recon-osint

Name: recon-osint
Author: hypnguyen1209

320stars55forks

How to install recon-osint?

hypnguyen1209/offensive-claude/recon-osint

$npx -y skills add hypnguyen1209/offensive-claude --skill recon-osint

Installs into the current project.

Summary

Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EP

Files · 1

View on GitHub

SKILL.md

1	# Reconnaissance & OSINT
2
3	## When to Activate
4
5	- A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
6	- Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
7	- Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
8	- Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
9	- Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
10	- Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.
11
12	## Technique Map
13
14	\| Technique \| ATT&CK \| CWE \| Reference \| Script \|
15	\|-----------\|--------\|-----\|-----------\|--------\|
16	\| Passive subdomain enum (subfinder/amass/CT logs) \| T1590.002, T1596.001 \| CWE-200 \| references/subdomain-discovery.md \| scripts/recon_orchestrator.py \|
17	\| DNS brute / permutation / resolution (puredns/alterx/dnsx) \| T1595.002, T1590.002 \| CWE-200 \| references/subdomain-discovery.md \| scripts/recon_orchestrator.py \|
18	\| ASN → CIDR → reverse-DNS expansion \| T1590.005, T1596.005 \| CWE-200 \| references/subdomain-discovery.md \| scripts/recon_orchestrator.py \|
19	\| HTTP probing + tech fingerprint (httpx) \| T1595.002, T1592.002 \| CWE-200 \| references/attack-surface-mapping.md \| scripts/recon_orchestrator.py \|
20	\| Headless crawling + archive URLs (katana/gau) \| T1595.002, T1593.003 \| CWE-200 \| references/attack-surface-mapping.md \| scripts/js_secret_hunter.py \|
21	\| JavaScript endpoint / secret extraction \| T1593.003, T1552.001 \| CWE-540 \| references/attack-surface-mapping.md \| scripts/js_secret_hunter.py \|
22	\| Subdomain takeover (dangling CNAME/NS) \| T1583.001, T1584.001 \| CWE-350 \| references/subdomain-takeover.md \| scripts/subdomain_takeover.py \|
23	\| Deleted-S3 takeover → supply-chain pivot \| T1583.001, T1195.002 \| CWE-350 \| references/subdomain-takeover.md \| scripts/subdomain_takeover.py \|
24	\| Multi-cloud bucket/blob enum (cloud_enum) \| T1580, T1596.005 \| CWE-732 \| references/cloud-saas-recon.md \| scripts/cloud_asset_enum.py \|
25	\| Azure tenant outsider recon (AADInternals) \| T1590.001, T1589 \| CWE-200 \| references/cloud-saas-recon.md \| scripts/cloud_asset_enum.py \|
26	\| GitHub/GitLab dorking + secret scanning \| T1593.003, T1213.003 \| CWE-540 \| references/cloud-saas-recon.md \| scripts/cloud_asset_enum.py \|
27	\| Email/username harvesting (theHarvester) \| T1589.002, T1591 \| CWE-200 \| references/breach-credential-intel.md \| scripts/breach_intel.py \|
28	\| Breach + infostealer credential intel (HIBP/DeHashed) \| T1589.001, T1596 \| CWE-522 \| references/breach-credential-intel.md \| scripts/breach_intel.py \|
29	\| CVE enrichment + prioritization (NVD/EPSS/KEV) \| T1592.002, T1596 \| CWE-1395 \| references/cve-exploit-intel.md \| scripts/cve_prioritizer.py \|
30	\| Shodan InternetDB exposure → CVE mapping \| T1596.005, T1595.002 \| CWE-200 \| references/cve-exploit-intel.md \| scripts/cve_prioritizer.py \|
31
32	## Quick Start
33
34	```bash
35	export DOMAIN=target.com
36	# 0. Validate resolvers once (puredns needs a clean list)
37	dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt
38
39	# 1. Full discovery + probe + crawl + takeover + nuclei, JSONL

