원클릭으로 Manus에서 모든 스킬 실행

osint-recon

스타279

포크27

업데이트2026년 5월 27일 05:59

Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'investigate a domain,' or needs to research a target using publicly available data.

설치

Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.

Manus에서 실행

출처

briiirussell

briiirussell/cybersecurity-skills

GitHub 저장소 열기 Creator 저장소 보기

다운로드

Manus에서 실행

OSINT Recon — Open Source Intelligence Gathering

Systematically gather, analyze, and correlate publicly available information from open sources.

Cross-references: recon for the active/passive target-mapping pass against an authorized system (DNS, ports, fingerprinting) — osint-recon focuses on people, organizations, leaked data, and historical artifacts; the two pair naturally. breach-patterns for ingesting public breach intelligence into your own preemptive assessments. incident-triage if OSINT surfaces evidence the user is already compromised.

Ethics Check

Before proceeding, confirm:

The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
You are only gathering publicly available information
Results will not be used for harassment, stalking, or doxing

Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.

Collection Techniques

Domain and Infrastructure OSINT

Run these to map a target's infrastructure:

whois <domain>                  # Registration data
dig any <domain>                # DNS records

Query certificate transparency for subdomains:

curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u

Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.

Organization OSINT

Company registrations, filings, SEC records (public companies)
LinkedIn company page — employee count, roles, tech stack hints
Job postings — reveal internal tools, tech stack, pain points
Press releases and news articles
GitHub/GitLab organization pages and public repositories
Patent filings

Email and Username OSINT

Email format patterns (e.g., first.last@domain.com)
HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
PGP key servers for email discovery
Gravatar lookups for email-to-identity correlation

Document and File OSINT

Extract metadata from public documents: exiftool <file> reveals author, software, GPS, timestamps
Google dorking: site:<domain> filetype:pdf, site:<domain> filetype:xlsx
Pastebin and code paste site monitoring
Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)

Threat Intelligence

CVE databases for the target's technology stack
Exploit databases (exploit-db, searchsploit)
Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
Abuse contact databases

Analysis

Cross-reference findings across multiple sources
Validate information with at least two independent sources
Build a timeline of events when investigating incidents
Map relationships between entities (people, domains, IPs, organizations)
Rate confidence: High (multiple corroborating sources), Medium (single reliable source), Low (unverified)

Output Format

# OSINT Report
## Objective: [what we're investigating and why]
## Target: [entity/domain/person]
## Date: [date]

### Collection Summary
| Source | Findings | Confidence |
|--------|----------|------------|

### Key Findings

#### Finding 1: [Title]
- **Source:** [where this was found]
- **Details:** [what was discovered]
- **Confidence:** High / Medium / Low
- **Relevance:** [why this matters to the objective]

### Correlations
[How different findings connect to each other]

### Intelligence Gaps
[What we couldn't find or verify]

### Recommendations
[Next steps and actionable intelligence]

Boundaries

Only use publicly available sources
Never attempt to access private or authenticated systems
Do not aggregate PII beyond what is necessary for the stated objective
Attribute all findings to their source
Rate confidence levels honestly — do not overstate certainty
If a finding could cause harm if misused, note the sensitivity
Refuse requests for doxing, stalking, or unauthorized surveillance

References

OSINT Framework (osintframework.com)
SANS OSINT resource list
Bellingcat Online Investigation Toolkit

이 저장소의 다른 Skills

같은 저장소

breach-patterns

briiirussell/cybersecurity-skills

Learn from public breach disclosures — extract the audit question each one implies and check your own stack. Capital One IMDS abuse, LastPass vault exfiltration, Okta Lapsus$, Snowflake credential reuse, MOVEit, SolarWinds, Equifax, Target POS, Codecov, Uber, Twilio — what would you check now if your boss said 'could that happen to us?' Use when the user mentions 'breach analysis,' 'lessons learned,' 'security postmortem,' 'breach patterns,' 'breach lessons,' 'has this happened to us,' 'apply breach lessons,' 'preempt breaches,' 'security retrospective,' 'real-world security incidents,' or wants to harden against known attacker playbooks.

2026-05-27288

finding-triage

briiirussell/cybersecurity-skills

Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup. Use when the user mentions 'triage this finding,' 'is this a real vulnerability,' 'mitigation plan,' 'false positive,' 'accept this risk,' 'compensating controls,' 'risk justification,' 'security ticket,' 'CVSS this,' 'should we fix this,' 'disposition,' 'sign off on,' or has a single security finding and needs to decide what to do.

2026-05-27288

incident-triage

briiirussell/cybersecurity-skills

Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology. Use when the user mentions 'incident response,' 'security incident,' 'triage,' 'we've been hacked,' 'breach,' 'compromised,' 'malware detected,' 'suspicious activity,' 'IOC,' 'indicators of compromise,' or needs help handling a security event.

2026-05-27288

prompt-injection

briiirussell/cybersecurity-skills

Audit applications for AI prompt injection, agent security, and LLM permission boundary vulnerabilities. Use when the user mentions 'prompt injection,' 'LLM security,' 'AI security,' 'jailbreak,' 'indirect prompt injection,' 'prompt leaking,' 'AI red team,' 'LLM vulnerabilities,' 'AI input validation,' 'system prompt extraction,' 'agent security,' 'MCP security,' 'AI permissions,' 'AI privilege escalation,' or needs to secure any application with AI features, AI agents, or LLM integrations.

