osint-recon

Name: osint-recon
Author: briiirussell

150installs36forks

How to install osint-recon?

briiirussell/cybersecurity-skills/osint-recon

$npx -y skills add briiirussell/cybersecurity-skills --skill osint-recon

Installs into the current project.

Summary

Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'inve

Files · 1

View on GitHub

SKILL.md

1	# OSINT Recon — Open Source Intelligence Gathering
2
3	Systematically gather, analyze, and correlate publicly available information from open sources.
4
5	Cross-references: `recon` for the active/passive target-mapping pass against an authorized system (DNS, ports, fingerprinting) — osint-recon focuses on people, organizations, leaked data, and historical artifacts; the two pair naturally. `breach-patterns` for ingesting public breach intelligence into your own preemptive assessments. `incident-triage` if OSINT surfaces evidence the user is already compromised.
6
7	## Ethics Check
8
9	Before proceeding, confirm:
10	1. The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
11	2. You are only gathering publicly available information
12	3. Results will not be used for harassment, stalking, or doxing
13
14	Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.
15
16	## Collection Techniques
17
18	### Domain and Infrastructure OSINT
19
20	Run these to map a target's infrastructure:
21
22	```bash
23	whois <domain> # Registration data
24	dig any <domain> # DNS records
25	```
26
27	Query certificate transparency for subdomains:
28	```bash
29	curl -s "https://crt.sh/?q=%25.<domain>&output=json" \| jq -r '.[].name_value' \| sort -u
30	```
31
32	Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.
33
34	### Organization OSINT
35
36	- Company registrations, filings, SEC records (public companies)
37	- LinkedIn company page — employee count, roles, tech stack hints
38	- Job postings — reveal internal tools, tech stack, pain points
39	- Press releases and news articles
40	- GitHub/GitLab organization pages and public repositories
41	- Patent filings
42
43	### Email and Username OSINT
44
45	- Email format patterns (e.g., first.last@domain.com)
46	- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
47	- PGP key servers for email discovery
48	- Gravatar lookups for email-to-identity correlation
49
50	### Document and File OSINT
51
52	- Extract metadata from public documents: `exiftool <file>` reveals author, software, GPS, timestamps
53	- Google dorking: `site:<domain> filetype:pdf`, `site:<domain> filetype:xlsx`
54	- Pastebin and code paste site monitoring
55	- Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)
56
57	### Threat Intelligence
58
59	- CVE databases for the target's technology stack
60	- Exploit databases (exploit-db, searchsploit)
61	- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
62	- Abuse contact databases
63
64	## Analysis
65
66	- Cross-reference findings across multiple sources
67	- Validate information with at least two independent sources
68	- Build a timeline of events when investigating incidents
69	- Map relationships between entities (people, domains, IPs, organizations)
70	- Rate confidence: High (multiple corroborating sources), Medium (single reliable source), Low (unverified)
71
72	## Output Format
73
74	```markdown
75	# OSINT Report
76	## Objective: [what we're investigating and why]
77	## Target: [entity/domain/person]
78	## Date: [date]
79
80	### Collection Summary
81	\| Source \| Findings \| Confidence \|
82	\|--------\|----------\|------------\|
83
84	### Key Findings
85
86	#### Finding 1: [Title]
87	- Source: [where this was found]
88	- Details: [what was discovered]
89	- Confidence: High / Medium / Low
90	- Relevance: [why this matters to the objective]
91
92	### Correlations
93	[How different findings connect to each other]
94
95	### Intelligence Gaps
96	[What we couldn't find or verify]
97
98	### Recommendations
99	[Next steps and actionable intelligence]
100	```
101
102	## Boundaries
103
104	- Only use publicly available sources
105	- Never attempt to access private or authenticated systems
106	- Do not aggregate PII beyond what is necessary for the stated objective
107	- Attribute all findings to their source
108	- Rate confidence levels honestly — do not overstate certainty
109	- If a finding could cause harm if misused, note the sensitivity
110	- Refuse requests for doxing, stalking, or unauthorized surveillance
111
112	## References
113
114	- OSINT Framework (osintframework.com)
115	- SANS OSINT resource list
116	- Bellingcat Online Investigation Toolkit