People who liked this also viewed

6 picks

Type

recon-osint

320stars55forks

View on GitHub

How to install recon-osint?

hypnguyen1209/offensive-claude/recon-osint

$npx -y skills add hypnguyen1209/offensive-claude --skill recon-osint

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Reconnaissance & OSINT
2
3	## When to Activate
4
5	- A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
6	- Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
7	- Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
8	- Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
9	- Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
10	- Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.
11
12	## Technique Map
13
14	\| Technique \| ATT&CK \| CWE \| Reference \| Script \|
15	\|-----------\|--------\|-----\|-----------\|--------\|
16	\| Passive subdomain enum (subfinder/amass/CT logs) \| T1590.002, T1596.001 \| CWE-200 \| references/subdomain-discovery.md \| scripts/recon_orchestrator.py \|
17	\| DNS brute / permutation / resolution (puredns/alterx/dnsx) \| T1595.002, T1590.002 \| CWE-200 \| references/subdomain-discovery.md \| scripts/recon_orchestrator.py \|
18	\| ASN → CIDR → reverse-DNS expansion \| T1590.005, T1596.005 \| CWE-200 \| references/subdomain-discovery.md \| scripts/recon_orchestrator.py \|
19	\| HTTP probing + tech fingerprint (httpx) \| T1595.002, T1592.002 \| CWE-200 \| references/attack-surface-mapping.md \| scripts/recon_orchestrator.py \|
20	\| Headless crawling + archive URLs (katana/gau) \| T1595.002, T1593.003 \| CWE-200 \| references/attack-surface-mapping.md \| scripts/js_secret_hunter.py \|
21	\| JavaScript endpoint / secret extraction \| T1593.003, T1552.001 \| CWE-540 \| references/attack-surface-mapping.md \| scripts/js_secret_hunter.py \|
22	\| Subdomain takeover (dangling CNAME/NS) \| T1583.001, T1584.001 \| CWE-350 \| references/subdomain-takeover.md \| scripts/subdomain_takeover.py \|
23	\| Deleted-S3 takeover → supply-chain pivot \| T1583.001, T1195.002 \| CWE-350 \| references/subdomain-takeover.md \| scripts/subdomain_takeover.py \|
24	\| Multi-cloud bucket/blob enum (cloud_enum) \| T1580, T1596.005 \| CWE-732 \| references/cloud-saas-recon.md \| scripts/cloud_asset_enum.py \|
25	\| Azure tenant outsider recon (AADInternals) \| T1590.001, T1589 \| CWE-200 \| references/cloud-saas-recon.md \| scripts/cloud_asset_enum.py \|
26	\| GitHub/GitLab dorking + secret scanning \| T1593.003, T1213.003 \| CWE-540 \| references/cloud-saas-recon.md \| scripts/cloud_asset_enum.py \|
27	\| Email/username harvesting (theHarvester) \| T1589.002, T1591 \| CWE-200 \| references/breach-credential-intel.md \| scripts/breach_intel.py \|
28	\| Breach + infostealer credential intel (HIBP/DeHashed) \| T1589.001, T1596 \| CWE-522 \| references/breach-credential-intel.md \| scripts/breach_intel.py \|
29	\| CVE enrichment + prioritization (NVD/EPSS/KEV) \| T1592.002, T1596 \| CWE-1395 \| references/cve-exploit-intel.md \| scripts/cve_prioritizer.py \|
30	\| Shodan InternetDB exposure → CVE mapping \| T1596.005, T1595.002 \| CWE-200 \| references/cve-exploit-intel.md \| scripts/cve_prioritizer.py \|
31
32	## Quick Start
33
34	```bash
35	export DOMAIN=target.com
36	# 0. Validate resolvers once (puredns needs a clean list)
37	dnsvalidator -tL https://public-dns.info/nameservers.txt -threads 100 -o resolvers.txt
38
39	# 1. Full discovery + probe + crawl + takeover + nuclei, JSONL

People who liked this also viewed

6 picks

Type