Companion skill: osint-methodology (the "how to think" skill). This skill is the "what to reach for." Use them together.
0. When to use / When NOT
Use this skill when:
You need concrete probe paths, wordlists, regexes, payloads, scoring rules, or tool URLs.
You're executing reconnaissance and need the actual technical reference (vs. methodology).
You're building a recon automation and need specific lists to seed it.
Do NOT use this skill when:
The user is asking for active exploitation, post-exploitation, or anything past reconnaissance.
The user is asking for defensive / blue-team detections.
The target's authorization isn't established — see §1.
1. Authorization & Legal Posture
For assets the operator owns or has written authorization to assess. Soft scope check before acting against an unverified third-party target — see methodology skill §1 for the full posture.
2. Confidence Levels
TENTATIVE — plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).
CONFIRMED — verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).
3. Output Format Conventions
Findings should carry: id, module, asset_key, category, severity (info/low/medium/high/critical), confidence, title, description, evidence (url + UTC timestamp + sha256 + raw ≤ 2 KiB), references, remediation. UTC timestamps everywhere.
4. Source Hygiene & Citations
URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.
5. Do NOT
Don't paste creds/PII/session tokens into cloud LLMs.
Don't run destructive probes outside DEEP/--aggressive.
Don't use validated credentials for anything except read-only liveness check.
Given a (first_name, last_name, domain), generate these 8 candidate addresses for breach pre-hits, phishing list curation, and downstream enrichment. Mark as TENTATIVE confidence until corroborated.
Lowercase before lookup. Strip diacritics for ASCII fallback. If the org uses a known pattern (e.g., Hunter.io shows {first}.{last} is dominant), prioritize that one and mark FIRM.
12. Email-Harvest Source Stack
Six parallel sources, dedup at the end:
IntelX phonebook API — 2-step search + poll. Largest single source for breach-era addresses.
GSXT — gsxt.gov.cn National Enterprise Credit Info; cross-check with Tianyancha / Qichacha.
USCC (Unified Social Credit Code) — 18-character entity ID assigned to all CN legal entities. Format: <region:6><authority:2><type:1><serial:9>. Useful for joining GSXT records to ICP filings.
ICP Beian — beian.miit.gov.cn — every domain serving traffic in mainland CN must register an ICP filing; the filing links the domain to a USCC, which links to the legal entity in GSXT.
Subdomain hostnames in data.*_urls[] past the first few are redacted with asterisks (*****.target.com). Pivot to paid Cavalier tier or other sources for unredacted.
Free endpoint returns counts + sample URLs only. Cleartext passwords + emails are never in the free response.
Rate limit ~1 req/sec/IP; 429 on burst. Sleep 1s between calls.
For unredacted creds + bulk enumeration → paid Cavalier portal.
Severity mapping (per §15.1 + §15.2):employees ≥ 10 → CRITICAL, regardless of whether the breached service is still online (legacy Lotus Domino / on-prem mail decommissioned + cloud SSO migration → employees almost always reuse passwords → SSO_EXPOSURE escalates CRITICAL).
15.1 Domain-Level Breach Severity Mapping
When you query a breach corpus by domain, map the result to severity like so:
Stat
Severity
≥ 10 employees compromised
CRITICAL
1–9 employees compromised
HIGH
≥ 1 end-user (non-employee) compromised
MEDIUM
Domain seen in breach with 0 named accounts
INFO
Employees vs end-users distinction: an employee account is <anything>@<target-domain> (the breach victim is the target's own staff). An end-user account is the target's customer who reused a password — useful for credential-stuffing risk awareness but not directly compromising the target's identity fabric.
15.2 SSO_EXPOSURE finding
When a discovered SSO tenant (Entra GUID / Okta slug / Google Workspace domain) intersects with the breach corpus on its domain → SSO_EXPOSURE finding, severity CRITICAL. Evidence: tenant ID + product + employee count + per-account source attribution.
