offensive-osint

name	offensive-osint
description	Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
version	3.0.0
triggers	["external recon","external red team","red team external","attack surface management","ASM","bug bounty recon","bug bounty","reconnaissance","footprinting","asset discovery","swagger discovery","openapi discovery","graphql introspection","graphql discovery","subdomain enumeration","subdomain takeover","cloud bucket enumeration","bucket enum","S3 enum","GCS enum","Azure blob enum","identity fabric","SSO discovery","IdP fingerprinting","tenant fingerprinting","okta enum","entra enum","azure AD enum","ADFS enum","SAML metadata","mobile recon","APK analysis","mobile attack surface","secret scanning","secret leak","leaked credential","github dorking","google dorking","bing dorking","DDG dorking","postman workspace","stack exchange OSINT","breach lookup","have I been pwned","HudsonRock cavalier","infostealer","dehashed","intelx","shodan recon","censys recon","certificate transparency","crt.sh","JARM","favicon mmh3","JS endpoint extraction","sourcemap leak","copy paste probes","curl one-liner","email security analysis","SPF DMARC DKIM","origin discovery","CDN bypass","WAF bypass","vendor product fingerprints","Citrix Netscaler","F5 BIG-IP","Pulse Secure","FortiGate","PaloAlto GlobalProtect","Cisco AnyConnect","VMware vCenter","cloud native fingerprint","Lambda function URL","Cloud Run","kubernetes exposure","kubelet","etcd","CI CD exposure","Jenkins recon","GitLab self-hosted","GitHub Actions secrets","documentation leak","Notion public","Confluence anonymous","Trello board","WHOIS RDAP","DNS record catalog","Wayback CDX","LinkedIn enumeration","job posting tech stack","Slack workspace discovery","Discord server discovery","npm token leak","PyPI token leak","Docker Hub leak","sat imagery physical recon","TLS deep audit","JA3 JA4","reverse DNS sweep","IPv6 enumeration","CVE prioritization","EPSS scoring","CISA KEV","vulnerability prioritization","tooling install","sector specific recon","healthcare DICOM","finance SWIFT","ICS SCADA","Modbus","BACnet","post discovery workflow","JWT triage","AWS key triage","GraphQL field suggestion","Anthropic API key","OpenAI API key","Microsoft 365 deep","Teams federation","SharePoint enum","OneDrive enum","hackerone reference","h1 hacktivity","disclosed reports","community bug reports","prior disclosures","bug bounty reference"]

Offensive OSINT — External Red-Team Arsenal

v3.0 — Refactored 2026-05-02 from a 4,168-line monolith into a lean SKILL.md (~400 lines) plus 15 modular reference files in references/. Detail content loads on demand — Claude reads only the reference files relevant to the current task.

0. When to use / When NOT

Use this skill when:

• You need concrete probe paths, wordlists, regexes, payloads, scoring rules, or tool URLs.
• You're executing reconnaissance and need the actual technical reference (vs. methodology).
• You're building a recon automation and need specific lists to seed it.

Do NOT use this skill when:

• The user is asking for active exploitation, post-exploitation, or anything past reconnaissance.
• The user is asking for defensive / blue-team detections.
• The target's authorization isn't established — see §1.

---

1. Authorization & Legal Posture

For assets the operator owns or has written authorization to assess. Soft scope check before acting against an unverified third-party target — see methodology skill §1 for the full posture.

---

2. Confidence Levels

• TENTATIVE — plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).
• FIRM — directly observed (subdomain resolves, HEAD-confirmed bucket exists, banner returned).
• CONFIRMED — verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).

---

3. Output Format Conventions

Findings should carry: id, module, asset_key, category, severity (info/low/medium/high/critical), confidence, title, description, evidence (url + UTC timestamp + sha256 + raw ≤ 2 KiB), references, remediation. UTC timestamps everywhere.

---

4. Source Hygiene & Citations

URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.

---

5. Do NOT

• Don't paste creds/PII/session tokens into cloud LLMs.
• Don't run destructive probes outside DEEP/.