offensive-osint

Name: offensive-osint
Author: SnailSploit

2.8kstars447forks

How to install offensive-osint?

snailsploit/claude-red/offensive-osint

$npx -y skills add SnailSploit/Claude-Red --skill offensive-osint

Installs into the current project.

Summary

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infra

Files · 1

View on GitHub

SKILL.md

1	# Offensive OSINT Methodology
2
3	## Workflow
4
5	1. Define target scope (domain, org, person, crypto address, or geo subject)
6	2. Select applicable categories below based on scope
7	3. Work top-down within each category; pivot on discovered artifacts
8	4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
9	5. Log findings in JSONL with a `run_id` and tool versions for reproducibility
10	6. Suggest next steps based on what each tool returns
11
12	---
13
14	## General OSINT
15
16	- [Bookmarks](https://tools.myosint.training/) — Comprehensive OSINT bookmarks
17	- [OSINT Framework](https://osintframework.com/) — Tool/resource directory
18	- [IntelTechniques Tools](https://inteltechniques.com/tools/) — Suite of investigative tools
19	- [Bellingcat Toolkit](https://www.bellingcat.com/resources/2024/09/24/bellingcat-online-investigations-toolkit/) — Investigative journalism tools
20	- [CyberSudo OSINT Toolkit](https://docs.google.com/spreadsheets/d/1EC0sKA_W9znzsxUt0wye9UYtyATXw5m8) — OSINT websites list
21	- [Google Dorks](https://dorksearch.com/) — Efficient Google searching
22	- [Distributed Denial of Secrets](https://ddosecrets.com/) — Leaked data
23	- [Country-Specific Resources](https://digitaldigging.org/osint/) — Country-targeted OSINT
24
25	### Search Engines
26
27	\| Tool \| Notes \|
28	\|------\|-------\|
29	\| [Carrot2](https://search.carrot2.org/#/search/web) \| Clusters results by topic \|
30	\| [etools](https://www.etools.ch/) \| Metasearch engine \|
31	\| [Kagi](https://kagi.com/) \| Privacy-first, non-personalized results \|
32	\| [Brave Search](https://search.brave.com/) \| Independent index; Goggles for custom ranking \|
33	\| [PDF Search](https://www.pdfsearch.io/) \| Search PDF files and view table of contents \|
34	\| [Google Fact Check Explorer](https://toolbox.google.com/factcheck/explorer) \| Cross-site fact-check search \|
35
36	---
37
38	## Username & Email Investigation
39
40	\| Tool \| Purpose \|
41	\|------\|---------\|
42	\| [Sherlock](https://github.com/sherlock-project/sherlock) \| Username search across social networks \|
43	\| [Maigret](https://github.com/soxoj/maigret) \| Collect profiles by username from many sites \|
44	\| [What's My Name](https://whatsmyname.app/) \| Username search across platforms \|
45	\| [Holehe](https://github.com/megadose/holehe) \| Check if email is registered on platforms \|
46	\| [Epieos](https://epieos.com/) \| Email address pivots and metadata \|
47	\| [OSINT Industries](https://osint.industries/) \| Email/username/phone lookups \|
48	\| [Hunter.io](https://hunter.io/) \| Find email addresses for a domain \|
49	\| [EmailRep](https://emailrep.io/) \| Email reputation and associated data \|
50	\| [Emailable](https://emailable.com/) \| Verify email existence \|
51	\| [Mugetsu](https://mugetsu.io/) \| X/Twitter username history \|
52	\| [RocketReach](https://rocketreach.co/) / [Apollo](https://www.apollo.io/) \| Email enrichment and pattern guessing \|
53	\| [PhoneInfoga](https://github.com/sundowndev/phoneinfoga) \| Phone number intelligence framework \|
54
55	Browser extensions: [GetProspect](https://chromewebstore.google.com/detail/email-finder-getprospect/bhbcbkonalnjkflmdkdodieehnmmeknp), [SignalHire](https://chrome.google.com/webstore/detail/signalhire-find-email-or/aeidadjdhppdffggfgjpanbafaedankd)
56
57	---
58
59	## People Search
60
61	- [TruePeopleSearch](https://www.truepeoplesearch.com/) — Free U.S. people search
62	- [WhitePages](https://www.whitepages.com/) — Contact information
63	- [Spokeo](https://www.spokeo.com/) — People search engine
64	- [Webmii](https://webmii.com/) — People search
65	- [Pipl](https://pipl.com/) — Deep web people search (paid)
66	- [Clearbit](https://clearbit.com/) — Company/individual data enrichment
67	- [FaceCheck](https://facecheck.id/) / [FaceSeek](https://faceseek.online/) — Reverse face search
68
69	---
70
71	## Phone Number OSINT
72
73	- [TrueCaller](https://www.truecaller.com/) — Caller ID and spam blocking
74	- [ThatsThem](https://thatsthem.com/) — Reverse phone search
75	- [Infobel](https://infobel.com/) — Phone search outside USA
76	- [FreeCarrierLookup](https://freecarrierlookup.com/) — Carrier/type lookup (US)
77	- [NumlookupAPI](https://numlookupapi.com/) [Freemium] — Programmatic carrier/line-type checks
78	- [CallerIDTest](https://calleridtest.com/) — Phone search
79	- [Advanced Background Checks](https://www.advancedbackgroundchecks.com/) — All people linked to a number
80
81	---
82
83	## Social Media
84
85	\| Platform \| Tool \|
86	\|----------\|------\|
87	\| Instagram \| [Picuki](https://www.picuki.com/) — view profiles without accoun