If mail.<domain> / webmail.<domain> returns NXDOMAIN today but HudsonRock/HIBP corpus still has historical employee credentials against it AND autodiscover.<domain> resolves to Microsoft IPs (M365) or aspmx.l.google.com MX (Workspace), the org migrated from on-prem to cloud — and the stolen passwords almost certainly survived the migration via password reuse. Escalate to CRITICAL SSO_EXPOSURE even when the legacy host is dead.
Concrete triggers (all three together):
Resolve-DnsName mail.<domain> -Type A → NXDOMAIN (legacy gone)
HudsonRock corpus has employee URLs against the old host (e.g. mail.<domain>/names.nsf for Lotus Domino, mail.<domain>/owa/ for Exchange, mail.<domain>/iwaredir.nsf for iNotes, mail.<domain>/zimbra/ for Zimbra)
Current MX → M365 / Google Workspace / Zoho cloud (DNS confirms migration)
Evidence pack: tenant GUID + breach count + 3+ legacy URLs from corpus + autodiscover Microsoft IPs + current MX. Recommend forced password rotation + MFA audit + Conditional Access review.
16. Pre-built Wordlists & Probe Paths
Copy-pasteable arsenals, severity-annotated where relevant.
16.1 Swagger / OpenAPI discovery — 28 paths
Probe each path on every alive webapp. GET (or HEAD if rate-limited).
{
"operationName": "IntrospectionQuery",
"query": "query IntrospectionQuery { __schema { types { name kind fields { name type { name kind } } } queryType { name } mutationType { name } subscriptionType { name } } }"
}
Severity:
Introspection returns schema without auth → HIGHOPEN_GRAPHQL_API.
Field-suggestion enumeration possible (server returns "did you mean" for typo'd field names) → MEDIUM (re-derive partial schema even when introspection is disabled).
/graphql accepts batched queries ([...] request body) → MEDIUM (rate-limit bypass surface; auth bypass via mixed batches).
UI markers (lower severity but still discoverable):
HTML response contains graphiql, playground, apollo studio, altair → GraphiQL UI exposed (often shipped accidentally on prod).
16.3 High-risk ports — 35 services
For each open port, emit a finding with the severity and "why an attacker cares" below. Source for the open-port observation: Shodan InternetDB (free, 1 req/sec) is the recommended starting point.
Port
Service
Severity
Why it matters
21
FTP
HIGH
Anonymous read often enabled; cleartext creds.
22
SSH
LOW
Banner discloses version; brute-force surface.
23
Telnet
HIGH
Cleartext protocol; should never be exposed.
25
SMTP
LOW
Open relay risk; version banner.
53
DNS
LOW
Recursion = DDoS amplifier; AXFR opportunism.
80
HTTP
INFO
Standard.
110
POP3
LOW
Cleartext if no STARTTLS.
111
rpcbind
MEDIUM
NFS exports enumeration.
135
MS RPC
HIGH
Enum via Impacket.
139
NetBIOS-SSN
HIGH
File/printer enum.
143
IMAP
LOW
Cleartext if no STARTTLS.
161
SNMP
HIGH
Community strings often public/private; full device enum.
389
LDAP
HIGH
Anonymous bind = full directory dump.
443
HTTPS
INFO
Standard.
445
SMB
CRITICAL
EternalBlue, SMB relay, anonymous shares.
465
SMTPS
LOW
Banner.
514
rsyslog
MEDIUM
Log injection / DoS.
587
SMTP-MSA
LOW
Banner.
631
IPP/CUPS
MEDIUM
Print server enum / RCE in old CUPS.
873
rsync
HIGH
Modules often listable; backup data exposure.
1433
MSSQL
HIGH
Brute-force; xp_cmdshell.
1521
Oracle TNS
HIGH
Brute-force; SID enum.
2049
NFS
HIGH
World-readable exports.
2375
Docker API (unencrypted)
CRITICAL
Unauthenticated container/host takeover.
