offensive-osint

Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.

跳到安装

仓库: Zyrexnn/Cybermes
最近来源活动: 2026年8月19日 13:32
检测到的 SKILL.md 语言: 英语
星标: 655
分支: 114

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/Zyrexnn/Cybermes --skill offensive-osint

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

22 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

autonomous-godmode-hunter

Autonomous end-to-end security research and full-surface bug hunting engine. Executes non-stop reconnaissance, attack-surface discovery, parameter mining, multi-stage vulnerability verification, minimal-impact PoC generation, and structured reporting on authorized targets.

2026-08-24

reporting

Generates standardized, professional Bug Bounty vulnerability reports in markdown format following HackerOne and Bugcrowd standards.

2026-08-24

engagement-deliverables-and-validation

Workspace conventions for authorized security-engagement deliverables — canonical report location (/workspace/reports/<target>/), plain files not zip, follow-the-existing-format rule, report-aggregator overwrite trap, bypass-before-clear validation gate for negative claims, and Cloudflare UA pitfalls in PoC reproduction. Use at report-writing time or before declaring any control "secure".

2026-08-24

查看这个仓库的全部 Skills

name	offensive-osint
description	Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
version	3.0.0
triggers	["external recon","external red team","red team external","attack surface management","ASM","bug bounty recon","bug bounty","reconnaissance","footprinting","asset discovery","swagger discovery","openapi discovery","graphql introspection","graphql discovery","subdomain enumeration","subdomain takeover","cloud bucket enumeration","bucket enum","S3 enum","GCS enum","Azure blob enum","identity fabric","SSO discovery","IdP fingerprinting","tenant fingerprinting","okta enum","entra enum","azure AD enum","ADFS enum","SAML metadata","mobile recon","APK analysis","mobile attack surface","secret scanning","secret leak","leaked credential","github dorking","google dorking","bing dorking","DDG dorking","postman workspace","stack exchange OSINT","breach lookup","have I been pwned","HudsonRock cavalier","infostealer","dehashed","intelx","shodan recon","censys recon","certificate transparency","crt.sh","JARM","favicon mmh3","JS endpoint extraction","sourcemap leak","copy paste probes","curl one-liner","email security analysis","SPF DMARC DKIM","origin discovery","CDN bypass","WAF bypass","vendor product fingerprints","Citrix Netscaler","F5 BIG-IP","Pulse Secure","FortiGate","PaloAlto GlobalProtect","Cisco AnyConnect","VMware vCenter","cloud native fingerprint","Lambda function URL","Cloud Run","kubernetes exposure","kubelet","etcd","CI CD exposure","Jenkins recon","GitLab self-hosted","GitHub Actions secrets","documentation leak","Notion public","Confluence anonymous","Trello board","WHOIS RDAP","DNS record catalog","Wayback CDX","LinkedIn enumeration","job posting tech stack","Slack workspace discovery","Discord server discovery","npm token leak","PyPI token leak","Docker Hub leak","sat imagery physical recon","TLS deep audit","JA3 JA4","reverse DNS sweep","IPv6 enumeration","CVE prioritization","EPSS scoring","CISA KEV","vulnerability prioritization","tooling install","sector specific recon","healthcare DICOM","finance SWIFT","ICS SCADA","Modbus","BACnet","post discovery workflow","JWT triage","AWS key triage","GraphQL field suggestion","Anthropic API key","OpenAI API key","Microsoft 365 deep","Teams federation","SharePoint enum","OneDrive enum","hackerone reference","h1 hacktivity","disclosed reports","community bug reports","prior disclosures","bug bounty reference"]

File	Coverage	Trigger phrases
`probes-and-wordlists.md`	API/Swagger/GraphQL paths, cloud-bucket arsenal, JS guess-paths, vendor & cloud-native fingerprints, K8s/CI-CD exposure, doc/wiki leaks, WHOIS/RDAP, DNS catalog, Wayback CDX, copy-paste curl probes, email security analysis, origin/CDN bypass	swagger discovery, graphql introspection, subdomain takeover, cloud bucket enum, S3/GCS/Azure enum, kubernetes exposure, CI CD exposure, vendor fingerprint, WHOIS RDAP, Wayback CDX, copy paste probes, curl one-liner
`identity-fabric.md`	Concrete endpoints for Entra/Okta/ADFS/Google/SAML, M365 deep (Teams federation, SharePoint, OneDrive), GraphQL field-suggestion enumeration, user-enum patterns	identity fabric, SSO discovery, IdP fingerprinting, okta enum, entra enum, azure AD enum, ADFS enum, SAML metadata, Microsoft 365 deep, Teams federation, SharePoint enum, OneDrive enum, graphql field suggestion
`secret-patterns.md`	48-pattern secret-regex catalog (AWS, GCP, GitHub PATs, Stripe, Slack, JWT, private keys, Anthropic/OpenAI/HuggingFace, Cloudflare, DigitalOcean, npm, PyPI, Docker Hub, Atlassian, DataDog, Sentry, ngrok) with severity & FP notes	secret scanning, secret leak, leaked credential, JWT triage, AWS key triage, Anthropic API key, OpenAI API key
`secret-validators.md`	9 read-only secret validators + post-discovery enumeration workflows for AWS/GitHub/Slack/Postman/JWT/Anthropic/OpenAI/npm/Atlassian/DataDog	secret validation, post discovery workflow, AWS key triage, JWT triage
`dork-corpus.md`	80+ Google/Bing/DDG dork templates across 9 categories + 13 GitHub code-search dorks tailored for targets	google dorking, bing dorking, github dorking, dork corpus
`recon-stack.md`	Subdomain-source stack (passive & active), infrastructure & attack-surface OSINT (Shodan/Censys/crt.sh/JARM/favicon mmh3), TLS deep audit, reverse DNS, IPv6 enumeration	subdomain enumeration, certificate transparency, crt.sh, shodan recon, censys recon, JARM, favicon mmh3, TLS deep audit, JA3 JA4, reverse DNS sweep, IPv6 enumeration
`breach-and-credentials.md`	Breach & leak data sources (HudsonRock, HIBP, DeHashed, IntelX, infostealer logs), email-pattern inference, email-harvest source stack	breach lookup, have I been pwned, HudsonRock cavalier, infostealer, dehashed, intelx, email harvest
`people-osint.md`

