OSINT - Infrastructure

DNSStuff Toolbox [http://www.dnsstuff.com/tools]
Hurricane Electric BGP Toolkit [http://bgp.he.net/]
Recon-ng [https://bitbucket.org/LaNMaSteR53/recon-ng]
Maltego Community Edition (CE) [https://www.paterva.com/]
TheHarvester (Edge Security) [http://www.edge-security.com/theharvester.php]
TheHarvester (GitHub) [https://github.com/laramies/theHarvester]
Shodan [https://shodan.io/]
CVE Details [https://www.cvedetails.com/]
Robtex [https://www.robtex.com/]
Reddit - Sysadmin [https://www.reddit.com/r/sysadmin/]
Reddit - Users [https://www.reddit.com/user/username]
Qualys SSL Labs [https://www.ssllabs.com/]
Mozilla Observatory [https://observatory.mozilla.org/]
PunkSPIDER [https://www.punkspider.org/]
TinEye Reverse Image Search [https://www.tineye.com/]
Google Images [https://images.google.com/]

---------------------------------------
Search Engine Queries - Email Addresses
---------------------------------------
  mailto company_domain.com
  site:company_domain.com directory

---------------------------------------
Search Engine Queries - Vulnerabilities
---------------------------------------
  site:cvedetails.com product_name version

-------------------------------------------
Search Engine Queries - Purchase Agreements
-------------------------------------------
  “company_name” “purchase agreement” filetype:pdf
  site:company_domain.com “purchase agreement”

---------------------------------------------
Search Engine Queries - Remote Access Portals
---------------------------------------------
  “company_name” vpn
  “company_name” remote access
  site:company_domain.com inurl:vpn
  site:company_domain.com inurl:remote