offensive-osint-methodology

Name: offensive-osint-methodology
Author: SnailSploit

2.8kstars447forks

How to install offensive-osint-methodology?

snailsploit/claude-red/offensive-osint-methodology

$npx -y skills add SnailSploit/Claude-Red --skill offensive-osint-methodology

Installs into the current project.

Summary

When this skill is active: 1. Load and apply the full methodology below as your operational checklist 2. Follow steps in order unless the user specifies otherwise 3. For each technique, consider applicability to the current target/context 4. Track which checklist items have been

Files · 1

View on GitHub

SKILL.md

1	# SKILL: OSINT Methodology
2
3	## Metadata
4	- Skill Name: osint-methodology
5	- Folder: offensive-osint-methodology
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/osint-method.md
7
8	## Description
9	Structured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`OSINT methodology, open source intelligence, target profiling, data correlation, OSINT workflow, intelligence collection, OSINT campaign, recon methodology`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# OSINT Methodology
29
30	## OpSec
31
32	### Create a Sock Puppet
33
34	- Fake account that cannot be linked to you
35	- Build a posting history (post stuff, etc.)
36	- Resources
37	- [Effective Sock Puppets](https://medium.com/@unseeable06/creating-an-effective-sock-puppet-for-your-osint-investigation-95fdbb8b075a)
38	- [Ultimate Guide to Sock Puppets](https://osintteam.blog/the-ultimate-guide-to-sockpuppets-in-osint-how-to-create-and-utilize-them-effectively-d088c2ed6e36)
39	- [Fake Name Generator](https://www.fakenamegenerator.com/)
40	- [This Person does not Exist](https://thispersondoesnotexist.com/)
41	- Use separate browser profiles or isolation tools (e.g., Firefox Multi‑Account Containers) for any sock‑puppet activity.
42	- Acquire disposable VoIP/SMS numbers (e.g., Burner, Silent Link) to satisfy platform verification without exposing real phone numbers.
43	- Audit every browser extension before installation; supply‑chain attacks on popular add‑ons have targeted investigators since 2024.
44	- Use dedicated browser profiles/containers per case and persona; avoid logging into personal accounts.
45	- Prefer hardware‑backed passkeys for critical accounts; store recovery codes offline.
46	- Maintain a minimal chain‑of‑custody: timestamp actions, hash key artifacts, and record tool versions per case.
47
48	## Cryptocurrency Investigation
49
50	### Transaction Analysis
51
52	- Track transaction flows between wallets
53	- Identify clusters of related addresses
54	- Monitor large transfers and whale activity
55	- Use block explorers to trace fund movements
56	- Tools:
57	- Cielo: Multi-chain wallet tracking (EVM, Bitcoin, Solana, Tron)
58	- TRM: Create relationship graphs for addresses/transactions
59	- Arkham: Multichain explorer with entity labels, graph creation, and alerts
60	- MetaSleuth: Transaction visualization for retail users
61	- Range: CCTP bridge explorer
62	- Socketscan: EVM bridge explorer
63	- Pulsy: Bridge explorer aggregator
64	- Chainalysis: Horizon 2.0 cross‑chain tracing suite (paid)
65	- Elliptic: Lens visual link explorer (launched Dec 2024)
66	- Most compliance suites now provide real‑time bridge‑risk scoring dashboards (e.g., TRM, Chainalysis)
67
68	#### Layer 2 / Rollup Analysis
69
70	- zkSync Era / Polygon zkEVM: Zero-knowledge proofs hide transaction details on L2; only deposit/withdrawal bridge events visible on L1. Use [zkSync Era Block Explorer](https://explorer.zksync.io/) and [PolygonScan zkEVM](https://zkevm.polygonscan.com/).
71	- Arbitrum / Optimism: Transactions batched and compressed; L2 state reconstructed from L1 calldata. Use [Arbiscan](https://arbiscan.io/) and [Optimistic Etherscan](https://optimistic.etherscan.io/). Check [L2Beat](https://l2beat.com/) for risk framework and technology stack.
72	- StarkNet: Cairo VM with STARK proofs; different address derivation. Use [Voyager](https://voyager.online/) or [StarkScan](https://starkscan.co/).
73	- Base / Blast / Scroll: OP Stack or ZK-rollups; similar challenges to above.
74	- Privacy protocols on L2:
75	- Aztec Network: Programmable privacy with noir circuits; limited block explorer visibility.
76	- Railgun: Privacy system for DeFi on Ethereum/Polygon/BSC; shielded pools obscure sender/receiver/amount.
77	- Privacy Pools: Proposed Tornado Cash successor with association sets; not yet deployed at scale.
78	- Challenges:
79	- Bridge mixers (Hop Protocol, Across, Stargate) create synthetic liquidity pools that break direct tracing; funds enter/exit via pool swaps.
80	- Cross-rollup transfers further obfuscate trails; requires tracking via bridge contracts and relayer infrastructure.
81	- Many L2s lack mature analytics tools; explorers show transactions but relationship graphs are sparse.
82	- Methodology:
83	- Start with L1 bridge events (deposits/withdrawals); these anchor L2 activity to known addresses.
84	- Use L2-specific explorers to trace activity within the rollup.
85	- For privacy protocols, focus on timing analysi

People who liked this also viewed

6 picks

Type

offensive-osint-methodology

2.8kstars447forks

View on GitHub

How to install offensive-osint-methodology?