2026-05-27288

hipaa-audit

briiirussell/cybersecurity-skills

Audit applications and infrastructure handling Protected Health Information against HIPAA — Security Rule (administrative, physical, technical safeguards), Privacy Rule, Breach Notification Rule, plus HITECH. Covers ePHI scoping, the 18 HIPAA identifiers, Business Associate Agreement (BAA) chain-of-liability, minimum-necessary standard, and breach notification timing. Use when the user mentions 'HIPAA,' 'HIPAA Security Rule,' 'HIPAA Privacy Rule,' 'PHI,' 'ePHI,' 'protected health information,' 'BAA,' 'business associate agreement,' 'covered entity,' 'business associate,' 'minimum necessary,' 'HIPAA breach,' 'HITECH,' 'healthcare compliance,' 'medical data,' 'patient data,' or audits any system that creates, receives, maintains, or transmits PHI.

2026-05-27288

pci-audit

briiirussell/cybersecurity-skills

Audit applications and infrastructure handling payment card data against PCI DSS v4.0. Heavy emphasis on scope determination (the single most-leveraged variable) plus the engineering-relevant requirements — Req 3 (storage of CHD), Req 4 (transmission), Req 6 (secure SDLC), Req 7-8 (access), Req 10 (logging), Req 11 (testing), Req 12 (program). Use when the user mentions 'PCI,' 'PCI DSS,' 'PCI DSS 4.0,' 'payment card,' 'cardholder data,' 'CHD,' 'PAN,' 'PCI scope,' 'PCI compliance,' 'SAQ,' 'AoC,' 'attestation of compliance,' 'tokenization,' 'P2PE,' 'network segmentation for PCI,' or audits any system that stores, processes, or transmits payment card data.

2026-05-27288

name	osint-recon
description	Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'investigate a domain,' or needs to research a target using publicly available data.
allowed-tools	Bash, WebSearch, WebFetch, Read, Write

OSINT Recon — Open Source Intelligence Gathering

Systematically gather, analyze, and correlate publicly available information from open sources.

Ethics Check

Before proceeding, confirm:

The investigation has a legitimate purpose (threat intel, authorized assessment, CTF, defensive research)
You are only gathering publicly available information
Results will not be used for harassment, stalking, or doxing

Refuse requests that target individuals for harassment or aggregate private information beyond what the objective requires.

Collection Techniques

Domain and Infrastructure OSINT

Run these to map a target's infrastructure:

whois <domain>                  # Registration data
dig any <domain>                # DNS records

Query certificate transparency for subdomains:

curl -s "https://crt.sh/?q=%25.<domain>&output=json" | jq -r '.[].name_value' | sort -u

Additional sources: SecurityTrails, DNSDumpster, ipinfo.io, bgp.he.net, Wayback Machine, Shodan, Censys.

Organization OSINT

Company registrations, filings, SEC records (public companies)
LinkedIn company page — employee count, roles, tech stack hints
Job postings — reveal internal tools, tech stack, pain points
Press releases and news articles
GitHub/GitLab organization pages and public repositories
Patent filings

Email and Username OSINT

Email format patterns (e.g., first.last@domain.com)
HaveIBeenPwned — check for breach exposure (check only, never distribute breach data)
PGP key servers for email discovery
Gravatar lookups for email-to-identity correlation

Document and File OSINT

Extract metadata from public documents: exiftool <file> reveals author, software, GPS, timestamps
Google dorking: site:<domain> filetype:pdf, site:<domain> filetype:xlsx
Pastebin and code paste site monitoring
Public cloud storage enumeration (S3 buckets, GCS buckets with predictable names)

Threat Intelligence

CVE databases for the target's technology stack
Exploit databases (exploit-db, searchsploit)
Threat feeds and IOC databases (VirusTotal, MalwareBazaar, OTX)
Abuse contact databases

Analysis

Cross-reference findings across multiple sources
Validate information with at least two independent sources
Build a timeline of events when investigating incidents
Map relationships between entities (people, domains, IPs, organizations)
Rate confidence: High (multiple corroborating sources), Medium (single reliable source), Low (unverified)

Output Format

# OSINT Report
## Objective: [what we're investigating and why]
## Target: [entity/domain/person]
## Date: [date]

### Collection Summary
| Source | Findings | Confidence |
|--------|----------|------------|

### Key Findings

#### Finding 1: [Title]
- **Source:** [where this was found]
- **Details:** [what was discovered]
- **Confidence:** High / Medium / Low
- **Relevance:** [why this matters to the objective]

### Correlations
[How different findings connect to each other]

### Intelligence Gaps
[What we couldn't find or verify]

### Recommendations
[Next steps and actionable intelligence]

Boundaries

Only use publicly available sources
Never attempt to access private or authenticated systems
Do not aggregate PII beyond what is necessary for the stated objective
Attribute all findings to their source
Rate confidence levels honestly — do not overstate certainty
If a finding could cause harm if misused, note the sensitivity
Refuse requests for doxing, stalking, or unauthorized surveillance

References

OSINT Framework (osintframework.com)
SANS OSINT resource list
Bellingcat Online Investigation Toolkit