01-recon-osint

Name: 01-recon-osint
Author: Masriyan

190stars37forks

How to install 01-recon-osint?

masriyan/claude-code-cybersecurity-skill/01-recon-osint

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 01-recon-osint

Installs into the current project.

Summary

Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments

Files · 1

View on GitHub

SKILL.md

1	# Reconnaissance & OSINT Automation
2
3	## Purpose
4
5	Enable Claude to conduct comprehensive reconnaissance and open-source intelligence gathering during authorized security assessments. Claude performs passive and active recon using its native analysis capabilities and orchestrates the included scripts for automation at scale.
6
7	> Authorization Required: Always confirm written authorization for the target scope before proceeding. Unauthorized reconnaissance is illegal in most jurisdictions.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- Subdomain enumeration or discovery
15	- DNS reconnaissance, zone transfers, or DNS record analysis
16	- OSINT gathering on a domain, organization, or person
17	- Technology fingerprinting or stack identification
18	- Port scanning, service detection, or banner grabbing
19	- Google dorking or advanced search query generation
20	- WHOIS, certificate transparency, or Shodan queries
21	- Attack surface mapping or perimeter discovery
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install requests dnspython python-whois beautifulsoup4 shodan
29	```
30
31	Optional enhanced capabilities:
32	- `nmap` — Active port scanning
33	- `amass` — Advanced subdomain enumeration
34	- `theHarvester` — Email and domain harvesting
35	- Shodan API key — Internet-wide device search
36	- Censys API key — Certificate and host search
37
38	---
39
40	## Core Capabilities
41
42	### 1. Passive Reconnaissance (No Direct Target Contact)
43
44	When the user asks for passive recon or OSINT:
45
46	1. WHOIS Analysis — Query domain registration records for registrant, registrar, nameservers, and dates. Flag privacy-protected registrations and registrar patterns.
47	2. Certificate Transparency Logs — Search crt.sh for all certificates issued to the domain and subdomains. Extract SANs (Subject Alternative Names) to discover hidden subdomains.
48	3. DNS Records (Passive) — Enumerate A, AAAA, MX, NS, TXT, SOA, SRV, and CNAME records using public resolvers. Analyze SPF, DKIM, and DMARC for email security posture.
49	4. Search Engine Dorking — Generate targeted dork queries to discover exposed files, login portals, and configuration leaks:
50	- `site:target.com filetype:pdf` — Exposed documents
51	- `site:target.com inurl:admin` — Admin panels
52	- `site:target.com ext:env OR ext:config` — Config files
53	- `"@target.com" site:linkedin.com` — Employee enumeration
54	- `"target.com" site:pastebin.com` — Credential leaks
55	5. Shodan/Censys Queries — Search for internet-exposed services, open ports, banners, and vulnerabilities associated with the target's IP ranges.
56	6. Git/Code Repository Search — Search GitHub/GitLab for leaked credentials, API keys, and internal information:
57	- `org:targetorg api_key`
58	- `filename:.env target.com`
59	- `"target.com" password`
60
61	### 2. Subdomain Enumeration
62
63	When the user asks to enumerate subdomains:
64
65	1. Certificate Transparency — Extract all SANs from crt.sh/Censys certificates (most effective passive method)
66	2. DNS Brute-Force — Run subdomain_enum.py against the common wordlist in `resources/`
67	3. Wildcard Detection — Query random subdomains to detect wildcard DNS responses and filter false positives
68	4. Resolution Validation — Resolve all candidates to IP addresses; discard NXDOMAINs
69	5. HTTP Probing — Check which subdomains respond on ports 80/443; identify web applications
70	6. Infrastructure Grouping — Group discovered subdomains by IP/ASN to map cloud vs. on-prem assets
71
72	Output format for subdomain findings:
73	```
74	Target: example.com
75	Discovery Method: CT Logs + DNS Brute-Force
76	Discovered: 47 subdomains
77
78	LIVE SUBDOMAINS:
79	admin.example.com → 203.0.113.10 [HTTP 200] [nginx/1.18]
80	dev.example.com → 203.0.113.11 [HTTP 302 → /login]
81	api.example.com → 203.0.113.12 [HTTP 200] [cloudflare]
82	internal.example.com → 10.0.0.5 [No public response — internal?]
83
84	INFRASTRUCTURE CLUSTERS:
85	203.0.113.10-15 → AS12345 (Company Hosting)
86	Cloudflare CDN → 7 subdomains proxied
87	```
88
89	### 3. Active Port Scanning & Service Detection
90
91	When the user asks to scan ports or detect services:
92
93	1. Define scan scope (host, subnet, CIDR range) and confirm authorization
94	2. Select scan technique: SYN scan (requires root), connect scan (no root), or stealth options
95	3. Run top-1000 ports first, then targeted service ports
96	4. Perform service version detection (`-sV`) on all open ports
97	5. Run OS fingerprinting (`-O`) if authorized
98	6. Grab banners from discovered services
99	7. Flag services with known vulnerabilities based on version data
100
101	Provide Nmap commands ready to run:
102	```bash
103	# Quick discovery
104	nmap -sn 203.0.113.0/24
105
106	# Top 1000

People who liked this also viewed

6 picks

Type

01-recon-osint

190stars37forks

View on GitHub

How to install 01-recon-osint?

masriyan/claude-code-cybersecurity-skill/01-recon-osint

$npx -y skills add Masriyan/Claude-Code-CyberSecurity-Skill --skill 01-recon-osint

Installs into the current project.

