agentleFS
Sign inStart free
sunilgentyalasunilgentyala/OmniRed/skills/recon/osint/SKILL.md

osint

Skill5 starsChanged 5 months agoApache-2.0View on GitHub

Open Source Intelligence expert methodology for pre-engagement reconnaissance. Covers target profiling, email harvesting, subdomain enumeration, technology fingerprinting, employee reconnaissance, and dark web monitoring.

18 other projects use a version of this.

Adopted by

Most recently taken up by

Used with

Projects with it also use RECON, analyze and 1 more.

Other files people use alongside this one.

Files found in the same public projects as a version of this one, more often than they turn up anywhere else. Each project counts once, large collections count for less, and this file's own repository is left out.
  • jord0-cmdSkill

    RECON

    Deep technical research that persists. Use when: exploring new technologies, investigating frameworks, comparative analysis of tools, understanding complex systems, or any research task that should be saved for future reference. Invokes Claude's built-in research agent and auto-saves results to a knowledge base for retrieval across sessions.

    Also in 4 projects that use this

  • AnthropicSkill

    analyze

    Answer data questions -- from quick lookups to full analyses. Use when looking up a single metric, investigating what's driving a trend or drop, comparing segments over time, or preparing a formal data report for stakeholders.

    Also in 3 projects that use this

  • NVIDIASkill

    research

    Before designing a feature, research how comparable libraries solve the problem, check best practices, known pitfalls, and upstream changes. Use when starting a new feature, investigating an unfamiliar area, or the user asks to research something.

    Also in 3 projects that use this

The file

Create a free account to mount
Files
SKILL.md

OSINT Reconnaissance

Methodology

Phase 1 — Scope definition and initial collection

Target: domain, IP ranges, org name, LinkedIn company page, stock ticker
Deliverables: attack surface map, employee list, technology stack, exposed assets

Phase 2 — Domain and infrastructure enumeration

# DNS enumeration
dig +any target.com
nslookup -type=ANY target.com
fierce --domain target.com
dnsx -d target.com -a -aaaa -cname -mx -ns -txt

# ASN and IP range discovery
whois -h whois.radb.net -- '-i origin AS12345'
bgp.he.net — manual lookup
amass intel -org "Target Corp"

# Certificate transparency (fast subdomain discovery)
curl -s "https://crt.sh/?q=%.target.com&output=json" | jq '.[].name_value' | sort -u

Phase 3 — Subdomain enumeration

# Passive (no direct target contact)
amass enum -passive -d target.com
subfinder -d target.com -all
assetfinder target.com
findomain -t target.com

# Active (sends DNS queries)
gobuster dns -d target.com -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
puredns bruteforce /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100000.txt target.com

# Combine and resolve
cat passive.txt active.txt | sort -u | httpx -status-code -title -tech-detect

Phase 4 — Email harvesting

theHarvester -d target.com -l 500 -b google,bing,yahoo,linkedin,twitter
hunter.io API — pattern discovery + verification
phonebook.cz — email/subdomain/URL search
emailrep.io — reputation scoring

# LinkedIn scraping (respect ToS — use during authorized engagements)
linkedin2username.py -c "Target Corp"   # generate username formats

Phase 5 — Technology fingerprinting

# Web technology
whatweb target.com
wappalyzer CLI — browser-based fingerprinting
builtwith.com — technology profile

# Cloud provider and CDN
clouddetect.py target.com
nmap -sV -p 80,443,8080,8443 target.com

# WAF detection
wafw00f https://target.com
nmap --script http-waf-detect target.com

Phase 6 — Employee and social reconnaissance

LinkedIn: employees, roles, technology mentions in profiles
GitHub: employee repos — leaked credentials, internal tool names, API endpoints
Twitter/X: security event mentions, tool names, incident indicators
Glassdoor: job postings reveal technology stack
Indeed job listings: mention specific products, frameworks, versions

Phase 7 — Exposed credentials and secrets

# GitHub dorking
"target.com" password site:github.com
"target.com" api_key site:github.com
"@target.com" site:pastebin.com

# Automated credential search
trufflehog git https://github.com/target-org/
gitrob --github-access-token <token> target-org
gitleaks detect --source=.

# Breach databases
haveibeenpwned.com API
dehashed.com
intelx.io

Phase 8 — Google Dorking

site:target.com filetype:pdf
site:target.com ext:xlsx OR ext:docx
site:target.com inurl:admin OR inurl:login
site:target.com "internal use only"
"@target.com" site:linkedin.com
cache:target.com/admin

Tools

MITRE ATT&CK Mapping

  • T1590 — Gather Victim Network Information
  • T1591 — Gather Victim Organization Information
  • T1592 — Gather Victim Host Information
  • T1589 — Gather Victim Identity Information

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free