2376
Docker API (TLS)
HIGH
Cert validation bypass risk.
3000
Common dev / Grafana
MEDIUM
Often Grafana / Express dev with default creds.
3306
MySQL
HIGH
Brute-force; default root:"".
3389
RDP
CRITICAL
BlueKeep / DejaBlue / NLA bypass.
5432
PostgreSQL
HIGH
Brute-force; default postgres:postgres.
5601
Kibana
HIGH
Often unauthenticated; Elasticsearch pivot.
5900
VNC
HIGH
Often unauthenticated or weak password.
5984
CouchDB
HIGH
Default no auth; admin party.
6379
Redis
CRITICAL
No auth default; write authorized_keys for SSH.
7001
WebLogic
HIGH
Frequent CVEs (CVE-2020-14882, etc.).
8000
Common dev
MEDIUM
Django, common dev servers.
8080
HTTP-alt
MEDIUM
Tomcat, Jenkins, common proxy.
8443
HTTPS-alt
MEDIUM
Same as 8080.
8888
Common dev / Jupyter
HIGH
Jupyter often exposes interactive shell.
9090
Cockpit / Prometheus
HIGH
Server admin UI / metrics scraping.
9200
Elasticsearch
CRITICAL
Typically no auth.
9300
Elasticsearch transport
HIGH
Cluster join + RCE.
11211
memcached
MEDIUM
UDP DDoS amp; data dump.
27017
MongoDB
CRITICAL
No auth by default.
50070
Hadoop NameNode
HIGH
HDFS browse.
When Shodan InternetDB returns vulns[] for a port, escalate the finding severity by one tier and include the CVE list in evidence.
16.4 Missing security headers — 6 findings
For every alive webapp, audit response headers. Each missing header below = one finding.
Probe technique: HEAD first → 200/301 = exists, 403 = exists private, 404 = skip. On exists, GET root → if XML/JSON object listing returns, CRITICALPUBLIC_CLOUD_BUCKET. Direct-URL object reads but not listable → HIGHPUBLIC_CLOUD_BUCKET_OBJECT_READ.
16.9 JS guess-paths for endpoint discovery
Probe these paths on every alive webapp (in addition to scraped <script src=...>):
Each match → MEDIUM INFO_DISCLOSURE. Aggregate per host: if many matches share the same internal subdomain, that's a recon seed for any future internal phase.
Whatever you were looking for doesn't currently exist.
WordPress
*.wordpress.com
Do you want to register *.wordpress.com?
Fastly
various
Fastly-specific 404
Pantheon
*.pantheonsite.io
The gods are wise, but do not know of the site...
Surge.sh
*.surge.sh
project not found
Bitbucket Pages
*.bitbucket.io
Repository not found
Tilda
*.tilda.ws
Please renew your subscription
Strikingly
*.s.strikinglydns.com
PAGE NOT FOUND
Smartling
*.smartling.com
Domain is not configured
Ngrok
*.ngrok.io
Tunnel not found
Webflow
*.webflow.io
Site not found
Zendesk
*.zendesk.com
Help Center Closed
Cargo
*.cargocollective.com
404 Not Found (with cargo branding)
Statuspage
*.statuspage.io
Not found
Intercom
*.intercom.help
Not found
Helpjuice
*.helpjuice.com
Not found
Helpscout
*.helpscoutdocs.com
Not found
Tictail
*.tictail.com
Not found
Brightcove
*.brightcovegallery.com
Not found
Smugmug
various
Not found
For full per-provider detection signatures + edge cases, use SubdomainX or Subzy/Subjack against a freshly-fetched fingerprint database.
16.13 Copy-Paste Probes (curl one-liners)
Every probe path in §16.1–16.12 with a runnable curl. Defaults: -sk (silent + ignore TLS errors), -m 10 (10s max), -o /tmp/r (response body to disk), -w '%{http_code}\n' (print status code), -A "Mozilla/5.0" (UA — change per persona).
p=none → spoof-feasible, downgrade trust → MEDIUM finding.
p=quarantine pct<100 → partial enforcement → LOW.
p=reject + aspf=s + adkim=s → well-postured → no finding.