Summary

Passive and active reconnaissance, subdomain enumeration, DNS analysis, technology fingerprinting, and OSINT data correlation for authorized security assessments

Files · 1

View on GitHub

SKILL.md

1	# Reconnaissance & OSINT Automation
2
3	## Purpose
4
5	Enable Claude to conduct comprehensive reconnaissance and open-source intelligence gathering during authorized security assessments. Claude performs passive and active recon using its native analysis capabilities and orchestrates the included scripts for automation at scale.
6
7	> Authorization Required: Always confirm written authorization for the target scope before proceeding. Unauthorized reconnaissance is illegal in most jurisdictions.
8
9	---
10
11	## Activation Triggers
12
13	This skill activates when the user asks about:
14	- Subdomain enumeration or discovery
15	- DNS reconnaissance, zone transfers, or DNS record analysis
16	- OSINT gathering on a domain, organization, or person
17	- Technology fingerprinting or stack identification
18	- Port scanning, service detection, or banner grabbing
19	- Google dorking or advanced search query generation
20	- WHOIS, certificate transparency, or Shodan queries
21	- Attack surface mapping or perimeter discovery
22
23	---
24
25	## Prerequisites
26
27	```bash
28	pip install requests dnspython python-whois beautifulsoup4 shodan
29	```
30
31	Optional enhanced capabilities:
32	- `nmap` — Active port scanning
33	- `amass` — Advanced subdomain enumeration
34	- `theHarvester` — Email and domain harvesting
35	- Shodan API key — Internet-wide device search
36	- Censys API key — Certificate and host search
37
38	---
39
40	## Core Capabilities
41
42	### 1. Passive Reconnaissance (No Direct Target Contact)
43
44	When the user asks for passive recon or OSINT:
45
46	1. WHOIS Analysis — Query domain registration records for registrant, registrar, nameservers, and dates. Flag privacy-protected registrations and registrar patterns.
47	2. Certificate Transparency Logs — Search crt.sh for all certificates issued to the domain and subdomains. Extract SANs (Subject Alternative Names) to discover hidden subdomains.
48	3. DNS Records (Passive) — Enumerate A, AAAA, MX, NS, TXT, SOA, SRV, and CNAME records using public resolvers. Analyze SPF, DKIM, and DMARC for email security posture.
49	4. Search Engine Dorking — Generate targeted dork queries to discover exposed files, login portals, and configuration leaks:
50	- `site:target.com filetype:pdf` — Exposed documents
51	- `site:target.com inurl:admin` — Admin panels
52	- `site:target.com ext:env OR ext:config` — Config files
53	- `"@target.com" site:linkedin.com` — Employee enumeration
54	- `"target.com" site:pastebin.com` — Credential leaks
55	5. Shodan/Censys Queries — Search for internet-exposed services, open ports, banners, and vulnerabilities associated with the target's IP ranges.
56	6. Git/Code Repository Search — Search GitHub/GitLab for leaked credentials, API keys, and internal information:
57	- `org:targetorg api_key`
58	- `filename:.env target.com`
59	- `"target.com" password`
60
61	### 2. Subdomain Enumeration
62
63	When the user asks to enumerate subdomains:
64
65	1. Certificate Transparency — Extract all SANs from crt.sh/Censys certificates (most effective passive method)
66	2. DNS Brute-Force — Run subdomain_enum.py against the common wordlist in `resources/`
67	3. Wildcard Detection — Query random subdomains to detect wildcard DNS responses and filter false positives
68	4. Resolution Validation — Resolve all candidates to IP addresses; discard NXDOMAINs
69	5. HTTP Probing — Check which subdomains respond on ports 80/443; identify web applications
70	6. Infrastructure Grouping — Group discovered subdomains by IP/ASN to map cloud vs. on-prem assets
71
72	Output format for subdomain findings:
73	```
74	Target: example.com
75	Discovery Method: CT Logs + DNS Brute-Force
76	Discovered: 47 subdomains
77
78	LIVE SUBDOMAINS:
79	admin.example.com → 203.0.113.10 [HTTP 200] [nginx/1.18]
80	dev.example.com → 203.0.113.11 [HTTP 302 → /login]
81	api.example.com → 203.0.113.12 [HTTP 200] [cloudflare]
82	internal.example.com → 10.0.0.5 [No public response — internal?]
83
84	INFRASTRUCTURE CLUSTERS:
85	203.0.113.10-15 → AS12345 (Company Hosting)
86	Cloudflare CDN → 7 subdomains proxied
87	```
88
89	### 3. Active Port Scanning & Service Detection
90
91	When the user asks to scan ports or detect services:
92
93	1. Define scan scope (host, subnet, CIDR range) and confirm authorization
94	2. Select scan technique: SYN scan (requires root), connect scan (no root), or stealth options
95	3. Run top-1000 ports first, then targeted service ports
96	4. Perform service version detection (`-sV`) on all open ports
97	5. Run OS fingerprinting (`-O`) if authorized
98	6. Grab banners from discovered services
99	7. Flag services with known vulnerabilities based on version data
100
101	Provide Nmap commands ready to run:
102	```bash
103	# Quick discovery
104	nmap -sn 203.0.113.0/24
105
106	# Top 1000

People who liked this also viewed

6 picks

Type