domains / security / external-recon / offensive-osint

offensive-osint

Skill card

combined

The copies overlap heavily on the 'Operational Arsenal' (probes, regexes, wordlists) but diverge on scope and safety. SnailSploit/Claude-Red is a broad methodology skill covering people, social media, and crypto, lacking the specific technical probes of the others. uphiago/recon-skills and elementalsouls/Claude-OSINT are technical recon arsenals, but elementalsouls includes a much larger secret-pattern catalog (80 vs 48) and mobile/APK analysis. sickn33/agentic-awesome-skills is a mirror of the uphiago/elementalsouls content but adds a mandatory 'confirmation gate' for authorization that the others lack. Because the SnailSploit copy covers a different domain (human/OSINT) and the sickn33 copy adds a critical safety constraint not present in the others, no single copy is the 'authentic' procedure for all.

Repositories

Other copies

Combined skill

---
name: offensive-osint
description: "Comprehensive offensive OSINT and external red-team recon skill. Covers human-centric OSINT (people, social, crypto) and technical recon (probes, secrets, infrastructure). Includes mandatory authorization gates."
---

# Offensive OSINT & Recon

## 1. Authorization & Safety
- **Mandatory Confirmation Gate**: Before any active probe, the user must state the exact target and confirm written authorization.
- **Scope**: Use for authorized external recon, bug bounty, or red-team engagements.
- **Do NOT**: Use for active exploitation, post-exploitation, or unauthorized targets.

## 2. Workflow
1. **Define Scope**: Determine if the target is a domain/org (technical) or a person/entity (human).
2. **Select Category**:
   - **Human/OSINT**: Use tools for username/email/phone/people search (e.g., Sherlock, Hunter.io, TruePeopleSearch).
   - **Technical Recon**: Use the operational arsenal for subdomain enum, secret scanning, and infrastructure mapping.
3. **Execute**:
   - **Technical**: Load specific reference files (probes, secret-patterns, identity-fabric) as needed.
   - **Human**: Pivot on discovered artifacts (emails, usernames) to social media and breach data.
4. **Archive**: Log all findings in JSONL with `run_id`, timestamps, and SHA-256 hashes.

## 3. Technical Recon Arsenal
- **Probes**: Use wordlists for Swagger, GraphQL, and cloud buckets.
- **Secrets**: Scan for 80+ patterns (AWS, GCP, AI keys, etc.).
- **Identity**: Enumerate Entra, Okta, ADFS, and M365 endpoints.
- **Mobile**: Perform APK static analysis for embedded secrets and misconfigurations.

## 4. Human-Centric OSINT
- **Username/Email**: Use Sherlock, Maigret, and Hunter.io.
- **Social Media**: Use platform-specific tools (Picuki, snscrape, etc.).
- **Breach Data**: Check Have I Been Pwned, DeHashed, and HudsonRock.

## 5. Output Format
- Findings must include: `id`, `module`, `asset_key`, `severity`, `confidence`, `evidence` (URL + timestamp + hash), and `remediation`.