agentleFS
Sign inStart free
Zen1th53Zen1th53/codex-red/Skills/recon/offensive-osint/SKILL.md

offensive-osint

Skill1 starsChanged 50 days agoMITView on GitHub

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.

6 other projects use a version of this, 3 of them edited.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

1 rule. 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 5 edited versions we read keep these.

  • 0

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    Use JSONL (NDJSON) logs with run_id and tool versions for reproducibility

    line 368

“Common” is measured: kept by at least 6 in 10 of the 5 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Offensive OSINT Methodology

Workflow

  1. Define target scope (domain, org, person, crypto address, or geo subject)
  2. Select applicable categories below based on scope
  3. Work top-down within each category; pivot on discovered artifacts
  4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
  5. Log findings in JSONL with a run_id and tool versions for reproducibility
  6. Suggest next steps based on what each tool returns

General OSINT

Search Engines

ToolNotes
Carrot2Clusters results by topic
etoolsMetasearch engine
KagiPrivacy-first, non-personalized results
Brave SearchIndependent index; Goggles for custom ranking
PDF SearchSearch PDF files and view table of contents
Google Fact Check ExplorerCross-site fact-check search

Username & Email Investigation

ToolPurpose
SherlockUsername search across social networks
MaigretCollect profiles by username from many sites
What's My NameUsername search across platforms
HoleheCheck if email is registered on platforms
EpieosEmail address pivots and metadata
OSINT IndustriesEmail/username/phone lookups
Hunter.ioFind email addresses for a domain
EmailRepEmail reputation and associated data
EmailableVerify email existence
MugetsuX/Twitter username history
RocketReach / ApolloEmail enrichment and pattern guessing
PhoneInfogaPhone number intelligence framework

Browser extensions: GetProspect, SignalHire

People Search

Phone Number OSINT

Social Media

PlatformTool
InstagramPicuki — view profiles without account
X/Twittersnscrape — preferred CLI scraper; use Twint only as fallback
FacebookGraph Search, sowsearch.info, lookup-id.com, whopostedwhat.com
Facebook (research)Meta Content Library — CrowdTangle successor (researcher-gated)
YouTube/TwitchSocial Blade — analytics
TikTokTokboard — trend and profile analytics
RedditReveddit — removed content; RedTrack.social — user history
BlueskyFiresky — real-time firehose; SkyView — follower graphs
MastodonFediSearch — cross-instance search; Fedifinder — find Twitter users on Mastodon
FacesSearch4Faces

Public Records & Company Information

RU/CN Registries

Russia: Rusprofile, Kontur.Focus (freemium), zakupki.gov.ru (procurement), EGRUL/EGRIP (official, captcha-gated)

China: GSXT (National Enterprise Credit), Qichacha/Tianyancha (freemium), MIIT ICP/Beian (ICP filings)

Sanctions & Compliance

Breach & Leak Data

Infrastructure & Attack-Surface OSINT

ASN/BGP & Internet Measurement

Certificates & CT Monitoring

  • crt.sh — Search Certificate Transparency logs
  • Censys Certificates — CT and x509 attribute pivots
  • CertStream — Real-time CT feed via WebSocket
  • Rapid7 Open Data — Sonar DNS/HTTP/SSL datasets
  • Cert Spotter [Freemium] — CT monitoring and alerts
  • Favicon hash (mmh3): cluster infrastructure; pair with Shodan/Censys favicon search

Threat Intel & IOCs

Malware Analysis & Sandboxes

Cryptocurrency OSINT

Blockchain Explorers

ChainExplorer
BitcoinBlockchain.com, Blockchair
EthereumEtherscan
BNB ChainBSCScan
Polygon PoSPolygonScan
SolanaSolscan
Multi-chainOKLink [Freemium], Cielo

L2 Explorers: Arbiscan, Optimistic Etherscan, BaseScan, zkSync Era, L2Beat (risk/TVL comparison)

Transaction Tracking & Analytics

NFT & Exchange Intelligence

Bridge Monitoring

Media Intelligence

Reverse Image & Facial Search

Image Forensics

  • Forensically — Digital image forensics toolkit
  • ExifTool — Read/write/edit metadata
  • Jimpl — Online EXIF viewer
  • Metadata Viewer — Browser-local EXIF, IPTC, XMP, and supported C2PA inspection
  • FOCA — Metadata in documents
  • Metagoofil — Extract metadata from public documents
  • C2PA Verify — Verify content credentials and AI provenance

Preserve the original artifact and corroborate important metadata values with a second parser before drawing conclusions.

Video Analysis

Browser Extensions for Media

Geospatial Intelligence

Satellite Imagery & Mapping

Geolocation Tools

Street View: Google Street View, Apple Maps, Yandex Maps, Baidu Maps

Flight OSINT

Maritime OSINT

AI-Assisted OSINT

Warning: Never paste PII, sensitive IOCs, or unique pivots into cloud LLMs. They log inputs and may use them for training. Use local models (Ollama, LM Studio) for sensitive analysis.

ToolStrength
ChatGPT (paid)Log parsing, dataset analysis, Code Interpreter for CSVs/JSON, GPT-4 Vision for image OCR
Codex (paid)200K token context for large document dumps and report synthesis
Gemini 1.5 Pro2M token context; Deep Research mode with citations
Perplexity Pro (paid)Real-time web search + reasoning; multi-query synthesis

Local/privacy-preserving: Ollama (Llama 3, Mistral), LM Studio, GPT4All

Commercial AI OSINT Platforms

Deepfake & Synthetic Media Detection

Archiving & Evidence Preservation

  • archive.today — One-page content archiver with screenshot
  • URLScan.io — On-demand webpage scan with resource map
  • ArchiveBox — Self-hosted archiving (HTML, PDF, screenshots, media)
  • Hunchly — Evidence capture for investigators (paid)
  • Wayback SavePageNow API v3 — On-demand archiving with job IDs
  • SingleFileZ — Browser extension for offline HTML archives
  • Kasm Workspaces — Containerized OSINT workspace/browser isolation

Evidence handling:

  • Capture: URL + timestamp + PNG screenshot + WARC/SingleFileZ archive
  • Hash all downloaded files (SHA-256) and record in case notes
  • Separate work profiles/containers per case; store evidence read-only
  • Use JSONL (NDJSON) logs with run_id and tool versions for reproducibility

Automation & Workflows

  • n8n — Self-hosted workflow automation (e.g., RSS → scrape → alert pipelines)
  • Huginn — Agent-based monitoring, scraping, alerting
  • Playwright — Headless browser automation with stealth plugins
  • Browsertrix Crawler — Archival crawling with WARC export
  • Prefect / Apache Airflow — Workflow orchestration for data pipelines

Regional Search Engines

Telegram & Messaging Intelligence

  • TGStat — Channel analytics and search
  • Telemetr — Channel growth, overlaps, forwards
  • Combot — Group analytics (partially paid)
  • TelegramDB Search Bot — Basic Telegram OSINT
  • Discord ID — Basic Discord account information
  • Sogou Weixin search — WeChat Official Accounts content search
  • View public Telegram channels: https://t.me/s/<channel>

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free