skills.rest
baljinnyamday
baljinnyamdayCOMMUNITY
Explore all skills by this author →
GitHub

conducting-external-reconnaissance-with-osint

Maps an organization's external attack surface using passive OSINT techniques and public data sources.

Updated May 27, 2026
Search Tags:#penetration testing#reconnaissance#subdomain enumeration#red team#attack surface#osint#shodan
One-click install
npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill conducting-external-reconnaissance-with-osint-baljinnyamday
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: conducting-external-reconnaissance-with-osint
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/conducting-external-reconnaissance-with-osint
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill conducting-external-reconnaissance-with-osint-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security teams need to understand an organization's internet-facing footprint before active testing begins, but manually correlating subdomains, exposed services, leaked credentials, and employee data across dozens of public sources is slow and error-prone. This Skill provides a structured, passive reconnaissance workflow that gathers intelligence without touching target systems. ## Core Features & Use Cases - Domain and DNS Enumeration: Combines Amass, subfinder, and certificate transparency logs to discover subdomains, DNS records, and misconfigured zone transfers. - Infrastructure and Leak Discovery: Uses Shodan, Censys, cloud storage enumeration, GitHub secret scanning, and breach databases to find exposed services and credentials. - Personnel and Technology Profiling: Harvests email formats, org charts, and technology stacks from LinkedIn, job postings, and web fingerprinting tools. - Use Case: Before a red team engagement against a SaaS company, run this workflow to enumerate 147 subdomains, find an unauthenticated Elasticsearch instance via Shodan, and discover AWS keys in a public GitHub repo, then compile everything into a reconnaissance report. ## Quick Start Conduct passive OSINT reconnaissance against the authorized target domain techcorp.io and produce a structured external reconnaissance report.

Frequently Asked Questions about conducting-external-reconnaissance-with-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains for a target domain?▼

Subdomain enumeration combines multiple passive tools for coverage: run amass enum -passive, subfinder, and query crt.sh certificate transparency logs, then merge, deduplicate, and resolve results to IP addresses mapped to ASN and hosting providers.

What tools are used for OSINT reconnaissance?▼

The workflow uses Amass and subfinder for subdomains, Shodan and Censys for internet-facing services, theHarvester for emails, SpiderFoot and Recon-ng for automated collection, and trufflehog or gitleaks for scanning public code repositories for secrets.

Does passive OSINT reconnaissance interact with target systems?▼

Passive reconnaissance gathers data only from public sources like search engines, certificate logs, and scanning databases, leaving no footprint in target logs. Active techniques such as port scanning and zone transfer attempts are separate and may be detected.

How do I find leaked credentials for a company domain?▼

Check the Have I Been Pwned API for breached emails, search GitHub with queries like org:target "api_key" using trufflehog or gitleaks, review paste sites, and extract metadata from public documents with exiftool to reveal usernames and internal paths.

When should I not use OSINT reconnaissance techniques?▼

Do not use OSINT gathering for stalking, harassment, or unauthorized surveillance of individuals. Collection must occur within a written authorized engagement scope and comply with privacy laws such as GDPR and CCPA.

Related Skills

Explore More Software Engineering Skills→
markwang2658markwang2658
31

web-pentest

Automate authorized web-application penetration testing from reconnaissance to reporting.

Community
Advanced
AndyAnh174AndyAnh174

Windows Privilege Escalation

Enumerate Windows systems and exploit privilege escalation vulnerabilities.

Community
Advanced
starwreckntxstarwreckntx

Vulnerability Management Agent

Track vulnerabilities across assets using CVE/CVSS standards and CVSS scoring.

Community
Basic
crazyMarkycrazyMarky
277

recon-port-scan

Scan TCP and UDP ports and identify services with nmap, masscan, or rustscan.

Community
Intermediate