DKIM key discovery:
DKIM selectors aren't well-known; common patterns:
for selector in default google selector1 selector2 mail email k1 dkim s1 s2 mta1 mta2 \
amazonses 20240101 20230101 mailchimp sendgrid mxvault; do
echo "=== ${selector} ==="
dig +short TXT "${selector}._domainkey.${D}"
done
If a key returns: extract p=<base64> and check key length. RSA-1024 → MEDIUM (deprecated; should be 2048+). Missing or rotated infrequently → LOW finding.
BIMI (Brand Indicators for Message Identification):
dig +short TXT "default._bimi.${D}"
If present + p=reject DMARC → brand-impersonation defense in inbox UI. Absence is LOW only (operational, not exploitable).
MTA-STS (Mail Transfer Agent Strict Transport Security):
If the target is behind Cloudflare/Akamai/Fastly/CloudFront, their CDN IPs are well-defined. Find IPs not in those ranges that serve the same site = origin.
Cloudflare IPv4 ranges:
https://www.cloudflare.com/ips-v4
Akamai ASNs: AS16625, AS20940, AS21342, AS21357.
Fastly: AS54113.
AWS CloudFront: published in https://ip-ranges.amazonaws.com/ip-ranges.json filter service:CLOUDFRONT.
Filter the result: any historical A record IP not in current CDN ranges = origin candidate.
Origin via certificate SAN pivot (Censys):
# Censys (free 250 queries/month with key)
censys search "services.tls.certificates.leaf_data.subject.common_name:${D} AND NOT services.tls.certificates.leaf_data.issuer.common_name:'Cloudflare'"
If small/no diff → confirmed origin. Document with detectability=low.
Origin via auxiliary subdomains (often skip CDN):
for sub in mail smtp ftp sftp cpanel webmail direct origin direct-connect noproxy \
dev staging stg uat preprod sandbox preview origin-www old-www legacy \
server srv host1 host2 vps server1; do
echo "=== ${sub}.${D} ==="
dig +short A "${sub}.${D}"
done | grep -vE '^(===|$)' | sort -u
Cross-reference any returned IP against CDN ranges.
Origin via email-header bounce:
Send mail to <random>@${D} from a sock-puppet account. The bounce often includes Received: headers showing the inbound mail server's actual IP — sometimes co-located with web origin.
Origin via misconfigured CDN error pages:
Some CDN 5xx error pages historically leaked upstream details. Trigger errors and inspect:
This finds adjacent corporate assets (subsidiary domains, brand variations, employee personal projects on corp email).
16.22 DNS Record Catalog (TXT verification tokens, MX→IdP)
For every target domain, dump all common record types:
D="target.example"
for rtype in A AAAA MX TXT NS SOA CAA SRV CNAME PTR; do
echo "=== ${rtype} ==="
dig +short "${D}" "${rtype}"
done
TXT record verification token catalog (each token reveals a SaaS tenancy):
TXT pattern
SaaS / service
Implication
google-site-verification=<token>
Google Workspace / Search Console / Analytics
Google tenancy.
MS=ms<digits>
Microsoft 365 (older)
M365 tenancy.
apple-domain-verification=<token>
Apple Business Manager / iCloud Calendar
Apple ecosystem.
atlassian-domain-verification=<token>
Atlassian Cloud (Jira/Confluence/etc.)
Atlassian customer.
facebook-domain-verification=<token>
Facebook Business / Pixel
FB Business.
adobe-idp-site-verification=<token>
Adobe Sign / Creative Cloud
Adobe customer.
docusign=<token>
DocuSign
DocuSign customer.
dropbox-domain-verification=<token>
Dropbox Business
Dropbox customer.
box-verification=<token>
Box
Box customer.
webexdomainverification.<id>
Webex
Cisco Webex.
zoom_verify_<id>
Zoom
Zoom customer (admin domain).
notion=<token> (rare)
Notion workspace
Notion enterprise.
slack-domain-verification=<token>
Slack Enterprise Grid
Slack EG.
asana-domain-verification=<token>
Asana Enterprise
Asana customer.
mongodb-site-verification=<token>
MongoDB Atlas
DB tenant.
