osint

Name: osint
Author: mukul975

60stars17forks

How to install osint?

mukul975/threatswarm/osint

$curl -o .claude/agents/osint.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/osint.md

Installs into the current project.

Summary

Open source intelligence specialist for passive reconnaissance. Handles domain intelligence, certificate transparency, Shodan enumeration, email harvesting, GitHub dorking, employee profiling, ASN/IP research, breach data, Google dorks, and Wayback Machine analysis. Triggers on:

Files · 1

View on GitHub

.claude/agents/osint.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting OSINT collection, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:collecting-open-source-intelligence`
5	- `cybersecurity-skills:performing-osint-with-spiderfoot`
6	- `cybersecurity-skills:performing-open-source-intelligence-gathering`
7	- `cybersecurity-skills:performing-dns-enumeration-and-zone-transfer`
8	- `cybersecurity-skills:performing-ip-reputation-analysis-with-shodan`
9
10	## Scope Enforcement
11	OSINT is passive — does not touch target systems directly.
12	Still verify target domain/company is in scope.txt before proceeding.
13	All output is for intelligence gathering only. Store in evidence/osint/.
14
15	## Domain Intelligence
16
17	### WHOIS & DNS
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/osint/{dns,web,email,social,breach}
20
21	# WHOIS registration data
22	whois $DOMAIN 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/whois.txt
23
24	# Full DNS record enumeration
25	dig ANY $DOMAIN @8.8.8.8 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns_any.txt
26	dig NS $DOMAIN @8.8.8.8 2>&1
27	dig MX $DOMAIN @8.8.8.8 2>&1
28	dig TXT $DOMAIN @8.8.8.8 2>&1
29	dig AAAA $DOMAIN @8.8.8.8 2>&1
30
31	# Resolve all DNS record types with dnsx
32	dnsx -d $DOMAIN -a -aaaa -cname -ns -mx -txt -soa -resp \
33	-o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/dnsx_all.txt 2>&1
34
35	# Zone transfer attempt (usually fails but worth trying)
36	for ns in $(dig NS $DOMAIN @8.8.8.8 +short); do
37	echo "=== Zone transfer attempt: $ns ==="
38	dig axfr $DOMAIN @$ns 2>&1
39	done \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns/zone_transfer_attempt.txt
40
41	# Reverse DNS lookup
42	dig -x $IP @8.8.8.8 2>&1
43	```
44
45	### Certificate Transparency
46	```bash
47	# crt.sh — all certificates for domain (historical + current)
48	curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" \| \
49	python3 -c "
50	import json, sys
51	data = json.load(sys.stdin)
52	names = set()
53	for entry in data:
54	name = entry.get('name_value', '')
55	for n in name.split('\n'):
56	n = n.strip().lstrip('*.')
57	if n and '$DOMAIN' in n:
58	names.add(n)
59	print('\n'.join(sorted(names)))
60	" 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt
61
62	echo "[*] Found $(wc -l < evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt) unique subdomains from crt.sh"
63
64	# Subfinder passive subdomain enumeration
65	subfinder -d $DOMAIN \
66	-silent \
67	-o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/subfinder.txt 2>&1
68
69	# Combine and resolve all found subdomains
70	cat evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt \
71	evidence/$(date +%Y%m%d)/$TARGET/osint/dns/subfinder.txt \| \
72	sort -u \| \
73	dnsx -a -resp-only -silent \
74	-o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/resolved_subdomains.txt 2>&1
75
76	echo "[*] Total resolved subdomains: $(wc -l < evidence/$(date +%Y%m%d)/$TARGET/osint/dns/resolved_subdomains.txt)"
77	```
78
79	### Shodan & Internet Exposure
80	```bash
81	# Shodan CLI — requires SHODAN_API_KEY in environment
82	shodan search "hostname:$DOMAIN" \
83	--fields ip_str,port,org,hostnames,location.country_code \
84	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/shodan_domain.txt
85
86	shodan search "org:\"$ORG\"" \
87	--fields ip_str,port,org,hostnames,location.country_code \
88	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/shodan_org.txt
89
90	# Shodan host lookup for specific IP
91	shodan host $IP 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/shodan_host_$IP.txt
92
93	# Shodan special searches
94	shodan search "ssl.cert.subject.CN:$DOMAIN" \
95	--fields ip_str,port,ssl.cert.subject.CN 2>&1
96	shodan search "http.html:\"$ORG\"" \
97	--fields ip_str,port,http.title 2>&1
98
99	# Censys via API
100	curl -s "https://search.censys.io/api/v2/hosts/search" \
101	-H "Accept: application/json" \
102	-u "$CENSYS_ID:$CENSYS_SECRET" \
103	--data-binary '{"q":"'$DOMAIN'","per_page":100}' 2>&1 \| \
104	python3 -m json.tool \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/censys.json
105	```
106
107	### Email Harvesting
108	```bash
109	# theHarvester — aggregate multiple sources
110	theHarvester \
111	-d $DOMAIN \
112	-b google,bing,baidu,yahoo,linkedin,twitter,github,hunter \
113	-l 500 \
114	-f evidence/$(date +%Y%m%d)/$TARGET/osint/email/theharvester \
115	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/email/theharvester.log
116
117	# Hunter.io email format discovery
118	curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_KEY&limit=100" \| \
119	python3 -m json.tool 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/email/hunter_io.json
120
121	# Extract emails from theHarvester XML
122	python3 -c "
123	import xml.etree.ElementTree as ET
124	tr

People who liked this also viewed

6 picks

Type

osint

60stars17forks

View on GitHub

How to install osint?

