Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog, Postman workspaces, breach correlation, TLS/JA3 audit, secret triage. Detail content in 15 modular reference files. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
license
MIT
revision_date
"2026-07-25T00:00:00.000Z"
category
redteam
tags
["osint","offensive","recon","redteam"]
version
3.0.0
Offensive OSINT — External Red-Team Arsenal
v3.0 — Refactored 2026-05-02 from a 4,168-line monolith into a lean SKILL.md (~400 lines) plus 15 modular reference files in references/. Detail content loads on demand — Claude reads only the reference files relevant to the current task.
0. When to use / When NOT
Use this skill when:
You need concrete probe paths, wordlists, regexes, payloads, scoring rules, or command-line URLs.
You're executing reconnaissance and need the actual technical reference (vs. methodology).
You're building a recon automation and need specific lists to seed it.
Do NOT use this skill when:
The user is asking for active exploitation, post-exploitation, or anything past reconnaissance.
The user is asking for defensive / blue-team detections.
The target's authorization isn't established — see §1.
1. Authorization & Legal Posture
For assets the operator owns or has written authorization to assess. Soft scope check before acting against an unverified third-party target — see methodology skill §1 for the full posture.
2. Confidence Levels
TENTATIVE — plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).
CONFIRMED — verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).
3. Output Format Conventions
Findings should carry: id, module, asset_key, category, severity (info/low/medium/high/critical), confidence, title, description, evidence (url + UTC timestamp + sha256 + raw ≤ 2 KiB), references, remediation. UTC timestamps everywhere.
4. Source Hygiene & Citations
URL + UTC timestamp + SHA-256 +tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.
5. Do NOT
Don't paste creds/PII/session tokens into cloud LLMs.
Don't run destructive probes outside DEEP/--aggressive.
Don't use validated credentials for anything except read-only liveness check.
This skill is a lean operational index. Most concrete data (wordlists, regexes, dorks, endpoint catalogs, severity examples) lives in the references/ subfolder, organized by topic.
Workflow when this skill triggers:
Read this SKILL.md to anchor on principles (§0-5), scoring rubrics (§20-21), attack-path templates (§39), and the references index below.
For task-specific data, read only the reference file(s) you need — do NOT pull all 15. Each reference is self-contained.
Use the bug-bounty skill for the local toolkit at ~/security-research/bug-bounty-resources/ and osint-methodology for the planning framework.
Loading rules of thumb:
Single-class question (e.g., "what's the regex for AWS keys?") → load secret-patterns.md only.
Multi-class engagement (e.g., "do an external recon on target.com") → load probes-and-wordlists.md first, then add others as the engagement narrows.
Developer website URL is the target domain (or a confirmed sibling brand domain)
+20
App name contains a brand keyword from operator-supplied brand list
+10
App has ≥ minimum review-score threshold (default 20 reviews)
+5
Apps below threshold are tagged mobile_review_pending and shown but not analyzed. Operator can re-score with --mobile-ownership-threshold 50 for noisier collection.
39. Attack-Path Hint Patterns
When emitting a HIGH/CRITICAL API endpoint finding (score ≥ 70), include a one-sentence attack_path_hint in evidence so the operator knows where to start exploiting. Templates:
Trigger
Attack-path hint
Unauth POST / PUT / DELETE
"Unauthenticated {method} {path} — try IDOR + privilege escalation; check whether numeric IDs are sequential or guessable."
Open GraphQL introspection
"Open GraphQL introspection on {path} — enumerate mutations, look for createUser, setRole, transferFunds-shaped names; pivot to broken-auth or business-logic flaws."
Reflected CORS + creds
"Reflected CORS with credentials on {path} — host CSRF page on attacker-controlled origin; victim's browser will leak {sensitive-data-hint}."
Wildcard CORS + sensitive
"Wildcard CORS on {path} returning user-tied data without creds — exfiltrate via cross-origin fetch from any page victim visits."
Verb tampering
"Verb tampering: {hidden-method} allowed on documented-{visible-method}-only endpoint → likely missing-method-check authz bug; try {hidden-method} {path} with valid auth."
API key in URL
"API key in URL: ?{param}=... — token leaks to access logs, browser history, Referer headers, third-party CDNs. Check Wayback / Google for cached copies."
Schema leak in error
"Schema leak in error response — framework signature {framework} exposed; map to known {framework} vulns and craft targeted payloads."
Sensitive keyword
"Path contains '{keyword}' — review for direct object reference, mass-assignment, or hidden admin functionality."
Open RTDB Firebase
"Open Firebase RTDB at https://{project}.firebaseio.com/.json — read everything, then test write at /<random-key>.json with PUT to gauge ACL scope."
curl --max-time 30 --connect-timeout 10 -s "https://web.archive.org/cdx/search/cdx?url=example.com&output=text&limit=3" | head -3
All tests verify OSINT readiness.
Pitfalls
OSINT collection without scope validation — scraping LinkedIn/Shodan/crunchbase for employee names and tech stacks is recon, not a finding. The finding is what you DO with that data.
Breach data possession — possessing actual breach corpora (email:pass combos) is legally risky. Use hashes or redacted samples in reports.
Certificate transparency log mining — finding subdomains via crt.sh is highly automated now. The value is in what the subdomains expose, not just their existence.
Google dorks returning cached/outdated results — dork results may show pages that no longer exist. Verify each finding is live before reporting.
Social media scraping without authorization — some programs explicitly exclude social engineering and social media profiling. Check scope first.
Related Skills & Chains
web2-recon — When the arsenal needs to be executed against a live host set. Workflow primitive: this skill provides the probe paths and wordlists; web2-recon runs the actual subfinder → dnsx → httpx → katana pipeline that consumes them.
osint-methodology — When this skill's concrete probes need a planning framework. Workflow primitive: osint-methodology is the planning skeleton (5-stage pipeline, asset graph, findings rubric); this skill is the operational arsenal that fills each stage with curl one-liners and regexes.
hunt-subdomain — When this skill's subdomain enumeration finds stale CNAMEs. Workflow primitive: subdomains discovered via §27 / references/recon-stack.md get auto-routed to hunt-subdomain for takeover validation.
hunt-cloud-misconfig — When this skill's cloud-bucket enum surfaces listable buckets / Firebase / actuator endpoints. Workflow primitive: §39 attack-path hints (listable bucket, /actuator/env, open Elasticsearch) hand off to hunt-cloud-misconfig for exploitation.
m365-entra-attack / okta-attack — When identity-fabric fingerprinting finds Entra/Okta. Workflow primitive: references/identity-fabric.md fingerprints the IdP; matched platform skill (loaded by hunt-dispatch) takes over for active enumeration.
Search engines, username & email investigation, people search, phone OSINT, social media, public records & company info
username investigation, people search, phone OSINT, social media OSINT, public records
saas-public-surfaces.md
Postman public workspace search (verified endpoint), Stack Exchange OSINT sweep, public SaaS dork stack (Notion, Confluence, Trello)
Complement to sector-notes.md — mass recon of non-regulated US SMB sectors (landscaping, pool services, roofing, HVAC, auto repair, accounting, etc.) with parallel batch testing, false-positive filtering, empirical sector ranking. Reusable Python scanner at scripts/sector_mass_scan.py.
sector discovery, target discovery, non-regulated sectors, US small business recon, WordPress mass recon, parallel batch testing
tooling-install.md
Quick-install one-liners for Subfinder, Amass, httpx, nuclei, gau, katana, gowitness, dnsx, mapcidr, naabu, sslyze, testssl.sh, etc.
"Spring Boot /actuator/heapdump exposed — download HPROF, run jhat or VisualVM, search for cleartext secrets in heap strings."
Open Elasticsearch
"Open Elasticsearch on {host}:9200 — /_cat/indices?v for index list; sample documents from each high-value index; test write to /test-idx/_doc to gauge ACL."
Open Redis
"Open Redis on {host}:6379 — INFO, KEYS *, sample reads; check for write access via CONFIG SET then BGSAVE to write authorized_keys."
Open MongoDB
"Open MongoDB on {host}:27017 — show dbs, show collections, sample find queries; check user collection for password hashes."
Subdomain takeover
"CNAME for {host} points to unclaimed {provider} resource → register {takeover-target} on {provider} to serve content from {host}; pivot to phishing or content injection on the trusted domain."
Open kubelet
"Open kubelet on {host}:10250 — GET /pods to list; POST /run/<ns>/<pod>/<container> for in-container exec without K8s API auth."
Open etcd
"Open etcd on {host}:2379 — etcdctl get / --prefix --keys-only for full cluster state; secrets stored under /registry/secrets/."
K8s API anonymous
"Kubernetes API on {host}:6443 with anonymous-auth — kubectl --server=https://{host}:6443 --insecure-skip-tls-verify get pods --all-namespaces."
Citrix unpatched
"Citrix NetScaler version {ver} on {host} — vulnerable to CVE-{cve} (KEV-listed); see vendor advisory; do not exploit but flag for client immediate patching."
F5 BIG-IP TMUI exposed
"F5 BIG-IP TMUI on {host} reachable; CVE-2022-1388 / CVE-2023-46747 KEV applicable; advise immediate patching to vendor-released hotfix."
VMware vCenter accessible
"vCenter at {host} accessible without VPN; CVE-2021-21972 RCE if unpatched; check version banner."
Cloud function URL unauth
"AWS Lambda Function URL at {url} accessible anonymously — review IAM auth configuration; if unauthenticated by design, audit input validation aggressively."
npm typosquat candidate
"Package name {candidate} is unregistered + similar to target's published {official} — typosquat takeover risk; advise client to defensively register."
DMARC missing/permissive
"DMARC p=none on {domain} — spoof of {anything}@{domain} deliverable to recipients; recommend enforcement to p=quarantine or p=reject after observing reports."
Live AI API key (Anthropic/OpenAI)
"Validated sk-{provider}-... key with model access — quota cost can be exfiltrated; rotate immediately + audit usage logs in provider console."
Public Slack invite link
"Slack workspace invite link discoverable via search engine — anyone can join the workspace without approval; trivially access internal channels."
Open Docker registry
"Public Docker registry at {host} — GET /v2/_catalog lists images; pull and scan layers for embedded secrets."
Telegram bot token live
"Telegram bot token validated — getUpdates reveals bot recipients (admin chats); if getMe shows bot is in channels, full message read access."
Sourcemap with sourcesContent[]
"Sourcemap on {host} includes embedded original sources — full frontend code reconstructable; grep for inline secrets and internal hostnames."
"What modern AI API keys (Anthropic / OpenAI / HuggingFace / Cloudflare) match catalog patterns?" → §17 rows 30–48.
"Severity matrix for android:debuggable=true on prod app?" → §40.
"Install commands for the standard recon toolkit (subfinder/httpx/nuclei/etc.)?" → §46.
"For a healthcare engagement, what additional ports / protocols matter?" → §47.1.
"Pull HudsonRock breach corpus for target.com via direct API (no UI)." → §15.0.1.
"Run the full §16.14 email security audit from a Windows box (PowerShell)." → §16.14 PowerShell parallel.
"crt.sh just 502'd. What's the fallback chain?" → §27.0.1.
"Bulk IP → ASN lookup for 200 IPs without burning bgpview rate limit." → §28.1 (Cymru bulk).
"Common-prefix subdomain sweep for target.example covering vpn / api / staging / portal / intranet." → §16.24.
"Legacy mail (mail.<domain>) is NXDOMAIN today but breach corpus has employee URLs against it. What's the finding?" → §15.2 legacy-mail-decommissioned pattern.
"Confirm M365 tenancy when MX is wrapped by Mimecast (so MX doesn't reveal underlying mail platform)." → §22.1 autodiscover IP correlation + §16.22 autodiscover-as-confirmation.
"DMARC RUA points to kdmarc.com — what does that tell me?" → §16.14 DMARC reporting-vendor table.
"SharePoint HEAD probe returns HTTP 200. Does that mean anonymous access is granted?" → §22.8 (no — tenant exists, not anonymous access; distinguish).
"Wayback *.js query returned empty for a brochure-ware site. Pivot?" → §16.23 legacy-app pivot (.asp / .php / .jsp / .cfm / .aspx).
