skills.rest
sheawinkler
sheawinklerCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

domain-intel

Enumerate subdomains, inspect TLS certificates, and resolve DNS using Python's standard library.

78|16|Updated Apr 23, 2026
Search Tags:#dns#ssl#osint#whois#subdomains#bulk-analysis#domain-intel
One-click install
npx skills add https://github.com/sheawinkler/hermes-agent-ultra --skill domain-intel-sheawinkler
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/sheawinkler/hermes-agent-ultra/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/sheawinkler/hermes-agent-ultra --skill domain-intel-sheawinkler

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Passive domain intelligence tasks without relying on external APIs or keys, enabling offline-friendly OSINT workflows.

Core Features & Use Cases

  • Subdomain discovery via Certificate Transparency logs (crt.sh)
  • TLS/SSL certificate inspection, WHOIS lookups, DNS resolution
  • Domain availability signals via passive checks and bulk analysis
  • Output is structured JSON for easy integration and automation

Quick Start

Run python3 SKILL_DIR/scripts/domain_intel.py bulk example.com github.com --checks ssl,dns

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain intelligence gathering without external API keys?▼

Passive domain intelligence without API keys uses Python's standard library to gather subdomains via Certificate Transparency logs, inspect TLS certificates, perform WHOIS lookups, and resolve DNS records, returning structured JSON for automation.

Can I run bulk DNS and SSL analysis on multiple domains at once?▼

Bulk multi-domain analysis is supported with concurrent processing, enabling simultaneous DNS resolution and SSL certificate inspection across multiple domains while filtering specific checks like ssl and dns through the command line.

Does subdomain discovery work without installing third-party dependencies?▼

Subdomain discovery works without third-party dependencies by querying Certificate Transparency logs via crt.sh using only Python's standard library, enabling offline-friendly OSINT workflows across Linux, macOS, and Windows.

What's the best way to get WHOIS and TLS certificate data in a structured format?▼

WHOIS and TLS certificate data is returned as structured JSON output using deterministic functions with robust error handling, ensuring consistent results for integration into security workflows and automation pipelines across operating systems.

Are there limitations to passive domain checks compared to active scanning?▼

Passive domain checks rely on Certificate Transparency logs and DNS resolution without direct host interaction, providing infrastructure signals rather than active vulnerability scanning results while avoiding security alert triggers.

Do I need Python packages installed to use domain-intel for OSINT workflows?▼

No Python packages need installation since domain-intel operates with zero dependencies using only Python's standard library, requiring just Python 3 for subdomain enumeration, WHOIS lookups, and DNS resolution.

Related Skills

Explore More Data & Analytics Skills→
nadicodeainadicodeai

domain-intel

Collect subdomains, SSL certificates, WHOIS, and DNS records via passive OSINT.

Official
Intermediate
PlaidmustachePlaidmustache

domain-intel

Collect subdomains, SSL details, WHOIS data, and DNS records as structured JSON.

Community
Intermediate
wgpsecwgpsec
1.6k

recon-full

Enumerate subdomains, scan ports, fingerprint assets, and validate POCs.

Official
Advanced
afel6afel6

domain-intel

Identify subdomains, SSL details, WHOIS data, DNS records, and domain availability via passive OSINT.

Community
Advanced