recon-osint
Skill401 starsChanged 55 days agoMITView on GitHub
Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
5 other projects use a version of this.
Adopted by
Most recently taken up by
- noahfranklin/gideontheir own version, first seen Oct 13, 2026
- NoorQureshi/ronintheir own version, first seen Oct 11, 2026
- NoorQureshi/SploitAgenttheir own version, first seen Oct 11, 2026
- NoorQureshi/security-skillstheir own version, first seen Oct 11, 2026
- jessefmoore/offensive-claude-codetheir own version, first seen May 23, 2026
Other versions5 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 5
- NoorQureshi/security-skills★ 27same name
- NoorQureshi/ronin★ 26same name
- NoorQureshi/SploitAgent★ 26same name
- jessefmoore/offensive-claude-code★ 2same name
- noahfranklin/gideon★ 2same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository38 other files it gives its agents.
- CLAUDE.mdCLAUDE.md
- active-directory-attackSkill
- advanced-redteamSkill
- ai-agent-redteamSkill
- ai-securitySkill
- browser-exploitationSkill
- cicd-supply-chainSkill
- cloud-securitySkill
- coding-masterySkill
- container-k8s-escapeSkill
- crypto-analysisSkill
- edr-evasionSkill
- engagement-flowSkill
- engagement-memorySkill
- exploit-developmentSkill
- finding-disciplineSkill
- incident-responseSkill
- initial-accessSkill
- keylogger-archSkill
- malware-analysisSkill
- mobile-pentestSkill
- network-attackSkill
- opsec-disciplineSkill
- privesc-linuxSkill
- privesc-windowsSkill
- red-team-opsSkill
- reverse-engineeringSkill
- scope-disciplineSkill
- shellcode-devSkill
- threat-huntingSkill
- threat-model-disciplineSkill
- using-offensive-claudeSkill
- vulnerability-analysisSkill
- web-pentestSkill
- windows-boundariesSkill
- windows-mitigations-bypassSkill
- wireless-rfSkill
- writing-offensive-skillsSkill
The file
Files
SKILL.md
Reconnaissance & OSINT
When to Activate
- A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
- Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
- Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
- Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
- Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
- Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.
Technique Map
| Technique | ATT&CK | CWE | Reference | Script |
| Passive subdomain enum (subfinder/amass/CT logs) | T1590.002, T1596.001 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py |
| DNS brute / permutation / resolution (puredns/alterx/dnsx) | T1595.002, T1590.002 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py |
| ASN → CIDR → reverse-DNS expansion | T1590.005, T1596.005 | CWE-200 | references/subdomain-discovery.md | scripts/recon_orchestrator.py |
| HTTP probing + tech fingerprint (httpx) | T1595.002, T1592.002 | CWE-200 | references/attack-surface-mapping.md | scripts/recon_orchestrator.py |
| Headless crawling + archive URLs (katana/gau) | T1595.002, T1593.003 | CWE-200 | references/attack-surface-mapping.md | scripts/js_secret_hunter.py |
| JavaScript endpoint / secret extraction | T1593.003, T1552.001 | CWE-540 | references/attack-surface-mapping.md | scripts/js_secret_hunter.py |
| Subdomain takeover (dangling CNAME/NS) | T1583.001, T1584.001 | CWE-350 | references/subdomain-takeover.md | scripts/subdomain_takeover.py |
| Deleted-S3 takeover → supply-chain pivot | T1583.001, T1195.002 | CWE-350 | references/subdomain-takeover.md | scripts/subdomain_takeover.py |
| Multi-cloud bucket/blob enum (cloud_enum) | T1580, T1596.005 | CWE-732 | references/cloud-saas-recon.md | scripts/cloud_asset_enum.py |
| Azure tenant outsider recon (AADInternals) | T1590.001, T1589 | CWE-200 | references/cloud-saas-recon.md | scripts/cloud_asset_enum.py |
| GitHub/GitLab dorking + secret scanning | T1593.003, T1213.003 | CWE-540 | references/cloud-saas-recon.md | scripts/cloud_asset_enum.py |
| Email/username harvesting (theHarvester) | T1589.002, T1591 | CWE-200 | references/breach-credential-intel.md | scripts/breach_intel.py |
| Breach + infostealer credential intel (HIBP/DeHashed) | T1589.001, T1596 | CWE-522 | references/breach-credential-intel.md | scripts/breach_intel.py |
| CVE enrichment + prioritization (NVD/EPSS/KEV) | T1592.002, T1596 | CWE-1395 | references/cve-exploit-intel.md | scripts/cve_prioritizer.py |
