skills.rest
blueskies1818
blueskies1818COMMUNITY
Explore all skills by this author →
WebsiteGitHub

domain-intel

Analyze domain infrastructure passively using Python stdlib.

1|Updated May 21, 2026
Search Tags:#cybersecurity#domain reconnaissance#subdomain discovery#DNS records#domain availability#WHOIS lookup#SSL certificate inspection
One-click install
npx skills add https://github.com/blueskies1818/hermesALIone --skill domain-intel-blueskies1818
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/blueskies1818/hermesALIone/tree/main/Agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/blueskies1818/hermesALIone --skill domain-intel-blueskies1818

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill automates passive domain reconnaissance, providing subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records, and domain availability checks without the need for API keys.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains using Certificate Transparency logs.
  • SSL Certificate Inspection: Check SSL certificate details like expiry, cipher, and SANs.
  • WHOIS Lookup: Retrieve domain registration information, registrar, and dates.
  • DNS Records: Get A, AAAA, MX, NS, TXT, and CNAME records.
  • Domain Availability Check: Passively check if a domain is registered.
  • Use Case: For cybersecurity analysts or domain researchers to understand the infrastructure behind a domain.

Quick Start

Run the 'domain_intel' script with the desired domain, e.g., python3 domain_intel.py subdomains example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without external API keys?▼

Passive domain reconnaissance can be performed using Python's standard library modules like socket, ssl, and urllib to gather DNS records, WHOIS data, and SSL certificates without needing external API keys.

Can I discover subdomains using Certificate Transparency logs in Python?▼

Yes, subdomain discovery uses Certificate Transparency logs accessed via Python's urllib to passively enumerate existing subdomains for a target domain.

How do I check SSL certificate details like expiry and SANs using Python stdlib?▼

SSL certificate inspection uses Python's ssl module to connect to the target and retrieve certificate details including expiry dates, cipher suites, and Subject Alternative Names (SANs).

What is the best way to retrieve DNS records like MX, TXT, and CNAME without dependencies?▼

Retrieving DNS records like A, AAAA, MX, NS, TXT, and CNAME can be achieved using Python's built-in networking capabilities, querying servers directly without third-party DNS libraries.

Does this domain reconnaissance approach work for checking domain availability?▼

Yes, domain availability checks passively query registration infrastructure using Python's socket and urllib modules to determine if a domain is currently registered.

What are the limitations of using Python stdlib for WHOIS lookups and subdomain discovery?▼

Limitations include relying on unstructured WHOIS data from direct socket connections and being restricted to subdomains found in Certificate Transparency logs rather than active scanning.

Related Skills

Explore More Software Engineering Skills→
gqf2008gqf2008

domain-intel

Identify passive domain intelligence data using Python's standard library.

Community
Intermediate
PlaidmustachePlaidmustache

domain-intel

Collect subdomains, SSL details, WHOIS data, and DNS records as structured JSON.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
phatblatphatblat
12

Recon

Automate infrastructure and network reconnaissance for domains, IPs, and netblocks.

Community
Advanced