skills.rest
ragnarokhaa
ragnarokhaaCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

domain-intel

Identify subdomains, SSL details, WHOIS data, and DNS records using Python stdlib.

4|Updated Apr 19, 2026
Search Tags:#domain reconnaissance#subdomain discovery#WHOIS lookup#SSL certificate inspection#DNS analysis
One-click install
npx skills add https://github.com/ragnarokhaa/hermes --skill domain-intel-ragnarokhaa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/ragnarokhaa/hermes/tree/main/hermes-cerul-tech-news-package/hermes-cerul-tech-news-package/hermes-agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/ragnarokhaa/hermes --skill domain-intel-ragnarokhaa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill offers passive domain reconnaissance, enabling subdomain discovery, SSL certificate inspection, WHOIS lookups, DNS records analysis, and domain availability checks without any API keys required.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains through certificate transparency logs.
  • SSL Certificate Inspection: Get details on certificate expiry, cipher suite, and issuer.
  • WHOIS Lookup: Access registration information, registrar details, and dates.
  • DNS Records Analysis: Resolve and check A, AAAA, MX, NS, TXT, CNAME records.
  • Domain Availability Check: Verify domain registration status using passive signals.
  • Use Case: When conducting an audit on the presence and reputation of a company's online presence, use this Skill to check their subdomains and SSL certificates.

Quick Start

Run the 'domain_intel.py' script in the 'scripts' directory with the target domain name, e.g., 'python scripts/domain_intel.py subdomains example.com'.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I discover subdomains without using external API keys?▼

You can discover subdomains passively by leveraging certificate transparency logs. This approach queries public SSL certificate records to identify subdomains without requiring any third-party API keys or external dependencies.

How do I inspect SSL certificates to check expiry and issuer details?▼

Inspect SSL certificates by establishing an SSL connection to the target domain and extracting certificate details. This process retrieves the expiry date, cipher suite, and issuer information directly from the server's presented certificate.

Can I perform WHOIS lookups and DNS analysis using only Python standard libraries?▼

Yes, you can perform passive domain reconnaissance including WHOIS lookups and DNS analysis using only Python stdlib. It queries WHOIS servers and resolves A, AAAA, MX, NS, TXT, and CNAME records without external packages.

Does passive domain reconnaissance work across Linux, macOS, and Windows?▼

Passive domain reconnaissance using Python standard libraries works across Linux, macOS, and Windows. It relies on built-in Python modules for network connections and queries, ensuring cross-platform compatibility without needing OS-specific tools.

What is the best way to check if a domain is available for registration?▼

The best way to check domain availability is by using passive signals like WHOIS registration data and DNS records. Analyzing these signals determines if a domain is currently registered or available without sending active probe requests.

When should I avoid using passive domain reconnaissance for subdomain discovery?▼

Avoid passive domain reconnaissance when you need to find subdomains not yet published in certificate transparency logs. If a subdomain lacks an SSL certificate or was never logged, passive methods will not discover it.

Related Skills

Explore More Software Engineering Skills→
HarriesHarries

domain-intel

Gather subdomains, SSL data, WHOIS, DNS, and availability using Python standard library.

Community
Intermediate
PlaidmustachePlaidmustache

domain-intel

Collect subdomains, SSL details, WHOIS data, and DNS records as structured JSON.

Community
Intermediate
narlyseorgnarlyseorg
6

recon-and-enumeration

Automate reconnaissance and enumeration of endpoints, services, and technologies.

Community
Advanced
AeonDaveAeonDave
15

subfinder

Enumerate subdomains for a target domain using passive OSINT sources.

Community
Intermediate