People who liked this also viewed

6 picks

Type

osint-recon

150installs36forks

View on GitHub

How to install osint-recon?

briiirussell/cybersecurity-skills/osint-recon

$npx -y skills add briiirussell/cybersecurity-skills --skill osint-recon

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# OSINT Recon — Open Source Intelligence Gathering
2
3	Systematically gather, analyze, and correlate publicly available information from open sources.
4
5	Cross-references: `recon` for the active/passive target-mapping pass against an authorized system (DNS, ports, fingerprinting) — osint-recon focuses on people, organizations, leaked data, and historical artifacts; the two pair naturally. `breach-patterns` for ingesting public breach intelligence into your own preemptive assessments. `incident-triage` if OSINT surfaces evidence the user is already compromised.
6
7	## Ethics Check
8
9	Before proceeding, confirm:
10	1. The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
11	2. You are only gathering publicly available information
12	3. Results will not be used for harassment, stalking, or doxing
13
14	Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.
15
16	## Collection Techniques
17
18	### Domain and Infrastructure OSINT
19
20	Run these to map a target's infrastructure:
21
22	```bash
23	whois <domain> # Registration data
24	dig any <domain> # DNS records
25	```
26
27	Query certificate transparency for subdomains:
28	```bash
29	curl -s "https://crt.sh/?q=%25.<domain>&output=json" \| jq -r '.[].name_value' \| sort -u
30	```
31
32	Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.
33
34	### Organization OSINT
35
36	- Company registrations, filings, SEC records (public companies)
37	- LinkedIn company page — employee count, roles, tech stack hints
38	- Job postings — reveal internal tools, tech stack, pain points
39	- Press releases and news articles
40	- GitHub/GitLab organization pages and public repositories
41	- Patent filings
42
43	### Email and Username OSINT
44
45	- Email format patterns (e.g., first.last@domain.com)
46	- HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
47	- PGP key servers for email discovery
48	- Gravatar lookups for email-to-identity correlation
49
50	### Document and File OSINT
51
52	- Extract metadata from public documents: `exiftool <file>` reveals author, software, GPS, timestamps
53	- Google dorking: `site:<domain> filetype:pdf`, `site:<domain> filetype:xlsx`
54	- Pastebin and code paste site monitoring
55	- Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)
56
57	### Threat Intelligence
58
59	- CVE databases for the target's technology stack
60	- Exploit databases (exploit-db, searchsploit)
61	- Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
62	- Abuse contact databases
63
64	## Analysis
65
66	- Cross-reference findings across multiple sources
67	- Validate information with at least two independent sources
68	- Build a timeline of events when investigating incidents
69	- Map relationships between entities (people, domains, IPs, organizations)
70	- Rate confidence: High (multiple corroborating sources), Medium (single reliable source), Low (unverified)
71
72	## Output Format
73
74	```markdown
75	# OSINT Report
76	## Objective: [what we're investigating and why]
77	## Target: [entity/domain/person]
78	## Date: [date]
79
80	### Collection Summary
81	\| Source \| Findings \| Confidence \|
82	\|--------\|----------\|------------\|
83
84	### Key Findings
85
86	#### Finding 1: [Title]
87	- Source: [where this was found]
88	- Details: [what was discovered]
89	- Confidence: High / Medium / Low
90	- Relevance: [why this matters to the objective]
91
92	### Correlations
93	[How different findings connect to each other]
94
95	### Intelligence Gaps
96	[What we couldn't find or verify]
97
98	### Recommendations
99	[Next steps and actionable intelligence]
100	```
101
102	## Boundaries
103
104	- Only use publicly available sources
105	- Never attempt to access private or authenticated systems
106	- Do not aggregate PII beyond what is necessary for the stated objective
107	- Attribute all findings to their source
108	- Rate confidence levels honestly — do not overstate certainty
109	- If a finding could cause harm if misused, note the sensitivity
110	- Refuse requests for doxing, stalking, or unauthorized surveillance
111
112	## References
113
114	- OSINT Framework (osintframework.com)
115	- SANS OSINT resource list
116	- Bellingcat Online Investigation Toolkit

People who liked this also viewed

6 picks

Type