_dnsauth.<token>
Many ACME / Let's Encrypt CAs
DNS-01 challenge in progress.
pinterest-site-verification=<token>
Pinterest Business
Marketing surface.
cisco-ci-domain-verification=<token>
Cisco Spark / Webex
Cisco.
_globalsign-domain-verification=<token>
GlobalSign cert authority
Cert provider.
mailru-verification:<token>
Mail.ru
RU presence.
yandex-verification:<token>
Yandex services
RU presence.
zscaler-verification-<id>-<date>-<random>
Zscaler (ZIA / ZPA / ZDX)
Web SSE / SASE customer; the date suffix is the verification-issued date.
cloudflare-verify=<token>
Cloudflare (Zero Trust / Access / WARP)
Cloudflare org-tier customer.
autosect-site-verification=<token>
AutoSect (security tooling)
Security vendor on tenant.
cisco-site-verification=<token>
Cisco (various products)
Cisco vendor.
mscid=<token>
Microsoft (newer M365 verification)
M365 tenancy (newer format).
_amazonses=<token>
AWS SES sender verification
SES sender.
salesforce-domain-verification=<token>
Salesforce
SF customer.
workday-domain-verification=<token>
Workday
Workday customer (HR + Finance).
shopify-domain-verification=<token>
Shopify
E-commerce customer.
klaviyo-domain-verification=<token>
Klaviyo
Marketing automation.
mailchimp-domain-verification=<token>
Mailchimp
Marketing email.
hubspot-domain-verification=<token>
HubSpot
CRM / marketing.
zendesk-verification=<token>
Zendesk
Support tenancy (also see §43).
freshworks-verification=<token>
Freshworks
Support / CRM customer.
intercom-verification=<token>
Intercom
Messaging tenancy.
loom-site-verification=<token>
Loom
Video.
miro-site-verification=<token>
Miro
Whiteboard tenancy.
gitlab-domain-verification=<token>
GitLab
Self-hosted or cloud verification.
Each discovered tenancy is a separate attack surface (own credentials, own MFA posture, own data).
Autodiscover-as-confirmation pattern:
autodiscover.<domain> resolving to Microsoft IP space (40.96.0.0/13, 52.96.0.0/14, 13.107.0.0/16) is definitive proof of M365 Exchange Online tenancy — even when MX records are obscured by Mimecast/Proofpoint/Barracuda inbound filtering. Probe:
Resolve-DnsName "autodiscover.$D" -Type A | Select Name,IPAddress
If IPs are in Microsoft ranges → M365_CONFIRMED. Cross-reference with getuserrealm.srf (§22.1) for tenant GUID extraction.
CAA records:
dig +short CAA "${D}"
Lists which CAs are allowed to issue certs. Absence = LOW finding (any CA can mis-issue). Presence + restrictive list = good posture.
SOA serial pattern analysis:
dig +short SOA "${D}"
Serial format YYYYMMDDNN reveals last-edit date. Pattern across multiple zones can correlate ownership.
For each, fetch the archived JS and run the secret catalog (§17). Old JS often had hard-coded keys later removed.