| Shodan InternetDB exposure → CVE mapping | T1596.005, T1595.002 | CWE-200 | references/cve-exploit-intel.md | scripts/cve_prioritizer.py |
Quick Start
export DOMAIN=target.com
# 0. Validate resolvers once (puredns needs a clean list)
dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt
# 1. Full discovery + probe + crawl + takeover + nuclei, JSONL out (see orchestrator)
python3 scripts/recon_orchestrator.py -d $DOMAIN -o out/ --resolvers resolvers.txt --nuclei
# 2. JS/endpoint + secret hunting over live hosts
python3 scripts/js_secret_hunter.py -l out/httpx_live.txt -o out/js/
# 3. Dangling-DNS / subdomain-takeover triage
python3 scripts/subdomain_takeover.py -l out/all_subdomains.txt -o out/takeovers.jsonl
# 4. Cloud + code recon (buckets, Azure tenant, GitHub secrets)
python3 scripts/cloud_asset_enum.py -k $DOMAIN --company target --azure-domain $DOMAIN --gh-org target
# 5. People + breach/infostealer intel
python3 scripts/breach_intel.py --domain $DOMAIN --harvest --hibp --dehashed
# 6. Triage CVEs from fingerprints → KEV/EPSS/exposure ranked
python3 scripts/cve_prioritizer.py --from-httpx out/httpx_live.txt --ip-file out/ips.txt -o out/cve_ranked.jsonlOPSEC & Detection (summary)
| Technique | Telemetry / IOC | Detection (Sigma/EDR) | OPSEC note |
| Passive enum (CT/API) | None on target; queries hit 3rd-party APIs | Target cannot see it; CT-log monitoring (certstream) detects new certs only | Fully passive — prefer for stealth; no target traffic |
| DNS brute / resolution | Burst of NXDOMAIN/A queries to authoritative + resolvers | DNS firewall: high-volume distinct-label rate per source IP; Zeek dns.cc/NXDOMAIN ratio | Throttle -rate, rotate resolvers, never brute a single auth NS directly |
| httpx / katana probing | Spike of HTTP(S) requests, odd UA, favicon/JARM fetches | WAF/CDN: request-rate + UA anomaly; access-log User-Agent: *httpx*/*katana* | Set custom UA, low -rl, route via proxy pool / cloud egress |
| Subdomain takeover check | HTTP GET to dangling host (lands on 3rd-party) | 3rd-party provider logs; CT for new cert on claimed host | Verify with passive fingerprint before any claim; claiming is loud |
| Cloud bucket enum | DNS + HTTP to *.s3/blob/storage.googleapis | Cloud provider access logs; GuardDuty Discovery:S3/* | Hits provider, not target; still rate-limited / loggable |
| Azure tenant recon | Requests to login.microsoftonline.com | Entra sign-in/audit logs do not see unauth realm probes | getuserrealm/OpenID are unauth & invisible to tenant |
| GitHub/GitLab dorking | API/search queries from your token | GitHub audit log (only org members'); secret-scanning alerts | Use a throwaway token; respect rate limits to avoid bans |
| Breach/infostealer lookup | 3rd-party API calls (HIBP/DeHashed) | None on target | Handle PII per ROE/GDPR; document lawful basis |
| CVE enrichment | NVD/EPSS/KEV/Shodan API calls | None on target | Map exposure to in-scope assets only |
Deep Dives
- references/subdomain-discovery.md — Passive sources + CT logs, puredns/massdns resolution, alterx permutations, ASN→CIDR→PTR expansion, wildcard handling.
- references/attack-surface-mapping.md — httpx enrichment (
-td -favicon -jarm -asn), katana headless/authenticated crawling, gau/wayback archive mining, JS endpoint + secret extraction, nuclei triage of the live set. - references/subdomain-takeover.md — Dangling-DNS theory, can-i-take-over-xyz fingerprints, subzy/baddns/nuclei detection, the 2024-2025 deleted-S3 → CI/CD supply-chain pivot, NS-delegation takeover.
- references/cloud-saas-recon.md — cloud_enum multi-cloud, AADInternals/MicroBurst Azure tenant + blob recon (incl. the June-2025 Get-AADIntTenantDomains patch), GrayhatWarfare, GitHub/GitLab dorking with trufflehog/gitleaks/noseyparker.
- references/breach-credential-intel.md — theHarvester 4.x, HIBP API v3 (ALIEN TXTBASE), DeHashed, infostealer-log intel (Snowflake-style aged creds), username/email format derivation, password-pattern modeling.
- references/cve-exploit-intel.md — NVD 2.0 API + the 2026 selective-enrichment shift, EPSS v4, CISA KEV, Shodan InternetDB, searchsploit/nuclei, the KEV×EPSS×exposure prioritization stack.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.