snailsploit/claude-red/offensive-osint-methodology

$npx -y skills add SnailSploit/Claude-Red --skill offensive-osint-methodology

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: OSINT Methodology
2
3	## Metadata
4	- Skill Name: osint-methodology
5	- Folder: offensive-osint-methodology
6	- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/osint-method.md
7
8	## Description
9	Structured OSINT methodology framework: target definition, source selection, collection workflows, data correlation, timeline reconstruction, and reporting. Use to guide systematic OSINT campaigns or teach OSINT methodology.
10
11	## Trigger Phrases
12	Use this skill when the conversation involves any of:
13	`OSINT methodology, open source intelligence, target profiling, data correlation, OSINT workflow, intelligence collection, OSINT campaign, recon methodology`
14
15	## Instructions for Claude
16
17	When this skill is active:
18	1. Load and apply the full methodology below as your operational checklist
19	2. Follow steps in order unless the user specifies otherwise
20	3. For each technique, consider applicability to the current target/context
21	4. Track which checklist items have been completed
22	5. Suggest next steps based on findings
23
24	---
25
26	## Full Methodology
27
28	# OSINT Methodology
29
30	## OpSec
31
32	### Create a Sock Puppet
33
34	- Fake account that cannot be linked to you
35	- Build a posting history (post stuff, etc.)
36	- Resources
37	- [Effective Sock Puppets](https://medium.com/@unseeable06/creating-an-effective-sock-puppet-for-your-osint-investigation-95fdbb8b075a)
38	- [Ultimate Guide to Sock Puppets](https://osintteam.blog/the-ultimate-guide-to-sockpuppets-in-osint-how-to-create-and-utilize-them-effectively-d088c2ed6e36)
39	- [Fake Name Generator](https://www.fakenamegenerator.com/)
40	- [This Person does not Exist](https://thispersondoesnotexist.com/)
41	- Use separate browser profiles or isolation tools (e.g., Firefox Multi‑Account Containers) for any sock‑puppet activity.
42	- Acquire disposable VoIP/SMS numbers (e.g., Burner, Silent Link) to satisfy platform verification without exposing real phone numbers.
43	- Audit every browser extension before installation; supply‑chain attacks on popular add‑ons have targeted investigators since 2024.
44	- Use dedicated browser profiles/containers per case and persona; avoid logging into personal accounts.
45	- Prefer hardware‑backed passkeys for critical accounts; store recovery codes offline.
46	- Maintain a minimal chain‑of‑custody: timestamp actions, hash key artifacts, and record tool versions per case.
47
48	## Cryptocurrency Investigation
49
50	### Transaction Analysis
51
52	- Track transaction flows between wallets
53	- Identify clusters of related addresses
54	- Monitor large transfers and whale activity
55	- Use block explorers to trace fund movements
56	- Tools:
57	- Cielo: Multi-chain wallet tracking (EVM, Bitcoin, Solana, Tron)
58	- TRM: Create relationship graphs for addresses/transactions
59	- Arkham: Multichain explorer with entity labels, graph creation, and alerts
60	- MetaSleuth: Transaction visualization for retail users
61	- Range: CCTP bridge explorer
62	- Socketscan: EVM bridge explorer
63	- Pulsy: Bridge explorer aggregator
64	- Chainalysis: Horizon 2.0 cross‑chain tracing suite (paid)
65	- Elliptic: Lens visual link explorer (launched Dec 2024)
66	- Most compliance suites now provide real‑time bridge‑risk scoring dashboards (e.g., TRM, Chainalysis)
67
68	#### Layer 2 / Rollup Analysis
69
70	- zkSync Era / Polygon zkEVM: Zero-knowledge proofs hide transaction details on L2; only deposit/withdrawal bridge events visible on L1. Use [zkSync Era Block Explorer](https://explorer.zksync.io/) and [PolygonScan zkEVM](https://zkevm.polygonscan.com/).
71	- Arbitrum / Optimism: Transactions batched and compressed; L2 state reconstructed from L1 calldata. Use [Arbiscan](https://arbiscan.io/) and [Optimistic Etherscan](https://optimistic.etherscan.io/). Check [L2Beat](https://l2beat.com/) for risk framework and technology stack.
72	- StarkNet: Cairo VM with STARK proofs; different address derivation. Use [Voyager](https://voyager.online/) or [StarkScan](https://starkscan.co/).
73	- Base / Blast / Scroll: OP Stack or ZK-rollups; similar challenges to above.
74	- Privacy protocols on L2:
75	- Aztec Network: Programmable privacy with noir circuits; limited block explorer visibility.
76	- Railgun: Privacy system for DeFi on Ethereum/Polygon/BSC; shielded pools obscure sender/receiver/amount.
77	- Privacy Pools: Proposed Tornado Cash successor with association sets; not yet deployed at scale.
78	- Challenges:
79	- Bridge mixers (Hop Protocol, Across, Stargate) create synthetic liquidity pools that break direct tracing; funds enter/exit via pool swaps.
80	- Cross-rollup transfers further obfuscate trails; requires tracking via bridge contracts and relayer infrastructure.
81	- Many L2s lack mature analytics tools; explorers show transactions but relationship graphs are sparse.
82	- Methodology:
83	- Start with L1 bridge events (deposits/withdrawals); these anchor L2 activity to known addresses.
84	- Use L2-specific explorers to trace activity within the rollup.
85	- For privacy protocols, focus on timing analysi

People who liked this also viewed

6 picks

Type