skills.rest
Acczdy
AcczdyCOMMUNITY
Explore all skills by this author →
GitHub

conducting-external-reconnaissance-with-osint

Map an organization's external attack surface using passive OSINT techniques and structured JSON reports.

2|Updated Apr 14, 2026
Search Tags:#reconnaissance#osint#dns-records#subdomain-enumeration#shodan#github-leaks#web-technology
One-click install
npx skills add https://github.com/Acczdy/MoZiSec --skill conducting-external-reconnaissance-with-osint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-external-reconnaissance-with-osint
Source: https://github.com/Acczdy/MoZiSec/tree/main/penetration-testing/.claude/skills/conducting-external-reconnaissance-with-osint
Command: npx skills add https://github.com/Acczdy/MoZiSec --skill conducting-external-reconnaissance-with-osint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, shodan, and includes scripts (resource) and references (resource) components.

What problem does it solve?

OSINT reconnaissance is essential for mapping an organization's external footprint before engagement. This skill aggregates data from certificate transparency logs, DNS records, Shodan, breach databases, and GitHub to surface publicly exposed assets and sensitive information that could be misused or ignored.

Core Features & Use Cases

  • Passive OSINT collection across certificate transparency logs, DNS, Shodan, breach data, and code repos to build an external footprint.
  • Infrastructure and asset discovery to identify exposed services, domains, subdomains, and potential misconfigurations.
  • Use Case: Before a red team engagement, map the target's external surface to guide safe, authorized testing and risk assessment.

Quick Start

Run the External Reconnaissance OSINT agent for a target domain to enumerate subdomains, DNS records, Shodan results, email security posture, and GitHub leaks, producing a structured JSON report.

Frequently Asked Questions about conducting-external-reconnaissance-with-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map an organization's external attack surface using OSINT?▼

Passive OSINT reconnaissance maps an external attack surface by aggregating certificate transparency logs, DNS records, Shodan, and GitHub to enumerate subdomains and exposed services, producing a structured JSON footprint report.

How do I enumerate subdomains and check DNS records for a target domain?▼

Subdomain enumeration and DNS record checks use Python functions with CLI support to query certificate transparency logs and public DNS APIs, returning resolved assets and records within a structured JSON output.

Can I use Shodan and GitHub leaks to find exposed services and sensitive information?▼

Shodan queries identify exposed infrastructure and services, while GitHub leak checks scan code repositories for sensitive credentials, combining both passive results to assess publicly exposed assets during pre-engagement reconnaissance.

Does this OSINT reconnaissance approach check email security posture?▼

Yes, the OSINT reconnaissance process includes email security posture checks alongside DNS analysis and web-technology fingerprinting to evaluate the target domain's security configuration and identify potential misconfigurations.

Do I need API keys to run Shodan searches for external footprint mapping?▼

The implementation depends on the Shodan Python library and requests, requiring valid Shodan API credentials to query exposed services and infrastructure data for completing the external footprint mapping task.

What is the best way to find credential leakage and exposed assets before a red team engagement?▼

Passive OSINT reconnaissance is the best pre-engagement method, aggregating breach data, GitHub leaks, and Shodan results to surface exposed assets and credential leakage, guiding safe and authorized risk assessment.

Related Skills

Explore More Software Engineering Skills→
safzanpiranisafzanpirani
1

ai-scanner

Discover and classify public Ollama and ComfyUI instances via Shodan.

Community
Intermediate
cybersecwomancybersecwoman
5

web2-recon

Automate web2 asset, subdomain, and endpoint discovery for security assessments.

Community
Advanced
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
Muath2000Muath2000

attack-surface-analyst

Discover and monitor internet-facing assets for external attack surface management.

Community
Advanced