OSINT pour l’entreprise : surveiller sa marque et ses risques

Ce que vous saurez faire à la fin

1. Auditer l’empreinte numérique de votre entreprise
2. Détecter fuites, secrets GitHub, typosquatting
3. Monitorer mentions et exposition Shodan
4. Dashboard OSINT hebdo automatisé

Étape 1 — DNS et certificats

subfinder -d example.sn -silent
amass enum -passive -d example.sn

curl -s 'https://crt.sh/?q=%25.example.sn&output=json' \
  | jq -r '.[].name_value' | sort -u

dig TXT _dmarc.example.sn +short

Étape 2 — Have I Been Pwned

curl -H "hibp-api-key: $HIBP_KEY" \
  https://haveibeenpwned.com/api/v3/breacheddomain/example.sn

Étape 3 — Secrets GitHub publics

gitleaks detect --source https://github.com/monorg --no-git

trufflehog github --org=monorg --only-verified

gh search code "ANTHROPIC_API_KEY" --owner monorg

Étape 4 — Shodan

pip install shodan
shodan init YOUR_KEY

shodan search "ssl:example.sn"
shodan search "org:"ITSKILLSCENTER""
shodan search "port:9200 country:SN"

Étape 5 — Typosquatting

pip install dnstwist
dnstwist --registered example.sn

# Chaque variation enregistrée = surveiller

Étape 6 — Mentions de marque

import feedparser

flux = {
  "Google Alerts": "https://www.google.com/alerts/feeds/ID1/ID2",
  "Reddit": "https://www.reddit.com/r/all/search.rss?q=example.sn",
}

for nom, url in flux.items():
    feed = feedparser.parse(url)
    for entry in feed.entries[:10]:
        print(nom, entry.title, entry.link)

Étape 7 — Métadonnées PDF

# Télécharger tous les PDF publics
wget -r -l2 -A pdf,docx,xlsx https://example.sn/

# Extraire métadonnées
exiftool -r -a -u -G1:1 example.sn/ | head -100

# Cherchez: chemins internes "C:\Users\", auteurs, versions logiciel

Étape 8 — Enum emails Hunter.io

curl "https://api.hunter.io/v2/domain-search?domain=example.sn&api_key=$HUNTER_KEY"

# Identifier les adresses publiques → renforcer DMARC

Étape 9 — Wayback Machine

curl -s "https://web.archive.org/cdx/search/cdx?url=example.sn&output=json&limit=20" | jq

# Révèle parfois des fichiers sensibles retirés

Étape 10 — Dashboard hebdo

import os, requests
from slack_sdk import WebClient
from datetime import date

slack = WebClient(token=os.environ["SLACK_TOKEN"])
findings = []

# Nouveaux sous-domaines
subs = subprocess.check_output(
    ["subfinder", "-d", "example.sn", "-silent"], text=True
).splitlines()
if len(subs) > 50:
    findings.append({"severity":"med", "detail": f"{len(subs)} sous-domaines"})

# HIBP breaches
r = requests.get(
    "https://haveibeenpwned.com/api/v3/breacheddomain/example.sn",
    headers={"hibp-api-key": os.environ["HIBP_KEY"]}
)
if r.ok and r.json():
    findings.append({"severity":"high", "detail": f"{len(r.json())} breaches"})

# Typosquatting
typo = subprocess.check_output(["dnstwist", "--registered", "--format", "json", "example.sn"])
import json
nouveaux = [v for v in json.loads(typo) if v.get("dns_a")]
if nouveaux:
    findings.append({"severity":"med", "detail": f"{len(nouveaux)} typosquats"})

msg = f"*OSINT hebdo — {date.today()}*\n"
for f in sorted(findings, key=lambda x: x["severity"], reverse=True):
    msg += f"• {f['severity']}: {f['detail']}\n"
slack.chat_postMessage(channel="#secu", text=msg)

Checklist

✓ Sous-domaines diff vs baseline
✓ HIBP check domaine
✓ gitleaks sur repos publics
✓ Shodan query org
✓ dnstwist typosquat
✓ Google Alerts configurées
✓ Métadonnées PDF surveillées

Respect légal : OSINT = données publiques uniquement. Jamais de contournement d’auth ni de scraping violant CGU.