Signal	Points	Conditions
Unauth write	+40	POST/PUT/DELETE/PATCH endpoint returns 200/201/202/204 anonymously.
Open GraphQL introspection	+35	`__schema` query returns full type list anonymously.
Verb tampering bypass	+30	OPTIONS reveals method not documented; that method is accessible.
Reflected CORS + credentials	+25	`Access-Control-Allow-Origin` reflects request `Origin` AND `Access-Control-Allow-Credentials: true`.
Sensitive keyword in path	+20	Path matches one of: `admin`, `internal`, `debug`, `user`, `password`, `token`, `key`, `export`, `upload`, `backup`, `config`, `secret`, `private`, `delete`, `purge`, `wipe`.
Schema leak in error	+20	Response body contains stack trace, ORM error class, framework signature (e.g., `ActiveRecord::RecordNotFound`, `org.hibernate.exception.*`, `django.db.utils.IntegrityError`).
API key in URL	+15	Path or query string contains `api_key=`, `apikey=`, `token=`, `access_token=`.
Wildcard CORS	+10	`Access-Control-Allow-Origin: *`.
Missing rate-limit headers	+10	No `RateLimit-` / `X-RateLimit-` headers; no `Retry-After` after rapid requests.

Score	Severity
≥ 90	CRITICAL
70–89	HIGH
50–69	MEDIUM
25–49	LOW
< 25	INFO

Signal	Points
Package reverse-DNS matches target domain (e.g., `com.acme.android` ⟂ `acme.com`)	+40
Developer email is `<anything>@<target-domain>`	+25
Developer website URL is the target domain (or a confirmed sibling brand domain)	+20
App name contains a brand keyword from operator-supplied brand list	+10
App has ≥ minimum review-score threshold (default 20 reviews)	+5

Trigger	Attack-path hint
Unauth POST / PUT / DELETE	"Unauthenticated {method} {path} — try IDOR + privilege escalation; check whether numeric IDs are sequential or guessable."
Open GraphQL introspection	"Open GraphQL introspection on {path} — enumerate mutations, look for `createUser`, `setRole`, `transferFunds`-shaped names; pivot to broken-auth or business-logic flaws."
Reflected CORS + creds	"Reflected CORS with credentials on {path} — host CSRF page on attacker-controlled origin; victim's browser will leak {sensitive-data-hint}."
Wildcard CORS + sensitive	"Wildcard CORS on {path} returning user-tied data without creds — exfiltrate via cross-origin fetch from any page victim visits."
Verb tampering	"Verb tampering: {hidden-method} allowed on documented-{visible-method}-only endpoint → likely missing-method-check authz bug; try {hidden-method} {path} with valid auth."
API key in URL	"API key in URL: `?{param}=...` — token leaks to access logs, browser history, Referer headers, third-party CDNs. Check Wayback / Google for cached copies."
Schema leak in error	"Schema leak in error response — framework signature `{framework}` exposed; map to known {framework} vulns and craft targeted payloads."
Sensitive keyword	"Path contains '{keyword}' — review for direct object reference, mass-assignment, or hidden admin functionality."
Open RTDB Firebase	"Open Firebase RTDB at https://{project}.firebaseio.com/.json — read everything, then test write at `/<random-key>.json` with PUT to gauge ACL scope."
Listable cloud bucket	"Listable {provider} bucket `{bucket}` — recursive object listing + content-type analysis; look for backups, logs, customer data, AWS keys in JSON configs."
.git exposed	"Exposed .git/config on {host} — reconstruct repository with git-dumper or githacker; full source history."
.env exposed	"Exposed .env on {host} — grep for `_KEY`, `_SECRET`, `_TOKEN`, ; validate all credentials read-only via §23 validators."

offensive-osint

安装方式

检查来源文件

Offensive OSINT — External Red-Team Arsenal

0. When to use / When NOT

1. Authorization & Legal Posture

2. Confidence Levels

3. Output Format Conventions

4. Source Hygiene & Citations

5. Do NOT

6. General OSINT (curated tool refs)

How to use this skill

References Index

20. Endpoint Interest Score — 0–100 rubric

21. Mobile App Ownership Confidence — 0–100 rubric

39. Attack-Path Hint Patterns

49. Skill Self-Test

50. Changelog

Related Skills & Chains

offensive-osint

来源信息

安装方式

检查来源文件

同仓库更多 Skills

Offensive OSINT — External Red-Team Arsenal

0. When to use / When NOT

1. Authorization & Legal Posture

2. Confidence Levels

3. Output Format Conventions

4. Source Hygiene & Citations

5. Do NOT

6. General OSINT (curated tool refs)

How to use this skill

References Index

20. Endpoint Interest Score — 0–100 rubric

21. Mobile App Ownership Confidence — 0–100 rubric

39. Attack-Path Hint Patterns

49. Skill Self-Test

50. Changelog

Related Skills & Chains

同仓库更多 Skills