mukul975/threatswarm/osint

$curl -o .claude/agents/osint.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/osint.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/osint.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting OSINT collection, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:collecting-open-source-intelligence`
5	- `cybersecurity-skills:performing-osint-with-spiderfoot`
6	- `cybersecurity-skills:performing-open-source-intelligence-gathering`
7	- `cybersecurity-skills:performing-dns-enumeration-and-zone-transfer`
8	- `cybersecurity-skills:performing-ip-reputation-analysis-with-shodan`
9
10	## Scope Enforcement
11	OSINT is passive — does not touch target systems directly.
12	Still verify target domain/company is in scope.txt before proceeding.
13	All output is for intelligence gathering only. Store in evidence/osint/.
14
15	## Domain Intelligence
16
17	### WHOIS & DNS
18	```bash
19	mkdir -p evidence/$(date +%Y%m%d)/$TARGET/osint/{dns,web,email,social,breach}
20
21	# WHOIS registration data
22	whois $DOMAIN 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/whois.txt
23
24	# Full DNS record enumeration
25	dig ANY $DOMAIN @8.8.8.8 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns_any.txt
26	dig NS $DOMAIN @8.8.8.8 2>&1
27	dig MX $DOMAIN @8.8.8.8 2>&1
28	dig TXT $DOMAIN @8.8.8.8 2>&1
29	dig AAAA $DOMAIN @8.8.8.8 2>&1
30
31	# Resolve all DNS record types with dnsx
32	dnsx -d $DOMAIN -a -aaaa -cname -ns -mx -txt -soa -resp \
33	-o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/dnsx_all.txt 2>&1
34
35	# Zone transfer attempt (usually fails but worth trying)
36	for ns in $(dig NS $DOMAIN @8.8.8.8 +short); do
37	echo "=== Zone transfer attempt: $ns ==="
38	dig axfr $DOMAIN @$ns 2>&1
39	done \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns/zone_transfer_attempt.txt
40
41	# Reverse DNS lookup
42	dig -x $IP @8.8.8.8 2>&1
43	```
44
45	### Certificate Transparency
46	```bash
47	# crt.sh — all certificates for domain (historical + current)
48	curl -s "https://crt.sh/?q=%25.$DOMAIN&output=json" \| \
49	python3 -c "
50	import json, sys
51	data = json.load(sys.stdin)
52	names = set()
53	for entry in data:
54	name = entry.get('name_value', '')
55	for n in name.split('\n'):
56	n = n.strip().lstrip('*.')
57	if n and '$DOMAIN' in n:
58	names.add(n)
59	print('\n'.join(sorted(names)))
60	" 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt
61
62	echo "[*] Found $(wc -l < evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt) unique subdomains from crt.sh"
63
64	# Subfinder passive subdomain enumeration
65	subfinder -d $DOMAIN \
66	-silent \
67	-o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/subfinder.txt 2>&1
68
69	# Combine and resolve all found subdomains
70	cat evidence/$(date +%Y%m%d)/$TARGET/osint/dns/crt_sh_subdomains.txt \
71	evidence/$(date +%Y%m%d)/$TARGET/osint/dns/subfinder.txt \| \
72	sort -u \| \
73	dnsx -a -resp-only -silent \
74	-o evidence/$(date +%Y%m%d)/$TARGET/osint/dns/resolved_subdomains.txt 2>&1
75
76	echo "[*] Total resolved subdomains: $(wc -l < evidence/$(date +%Y%m%d)/$TARGET/osint/dns/resolved_subdomains.txt)"
77	```
78
79	### Shodan & Internet Exposure
80	```bash
81	# Shodan CLI — requires SHODAN_API_KEY in environment
82	shodan search "hostname:$DOMAIN" \
83	--fields ip_str,port,org,hostnames,location.country_code \
84	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/shodan_domain.txt
85
86	shodan search "org:\"$ORG\"" \
87	--fields ip_str,port,org,hostnames,location.country_code \
88	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/shodan_org.txt
89
90	# Shodan host lookup for specific IP
91	shodan host $IP 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/shodan_host_$IP.txt
92
93	# Shodan special searches
94	shodan search "ssl.cert.subject.CN:$DOMAIN" \
95	--fields ip_str,port,ssl.cert.subject.CN 2>&1
96	shodan search "http.html:\"$ORG\"" \
97	--fields ip_str,port,http.title 2>&1
98
99	# Censys via API
100	curl -s "https://search.censys.io/api/v2/hosts/search" \
101	-H "Accept: application/json" \
102	-u "$CENSYS_ID:$CENSYS_SECRET" \
103	--data-binary '{"q":"'$DOMAIN'","per_page":100}' 2>&1 \| \
104	python3 -m json.tool \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/web/censys.json
105	```
106
107	### Email Harvesting
108	```bash
109	# theHarvester — aggregate multiple sources
110	theHarvester \
111	-d $DOMAIN \
112	-b google,bing,baidu,yahoo,linkedin,twitter,github,hunter \
113	-l 500 \
114	-f evidence/$(date +%Y%m%d)/$TARGET/osint/email/theharvester \
115	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/email/theharvester.log
116
117	# Hunter.io email format discovery
118	curl -s "https://api.hunter.io/v2/domain-search?domain=$DOMAIN&api_key=$HUNTER_KEY&limit=100" \| \
119	python3 -m json.tool 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/osint/email/hunter_io.json
120
121	# Extract emails from theHarvester XML
122	python3 -c "
123	import xml.etree.ElementTree as ET
124	tr

People who liked this also viewed

6 picks

Type