People who liked this also viewed

6 picks

Type

offensive-osint

2.8kstars447forks

View on GitHub

How to install offensive-osint?

snailsploit/claude-red/offensive-osint

$npx -y skills add SnailSploit/Claude-Red --skill offensive-osint

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Offensive OSINT Methodology
2
3	## Workflow
4
5	1. Define target scope (domain, org, person, crypto address, or geo subject)
6	2. Select applicable categories below based on scope
7	3. Work top-down within each category; pivot on discovered artifacts
8	4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
9	5. Log findings in JSONL with a `run_id` and tool versions for reproducibility
10	6. Suggest next steps based on what each tool returns
11
12	---
13
14	## General OSINT
15
16	- [Bookmarks](https://tools.myosint.training/) — Comprehensive OSINT bookmarks
17	- [OSINT Framework](https://osintframework.com/) — Tool/resource directory
18	- [IntelTechniques Tools](https://inteltechniques.com/tools/) — Suite of investigative tools
19	- [Bellingcat Toolkit](https://www.bellingcat.com/resources/2024/09/24/bellingcat-online-investigations-toolkit/) — Investigative journalism tools
20	- [CyberSudo OSINT Toolkit](https://docs.google.com/spreadsheets/d/1EC0sKA_W9znzsxUt0wye9UYtyATXw5m8) — OSINT websites list
21	- [Google Dorks](https://dorksearch.com/) — Efficient Google searching
22	- [Distributed Denial of Secrets](https://ddosecrets.com/) — Leaked data
23	- [Country-Specific Resources](https://digitaldigging.org/osint/) — Country-targeted OSINT
24
25	### Search Engines
26
27	\| Tool \| Notes \|
28	\|------\|-------\|
29	\| [Carrot2](https://search.carrot2.org/#/search/web) \| Clusters results by topic \|
30	\| [etools](https://www.etools.ch/) \| Metasearch engine \|
31	\| [Kagi](https://kagi.com/) \| Privacy-first, non-personalized results \|
32	\| [Brave Search](https://search.brave.com/) \| Independent index; Goggles for custom ranking \|
33	\| [PDF Search](https://www.pdfsearch.io/) \| Search PDF files and view table of contents \|
34	\| [Google Fact Check Explorer](https://toolbox.google.com/factcheck/explorer) \| Cross-site fact-check search \|
35
36	---
37
38	## Username & Email Investigation
39
40	\| Tool \| Purpose \|
41	\|------\|---------\|
42	\| [Sherlock](https://github.com/sherlock-project/sherlock) \| Username search across social networks \|
43	\| [Maigret](https://github.com/soxoj/maigret) \| Collect profiles by username from many sites \|
44	\| [What's My Name](https://whatsmyname.app/) \| Username search across platforms \|
45	\| [Holehe](https://github.com/megadose/holehe) \| Check if email is registered on platforms \|
46	\| [Epieos](https://epieos.com/) \| Email address pivots and metadata \|
47	\| [OSINT Industries](https://osint.industries/) \| Email/username/phone lookups \|
48	\| [Hunter.io](https://hunter.io/) \| Find email addresses for a domain \|
49	\| [EmailRep](https://emailrep.io/) \| Email reputation and associated data \|
50	\| [Emailable](https://emailable.com/) \| Verify email existence \|
51	\| [Mugetsu](https://mugetsu.io/) \| X/Twitter username history \|
52	\| [RocketReach](https://rocketreach.co/) / [Apollo](https://www.apollo.io/) \| Email enrichment and pattern guessing \|
53	\| [PhoneInfoga](https://github.com/sundowndev/phoneinfoga) \| Phone number intelligence framework \|
54
55	Browser extensions: [GetProspect](https://chromewebstore.google.com/detail/email-finder-getprospect/bhbcbkonalnjkflmdkdodieehnmmeknp), [SignalHire](https://chrome.google.com/webstore/detail/signalhire-find-email-or/aeidadjdhppdffggfgjpanbafaedankd)
56
57	---
58
59	## People Search
60
61	- [TruePeopleSearch](https://www.truepeoplesearch.com/) — Free U.S. people search
62	- [WhitePages](https://www.whitepages.com/) — Contact information
63	- [Spokeo](https://www.spokeo.com/) — People search engine
64	- [Webmii](https://webmii.com/) — People search
65	- [Pipl](https://pipl.com/) — Deep web people search (paid)
66	- [Clearbit](https://clearbit.com/) — Company/individual data enrichment
67	- [FaceCheck](https://facecheck.id/) / [FaceSeek](https://faceseek.online/) — Reverse face search
68
69	---
70
71	## Phone Number OSINT
72
73	- [TrueCaller](https://www.truecaller.com/) — Caller ID and spam blocking
74	- [ThatsThem](https://thatsthem.com/) — Reverse phone search
75	- [Infobel](https://infobel.com/) — Phone search outside USA
76	- [FreeCarrierLookup](https://freecarrierlookup.com/) — Carrier/type lookup (US)
77	- [NumlookupAPI](https://numlookupapi.com/) [Freemium] — Programmatic carrier/line-type checks
78	- [CallerIDTest](https://calleridtest.com/) — Phone search
79	- [Advanced Background Checks](https://www.advancedbackgroundchecks.com/) — All people linked to a number
80
81	---
82
83	## Social Media
84
85	\| Platform \| Tool \|
86	\|----------\|------\|
87	\| Instagram \| [Picuki](https://www.picuki.com/) — view profiles without accoun

People who liked this also viewed

6 picks

Type