.

Next post: Footprinting with Sublist3r