skills.rest
objval
objvalCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

domain-intel

Enumerate subdomains, inspect TLS certificates, query WHOIS, and resolve DNS records using Python stdlib.

Updated Aug 27, 2026
Search Tags:#dns#ssl#domain#osint#whois#subdomains#passive
One-click install
npx skills add https://github.com/objval/hermes-agent --skill domain-intel-objval
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/objval/hermes-agent/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/objval/hermes-agent --skill domain-intel-objval

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain reconnaissance is often manual and requires external tools or services. This skill provides a zero-dependency OSINT workflow to gather subdomains, TLS data, WHOIS, DNS records, and domain availability insights using only Python stdlib.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency using crt.sh
  • SSL certificate inspection (expiry, SANs, issuer)
  • WHOIS lookup for registrar, dates, and name servers
  • DNS records resolution via system DNS and Google DoH
  • Passive domain availability signals with combined checks Use case: quickly assess a domain's exposure for security assessments or brand monitoring without API keys.

Quick Start

Run domain_intel.py with a target domain to perform a full passive OSINT sweep.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain OSINT without installing external dependencies?▼

You can perform passive domain OSINT using only the Python standard library to enumerate subdomains, inspect TLS certificates, query WHOIS, and resolve DNS records without requiring any external APIs or keys.

How does Certificate Transparency help with subdomain discovery?▼

Subdomain discovery via Certificate Transparency works by querying crt.sh to enumerate subdomains passively. This method gathers SSL certificate data to reveal subdomains without actively scanning the target domain's infrastructure.

Can I check domain availability and WHOIS data using only Python stdlib?▼

Yes, you can evaluate domain availability and query WHOIS for registrar, dates, and name servers using only Python stdlib. The tool combines passive checks to output structured JSON for domain analysis.

What DNS record types can I resolve with a zero-dependency OSINT tool?▼

You can resolve DNS records using system DNS and Google DoH. The tool queries these sources passively to gather DNS records for domain analysis without needing external API keys or dependencies.

Does passive domain reconnaissance work for brand monitoring and security assessments?▼

Passive domain reconnaissance is applicable to security assessments, brand monitoring, and infrastructure discovery. It assesses a domain's exposure by gathering TLS data, WHOIS, and subdomains without alerting the target.

What are the limitations of using Python stdlib for SSL certificate inspection?▼

Using Python stdlib for SSL certificate inspection limits you to standard library functions for checking expiry, SANs, and issuer. It requires no external tools but relies on passive data sources rather than active scanning.

Related Skills

Explore More Data & Analytics Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
valITinovalITino
7

osint-gathering

Collect passive OSINT data on target domains via public sources.

Community
Advanced
BishopCodesBishopCodes
1

Recon

Enumerate subdomains, DNS records, mail servers, and open ports.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic