recon-osint

Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)

Jump to install

Repository: hypnguyen1209/offensive-claude
Last source activity: June 29, 2026 at 07:22
Detected SKILL.md language: English
Stars: 343
Forks: 59

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill recon-osint

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

15 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

reverse-engineering

Use when reverse-engineering a binary or firmware — static triage + decompilation (Ghidra/IDA/Binary Ninja), dynamic instrumentation (GDB/Frida 17/angr), anti-reversing & packer bypass, OLLVM/VM deobfuscation, UEFI/BIOS RE & Secure Boot research, patch-diffing for n-days

2026-07-30

privesc-windows

Use when escalating privileges on a Windows host — SeImpersonate Potato chains (GodPotato/PrintNotifyPotato), service & DLL hijacking, UAC bypass (fodhelper/ICMLuaUtil), kernel EoP + BYOVD (CVE-2025-29824), token-rights abuse, LSASS/SAM/DPAPI credential harvesting

2026-06-30

threat-model-discipline

Use when starting an engagement, before exploitation, or whenever the attack surface changes — build/validate the threat model and detect drift (new unreviewed surface) before advancing

2026-06-30

View all from this repository

Reconnaissance & OSINT

When to Activate

A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.

Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.

Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.

Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).

Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.

Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Passive subdomain enum (subfinder/amass/CT logs)

T1590.002, T1596.001

CWE-200

references/subdomain-discovery.md

scripts/recon_orchestrator.py

DNS brute / permutation / resolution (puredns/alterx/dnsx)

T1595.002, T1590.002

CWE-200

references/subdomain-discovery.md

scripts/recon_orchestrator.py

ASN → CIDR → reverse-DNS expansion

T1590.005, T1596.005

CWE-200

references/subdomain-discovery.md

scripts/recon_orchestrator.py

HTTP probing + tech fingerprint (httpx)

T1595.002, T1592.002

CWE-200

references/attack-surface-mapping.md

scripts/recon_orchestrator.py

Headless crawling + archive URLs (katana/gau)

T1595.002, T1593.003

CWE-200

references/attack-surface-mapping.md

scripts/js_secret_hunter.py

JavaScript endpoint / secret extraction

T1593.003, T1552.001

CWE-540

references/attack-surface-mapping.md

scripts/js_secret_hunter.py

Subdomain takeover (dangling CNAME/NS)

T1583.001, T1584.001

CWE-350

references/subdomain-takeover.md

scripts/subdomain_takeover.py

Deleted-S3 takeover → supply-chain pivot

T1583.001, T1195.002

CWE-350

references/subdomain-takeover.md

scripts/subdomain_takeover.py

Reconnaissance & OSINT

When to Activate

A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.

Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.

Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.

Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).

Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.

Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.

Technique Map

Technique

ATT&CK

CWE

Reference

Script

Passive subdomain enum (subfinder/amass/CT logs)

T1590.002, T1596.001

CWE-200

references/subdomain-discovery.md

scripts/recon_orchestrator.py

DNS brute / permutation / resolution (puredns/alterx/dnsx)

T1595.002, T1590.002

CWE-200

references/subdomain-discovery.md

scripts/recon_orchestrator.py

ASN → CIDR → reverse-DNS expansion

T1590.005, T1596.005

CWE-200

references/subdomain-discovery.md

scripts/recon_orchestrator.py

HTTP probing + tech fingerprint (httpx)

T1595.002, T1592.002

CWE-200

references/attack-surface-mapping.md

scripts/recon_orchestrator.py

Headless crawling + archive URLs (katana/gau)

T1595.002, T1593.003

CWE-200

references/attack-surface-mapping.md

scripts/js_secret_hunter.py

JavaScript endpoint / secret extraction

T1593.003, T1552.001

CWE-540

references/attack-surface-mapping.md

scripts/js_secret_hunter.py

Subdomain takeover (dangling CNAME/NS)

T1583.001, T1584.001

CWE-350

references/subdomain-takeover.md

scripts/subdomain_takeover.py

Deleted-S3 takeover → supply-chain pivot

T1583.001, T1195.002

CWE-350

references/subdomain-takeover.md

scripts/subdomain_takeover.py

name	recon-osint
description	Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
metadata	{"type":"offensive","phase":"reconnaissance","tools":"subfinder, amass, puredns, dnsx, httpx, katana, gau, nuclei, subzy, baddns, cloud_enum, AADInternals, trufflehog, gitleaks, theHarvester, h8mail, shodan, censys","mitre":"TA0043"}
kill_chain	{"phase":["recon"],"step":[1],"attck_tactics":["TA0043","TA0006"],"attck_techniques":["T1595","T1595.002","T1590","T1590.001","T1590.002","T1590.005","T1592","T1592.002","T1589","T1589.001","T1589.002","T1593","T1593.001","T1593.003","T1596","T1596.005","T1591","T1583.001","T1213.003"]}
depends_on	[]
feeds_into	["vulnerability-analysis","web-pentest","network-attack","exploit-development","cloud-security","mobile-pentest","active-directory-attack","initial-access"]
inputs	["scope_definition","target_list","root_domains","asn_list","email_list"]
outputs	["attack_surface_map","subdomain_list","technology_fingerprint","cve_list","takeover_candidates","leaked_secrets","breach_intel","prioritized_findings"]
references	["references/subdomain-discovery.md","references/attack-surface-mapping.md","references/subdomain-takeover.md","references/cloud-saas-recon.md","references/breach-credential-intel.md","references/cve-exploit-intel.md"]
scripts	["scripts/recon_orchestrator.py","scripts/subdomain_takeover.py","scripts/js_secret_hunter.py","scripts/cloud_asset_enum.py","scripts/breach_intel.py","scripts/cve_prioritizer.py","scripts/wordlist_ranker.py","scripts/hackerone_public_recon.py"]

