skills.rest
Devsoul2026
Devsoul2026COMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance using Python stdlib and output JSON.

150|25|Updated Apr 20, 2026
Search Tags:#json#dns#ssl#osint#whois#domain-intelligence
One-click install
npx skills add https://github.com/Devsoul2026/Hermes-One-Click --skill domain-intel-devsoul2026
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Devsoul2026/Hermes-One-Click/tree/main/hermes-agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Devsoul2026/Hermes-One-Click --skill domain-intel-devsoul2026

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance using Python stdlib to discover subdomains, inspect SSL certificates, WHOIS lookups, DNS records, and domain availability, all without external API keys.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs
  • SSL certificate inspection (expiry, issuer, SANs)
  • WHOIS lookups and basic domain metadata
  • DNS records resolution (A, AAAA, MX, NS, TXT, CNAME)
  • Bulk domain analysis with JSON output

Quick Start

Run python3 domain_intel.py subdomains example.com to begin gathering subdomains via certificate transparency logs.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I gather subdomains and DNS records using Python without external API keys?▼

Passive domain reconnaissance uses Python stdlib to discover subdomains via Certificate Transparency logs, fetch DNS records, and inspect SSL certificates without requiring external API keys or dependencies.

Can I check SSL certificate expiry and issuer details for multiple domains in bulk?▼

Bulk domain analysis supports inspecting SSL certificates for expiry dates, issuer information, and Subject Alternative Names across multiple domains simultaneously, outputting all results as structured JSON.

What is the best way to perform passive WHOIS lookups and domain availability checks?▼

Passive WHOIS lookups and domain availability checks are performed using standard Python libraries, gathering basic domain metadata and registration status without sending active probes to the target server.

Does domain reconnaissance work with only the Python standard library installed?▼

Domain reconnaissance operates entirely with the Python standard library, requiring no external dependencies, API keys, or third-party packages to resolve DNS records, query WHOIS data, or fetch subdomains.

Why use Certificate Transparency logs for subdomain discovery instead of active scanning?▼

Certificate Transparency logs provide passive subdomain discovery by searching historical SSL certificate issuance records, avoiding active network scanning while still enumerating a domain's infrastructure.

How do I export DNS, WHOIS, and SSL inspection results as JSON for security auditing?▼

All domain intelligence commands including subdomains, SSL, WHOIS, DNS, and availability checks output structured JSON, enabling automated parsing for security research and infrastructure auditing workflows.

Related Skills

Explore More Software Engineering Skills→
afel6afel6

domain-intel

Identify subdomains, SSL details, WHOIS data, DNS records, and domain availability via passive OSINT.

Community
Advanced
ever-oliever-oli
3

domain-intel

Collect passive domain intelligence via subdomains, SSL, WHOIS, DNS, and availability.

Community
Intermediate
protoLabsAIprotoLabsAI
2

recon-sweep

Perform passive and scoped active reconnaissance on network targets and domains.

Official
Advanced
brittaniebuffiecsubrittaniebuffiecsu
1

domain-intel

Identifies subdomains from certificate logs and inspects TLS certificate details using Python stdlib without external API keys.

Community
Advanced