Legacy-app pivot (when *.js returns empty):
Static brochure-ware sites (older corporate sites, especially pre-2015) often have zero archived JS because the frontend was server-rendered. Pivot to legacy file extensions:
# ASP / ASP.NET classic
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.asp&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=500"
# PHP
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.php&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=500"
# JSP / .NET aspx / CGI / Coldfusion
for ext in aspx jsp cgi cfm; do
echo "=== .$ext ==="
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=200"
done
# JSON / XML config (sometimes leaks endpoints + creds)
for ext in json xml yml yaml ini conf; do
echo "=== .$ext ==="
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=100"
done
# Anything indexed (broad sweep — useful for legacy enumeration)
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=10000"
Legacy .asp / .cfm / .jsp URLs often reveal: forgotten admin panels, old user-enum endpoints, legacy auth flows, SQL-injection-prone parameters. Cross-reference with current DNS — many legacy hosts now NXDOMAIN but the URL paths sometimes survive on a renamed host.
Empirically: passive cert-transparency enumeration (crt.sh / VirusTotal / Subfinder) misses 20–40% of high-value subdomains because (a) many internal hosts use wildcard certs that don't expose the FQDN, (b) some hosts have never been issued public certs (HTTP-only or self-signed), (c) very-recently-provisioned hosts haven't propagated to CT log mirrors yet.
Always pair passive enum with an active prefix-probe. Detectability: low (single A-record query per host; no port scan, no HTTP).
The high-yield prefix list (ordered by hit-rate from real engagements):
D="target.example"
for p in www mail webmail owa autodiscover ftp vpn sslvpn gateway api app portal login sso idp iam identity accounts oauth auth adfs admin intranet hr sap erp crm support help status grafana kibana docs wiki jira jenkins gitlab dev test staging stg qa uat sandbox preprod preview careers jobs eapps old legacy beta tender suppliers procurement; do
IP=$(dig +short A "$p.$D" | head -1)
[ -n "$IP" ] && echo "$p.$D -> $IP"
done
Mass DNS approach (faster for large prefix lists):
# Generate candidate FQDNs from a wordlist; resolve in parallel via puredns
puredns resolve <(awk -v d="$D" '{print $1"."d}' assetnote-best-dns-wordlist.txt) -r resolvers.txt
What to extract from each hit:
IP / IP block → ASN lookup (§28.1) → confirms target-owned vs hosted-elsewhere.
For vpn.* / gateway.* / gp.* / globalprotect.* / citrix.* → flag for active vendor fingerprint (§16.16) under separate engagement scope.
For api.* / app.* → seed for §16.1–16.10 webapp probes.
For staging.* / dev.* / uat.* → seed for §16.5 always-on HTTP checks (often weaker auth + debug endpoints).
For intranet.* / eapps.* / sclepro.* → public-intranet finding (often MEDIUM; per §40).
Real-engagement validation: in an internal smoke test, prefix-sweep found vpn., api., intranet., staging., support., eapps., sclepro., autodiscover. — all of which crt.sh missed (or returned 502 for). Treat passive + active as complementary, not alternatives.
17. Secret-Pattern Catalog — 80 patterns (29 base + 19 modern + 32 provider expansion)
The catalog runs against any text source: GitHub code, Postman workspaces, JS bodies, sourcesContent blobs, mobile-app strings, Wayback HTML, paste sites, Stack Exchange code blocks. Order matters: most-specific patterns first so generic catches don't pre-empt typed ones.
Provider expansion (v2.2, #49–80). Row 49 (Postman PMAK) is grounded directly in the reference implementation's modules/secrets_beyond_github.py::_RE_PMAK — a real gap, since §23.1 already documents the PMAK validator but the catalog never had the detection regex. Rows 50–80 add well-known, distinctive-prefix or context-anchored token formats for providers not covered by rows 1–48, in the same reliability bar: standalone only where the vendor's own prefix is distinctive enough to not collide (glpat-, sq0atp-, shpat_, dapi, .atlasv1., GOCSPX-, ya29., EAA, rubygems_, AKCp, SSWS , xapp-1-, sl., dp.pt., hvs., AAAA…:), context-anchored (mirroring the §17 #35 Cloudflare approach) everywhere the vendor's own token has no fixed shape (PagerDuty, Asana, Fastly, Algolia, Segment, legacy Airtable key, Azure/Entra client secret, Okta generic token).