name	recon-osint
description	Use when mapping a target's external attack surface or gathering OSINT — subdomain enumeration, attack-surface mapping (httpx/katana/JS secrets), subdomain takeover, multi-cloud/Azure tenant recon, GitHub secret dorking, breach/infostealer credential intel, CVE prioritization (EPSS/KEV)
metadata	{"type":"offensive","phase":"reconnaissance","tools":"subfinder, amass, puredns, dnsx, httpx, katana, gau, nuclei, subzy, baddns, cloud_enum, AADInternals, trufflehog, gitleaks, theHarvester, h8mail, shodan, censys","mitre":"TA0043"}
kill_chain	{"phase":["recon"],"step":[1],"attck_tactics":["TA0043","TA0006"],"attck_techniques":["T1595","T1595.002","T1590","T1590.001","T1590.002","T1590.005","T1592","T1592.002","T1589","T1589.001","T1589.002","T1593","T1593.001","T1593.003","T1596","T1596.005","T1591","T1583.001","T1213.003"]}
depends_on	[]
feeds_into	["vulnerability-analysis","web-pentest","network-attack","exploit-development","cloud-security","mobile-pentest","active-directory-attack","initial-access"]
inputs	["scope_definition","target_list","root_domains","asn_list","email_list"]
outputs	["attack_surface_map","subdomain_list","technology_fingerprint","cve_list","takeover_candidates","leaked_secrets","breach_intel","prioritized_findings"]
references	["references/subdomain-discovery.md","references/attack-surface-mapping.md","references/subdomain-takeover.md","references/cloud-saas-recon.md","references/breach-credential-intel.md","references/cve-exploit-intel.md"]
scripts	["scripts/recon_orchestrator.py","scripts/subdomain_takeover.py","scripts/js_secret_hunter.py","scripts/cloud_asset_enum.py","scripts/breach_intel.py","scripts/cve_prioritizer.py","scripts/wordlist_ranker.py","scripts/hackerone_public_recon.py"]

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
Passive enum (CT/API)	None on target; queries hit 3rd-party APIs	Target cannot see it; CT-log monitoring (certstream) detects new certs only	Fully passive — prefer for stealth; no target traffic
DNS brute / resolution	Burst of NXDOMAIN/A queries to authoritative + resolvers	DNS firewall: high-volume distinct-label rate per source IP; Zeek `dns.cc`/NXDOMAIN ratio	Throttle `-rate`, rotate resolvers, never brute a single auth NS directly
httpx / katana probing	Spike of HTTP(S) requests, odd UA, favicon/JARM fetches	WAF/CDN: request-rate + UA anomaly; access-log `User-Agent: httpx`/`katana`	Set custom UA, low `-rl`, route via proxy pool / cloud egress
Subdomain takeover check	HTTP GET to dangling host (lands on 3rd-party)	3rd-party provider logs; CT for new cert on claimed host	Verify with passive fingerprint before any claim; claiming is loud
Cloud bucket enum	DNS + HTTP to `*.s3/blob/storage.googleapis`	Cloud provider access logs; GuardDuty `Discovery:S3/*`	Hits provider, not target; still rate-limited / loggable
Azure tenant recon	Requests to `login.microsoftonline.com`	Entra sign-in/audit logs do not see unauth realm probes	`getuserrealm`/OpenID are unauth & invisible to tenant
GitHub/GitLab dorking	API/search queries from your token	GitHub audit log (only org members'); secret-scanning alerts	Use a throwaway token; respect rate limits to avoid bans
Breach/infostealer lookup	3rd-party API calls (HIBP/DeHashed)	None on target	Handle PII per ROE/GDPR; document lawful basis
CVE enrichment	NVD/EPSS/KEV/Shodan API calls	None on target	Map exposure to in-scope assets only

recon-osint

Install options

Review the source files

Reconnaissance & OSINT

When to Activate

Technique Map

Reconnaissance & OSINT

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

recon-osint

Source facts

Install options

Review the source files

More from this repository

Reconnaissance & OSINT

When to Activate

Technique Map

Reconnaissance & OSINT

When to Activate

Technique Map

Quick Start

OPSEC & Detection (summary)

Deep Dives

More from this repository