skills.rest
dawsonblock
dawsonblockCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform subdomain discovery, SSL, WHOIS, DNS, and availability checks using Python stdlib.

Updated Apr 26, 2026
Search Tags:#dns#ssl#osint#whois#subdomains#domain-intel
One-click install
npx skills add https://github.com/dawsonblock/HERMY --skill domain-intel-dawsonblock
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/dawsonblock/HERMY/tree/main/hermes-agent-2026.4.23/optional-skills/research/domain-intel
Command: npx skills add https://github.com/dawsonblock/HERMY --skill domain-intel-dawsonblock

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using only Python stdlib. It enables collecting subdomains, SSL certificate details, WHOIS data, DNS records, and domain availability signals without external dependencies or API keys.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookups for domain registration data
  • DNS resolution for A/AAAA/MX/NS/TXT/CNAME records
  • Domain availability signals combining DNS, SSL, and WHOIS data
  • Batch analysis across multiple domains Use Case: Security teams performing quick surface mapping for risk assessment and asset discovery with zero external services.

Quick Start

Run the domain_intel.py script for a target domain to perform subdomain discovery, DNS lookups, and WHOIS checks.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find subdomains using Certificate Transparency logs without external dependencies?▼

Subdomain discovery queries Certificate Transparency logs via crt.sh to passively find subdomains. This approach relies entirely on Python's standard library, requiring no external dependencies or API keys to enumerate a domain's attack surface.

Can I check SSL certificate details like expiry and issuer using Python stdlib?▼

Yes, SSL certificate inspection retrieves expiry dates, issuer information, and Subject Alternative Names (SANs). It performs this data gathering using only built-in Python modules without requiring specialized cryptographic libraries or external services.

What DNS records can I resolve for a target domain with this passive reconnaissance approach?▼

DNS resolution retrieves A, AAAA, MX, NS, TXT, and CNAME records for target domains. This passive reconnaissance operates using Python standard library networking modules to map domain infrastructure without sending active probe traffic.

How do I perform a bulk WHOIS lookup and domain availability check across multiple domains?▼

Bulk analysis processes multiple domains to gather WHOIS registration data and domain availability signals. It combines DNS, SSL, and WHOIS checks into JSON output, enabling batch reconnaissance for asset discovery and risk assessment.

Do I need to install third-party libraries or get API keys for OSINT domain reconnaissance?▼

No, passive domain reconnaissance requires zero external dependencies or API keys. The tooling relies exclusively on Python's standard library to perform OSINT tasks like WHOIS lookups, DNS resolution, and SSL data gathering.

Related Skills

Explore More Data & Analytics Skills→
HarriesHarries

domain-intel

Gather subdomains, SSL data, WHOIS, DNS, and availability using Python standard library.

Community
Intermediate
Devsoul2026Devsoul2026
150

domain-intel

Perform passive domain reconnaissance using Python stdlib and output JSON.

Community
Intermediate
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
afel6afel6

domain-intel

Identify subdomains, SSL details, WHOIS data, DNS records, and domain availability via passive OSINT.

Community
Advanced