domains / families / security / osint-methodology

osint-methodology

combined

Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → asset expansion → enrichment → exposure analysis → convergence → operator-armed active validation) with connector-resilience and stage-vs-gating discipline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation with per-person identity dossiers, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables. Comprehensive OSINT methodology for external red-team operations and

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The three copies are not simple reproductions of one another. The uphiago copy (v2.1) describes a 5-stage pipeline and includes specific operational tactics (identity-fabric mapping, JavaScript deep analysis, mobile/cloud attack surface, threat-actor pivots, crypto tracing, forensics) that the others omit. The elementalsouls copy (v2.3) describes a 6-stage pipeline (adding convergence and active validation) and includes specific structural artifacts (Finding schema, Source Hygiene, Confidence Upgrade Workflows table) that the others omit. The sickn33 copy is a mirror of the elementalsouls content (v2.3) but adds a distinct 'Mandatory confirmation gate' requiring explicit user confirmation of the target and scope before any probing, which is a stricter constraint than the 'soft scope check' in the other two. Because the copies disagree on the pipeline stage count (5 vs 6) and the authorization gate strictness (soft check vs mandatory confirmation), and each contains unique material steps, crowning one would hide real alternatives.