domains / families / security / offensive-osint

offensive-osint

combined

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map. Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud bucket permutations, JS guess-paths, vendor product fingerprints for Citrix/F5/Pulse/Fortinet/Cisco/PaloAlto/VMware/Exchange, cloud-native service fingerprints, container/K8s exposure paths, CI/CD platform paths, documentation/wiki leak paths, WHOIS/RDAP, DNS record catalog, Wayback CDX recipes), 80-pattern secret-regex catalog (incl. modern AI API keys: Anthropic/OpenAI/HuggingFace/Cloudflare/DigitalOcean/npm/PyPI/Docker Hub/Atlassian/DataDog/Sentry/ngrok; plus a provider-expansion tier: Postman PMAK/GitLab/Square/Shopify/Mailchimp/PagerDuty/Asana/Databricks/Grafana/Terraform Cloud/Fastly/Algolia/Segment/Airtable/GCP+Google OAuth/Azure AD/Facebook OAuth/RubyGems/JFrog/Okta/Slack app-level/Dropbox/Doppler/HashiCorp Vault/Firebase Cloud Messaging), 80+ dork corpus acr…

When to use

You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
You need an individual reconnaissance reference or evidence triage; active verification stays inside the specific approved target and technique.

When not to use

Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
The 15 reference documents are bundled; executable upstream helpers, engines and external testing tools are not. Source examples are not runtime availability or observed test results. Review pinned external tooling in an isolated environme…
Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The copies overlap heavily on the 'Operational Arsenal' (probes, regexes, wordlists) but diverge on scope and safety. SnailSploit/Claude-Red is a broad methodology skill covering people, social media, and crypto, lacking the specific technical probes of the others. uphiago/recon-skills and elementalsouls/Claude-OSINT are technical recon arsenals, but elementalsouls includes a much larger secret-pattern catalog (80 vs 48) and mobile/APK analysis. sickn33/agentic-awesome-skills is a mirror of the uphiago/elementalsouls content but adds a mandatory 'confirmation gate' for authorization that the others lack. Because the SnailSploit copy covers a different domain (human/OSINT) and the sickn33 copy adds a critical safety constraint not present in the others, no single copy is the 'authentic' procedure for all.