skills.rest
richardnguyen0715
richardnguyen0715COMMUNITY
Explore all skills by this author →
GitHub

domain-intel

...

Updated May 11, 2026
Search Tags:#domain reconnaissance#subdomain discovery#DNS records#WHOIS lookup#SSL certificate inspection#passive OSINT
One-click install
npx skills add https://github.com/richardnguyen0715/keep-it-real --skill domain-intel-richardnguyen0715
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/richardnguyen0715/keep-it-real/tree/main/refer-projects/hermes-agent/optional-skills/research/domain-intel
Command: npx skills add https://github.com/richardnguyen0715/keep-it-real --skill domain-intel-richardnguyen0715

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill addresses the need for passive domain reconnaissance, offering a comprehensive set of tools for domain intelligence without the need for API keys.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains from certificate logs.
  • SSL Certificate Inspection: Examine TLS certificate details.
  • WHOIS Lookup: Obtain registration info, registrar, dates, and name servers.
  • DNS Records: Resolve A, AAAA, MX, NS, TXT, CNAME records.
  • Domain Availability Check: Passive checks for domain registration.
  • Bulk Analysis: Run multiple checks on multiple domains in parallel.
  • Use Case: Identify potential vulnerabilities in a domain's infrastructure by checking for subdomains, SSL certificate expiration, WHOIS data, and DNS records.

Quick Start

Use the domain-intel skill to find subdomains for 'example.com'.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

You can perform passive domain reconnaissance using Python stdlib to execute subdomain discovery, WHOIS lookups, DNS record resolution, and SSL certificate inspection without requiring any external API keys.

Can I find subdomains from certificate logs for infrastructure assessments?▼

Subdomain discovery extracts subdomains from certificate logs, providing visibility into a domain's infrastructure for security audits and vulnerability identification without active scanning.

What DNS records can I resolve with a Python stdlib OSINT tool?▼

A Python stdlib OSINT tool can resolve A, AAAA, MX, NS, TXT, and CNAME DNS records to inspect domain infrastructure configuration and identify potential vulnerabilities during security audits.

How do I check SSL certificate details and expiration for a domain?▼

SSL certificate inspection examines TLS certificate details and expiration dates to identify potential vulnerabilities in a domain's infrastructure during passive security audits.

Can I run bulk WHOIS lookups and DNS checks on multiple domains in parallel?▼

Bulk analysis allows running subdomain discovery, WHOIS lookups, DNS resolution, and SSL certificate inspection on multiple domains in parallel to streamline infrastructure assessments.

What are the limitations of passive OSINT for domain availability checks?▼

Passive OSINT domain availability checks rely on querying existing registration data rather than active probing, meaning they may not detect unregistered domains if WHOIS data is privacy-protected or delayed.

Related Skills

Explore More Software Engineering Skills→
cxnaivecxnaive

domain-intel

Perform passive domain reconnaissance using Python standard library modules.

Community
Intermediate
heysuhasheysuhas
2

domain-intel

Perform passive domain reconnaissance using standard Python libraries.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced