메뉴
Google-dork a target domain for exposed documents, directory listings, login portals, and misconfigurations using the `dork` source (real Google operators), then capture the result pages and produce a cited exposure brief.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | overcast-dork-recon |
| description | Google-dork a target domain for exposed documents, directory listings, login portals, and misconfigurations using the `dork` source (real Google operators), then capture the result pages and produce a cited exposure brief. |
Use this skill to search a target domain's public exposure with Google dorking.
The dork source (Serper.dev) passes your query verbatim to Google, so
operators (site: filetype: inurl: intitle: ext: -term OR) are
honored — unlike web (Tavily/Brave), which ignores them. Use the broad
overcast skill and overcast/reference/verbs.md for exact flags.
⚠️ Authorized recon only. Dorking surfaces exposed and often sensitive material. Run it only against domains you are permitted to investigate.
dorkis never a default source — you bind it deliberately.
overcast doctor --sources --json # confirm SERPER_API_KEY is set
overcast case init --json
overcast case setup --target "<domain>" --yes --json
overcast source add 'dork:site:<domain>' --json # register the dork source (any starter dork)
Run each template as its own scan against the target domain <domain> — the
ad-hoc --query overrides the bound ref, so one registered dork source serves
the whole battery. --pull captures each result page as evidence.
# Exposed documents (reports, spreadsheets, slides, configs)
overcast scan --source dork --query 'site:<domain> filetype:pdf OR filetype:xls OR filetype:xlsx OR filetype:doc OR filetype:docx' --limit 20 --pull --json
# Open directory listings
overcast scan --source dork --query 'site:<domain> intitle:"index of"' --limit 20 --pull --json
# Login / admin portals
overcast scan --source dork --query 'site:<domain> inurl:login OR inurl:admin OR inurl:signin OR intitle:"admin"' --limit 20 --pull --json
# Config / secret / log files
overcast scan --source dork --query 'site:<domain> ext:env OR ext:sql OR ext:log OR ext:bak OR ext:ini OR ext:conf' --limit 20 --pull --json
# Error / debug pages that leak stack traces or paths
overcast scan --source dork --query 'site:<domain> "sql syntax near" OR "stack trace" OR "Warning: mysql" OR "Fatal error"' --limit 20 --pull --json
# Git / backup / archive exposure
overcast scan --source dork --query 'site:<domain> inurl:.git OR inurl:backup OR ext:zip OR ext:tar OR ext:gz' --limit 20 --pull --json
# Subdomain / host discovery (exclude the apex www)
overcast scan --source dork --query 'site:*.<domain> -www' --limit 20 --pull --json
overcast finding list --state triage --json # leads auto-suggested from SENSED result pages
overcast finding accept <id> --json # promote a real exposure (or `dismiss <id>`)
overcast note "<what this dork exposed>" --ref <scan-record-id> --json # for hits worth flagging by hand
overcast finding create "<exposure summary>" --ref <scan-record-id> --json
overcast ask "which results indicate real exposure (credentials, PII, internal docs, misconfig)? group by severity" --json
overcast brief --export ./dork-recon.md --json
A cited exposure brief: each confirmed exposure with the dork that surfaced it,
the result URL, the captured page record.id, and a severity read. Note which
templates returned nothing (coverage), and flag any capture that was blocked
(login wall, robots, dead link).
scan --pull senses the captured page (the case's see/auto-sense chain) or
you flag one by hand with note / finding create. Run --pull (or a
case setup --auto-sense see) so leads actually populate the triage queue.--limit modest and batteries targeted.Give any agent senses (video/audio/image understanding) and OSINT reach (search/capture/monitor) organized around an investigation case. Use when the user wants to analyze a video/audio/image, scan or monitor sources for a target, or ask/brief over accumulated findings. Drives the `overcast` CLI (built on pi + the tinycloud/Cloudglue perception backend); see reference/verbs.md for the full verb surface.
Install and configure overcast for this harness: install the CLI, verify the system ffmpeg, and configure reusable provider profiles. Use once per machine/profile before driving the `overcast` skill.
Turn a case into a visual evidence board — materialize face and object crops, link the same person across clips, connect themes, and render the corkboard as a CSI brief plus a live monitor wall.
Make unreadable footage legible — denoise/upscale a marked moment, re-run OCR and detection on the enhanced output, and record what was recovered with honest provenance (interpolation is a lead, not proof).
Work out where a photo or clip was taken — check embedded EXIF/GPS first, then pull signage, landmarks, and terrain clues, reverse-image-search the strongest ones, and corroborate to a location with cited evidence.
Run a standing surveillance watch on public sources for a target — auto-sense new media, auto-suggest matches into a triage queue, and keep a live control-room wall — so new evidence surfaces itself over time.