skills.rest
Tommy-yw
Tommy-ywCOMMUNITY
Explore all skills by this author →
GitHub

domain-intel

Perform passive domain reconnaissance using Python stdlib.

539|39|Updated May 1, 2026
Search Tags:#domain reconnaissance#subdomain discovery#domain availability#WHOIS lookup#SSL certificate inspection#DNS analysis
One-click install
npx skills add https://github.com/Tommy-yw/RunbookHermes --skill domain-intel-tommy-yw
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: domain-intel
Source: https://github.com/Tommy-yw/RunbookHermes/tree/main/optional-skills/research/domain-intel
Command: npx skills add https://github.com/Tommy-yw/RunbookHermes --skill domain-intel-tommy-yw

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill provides passive domain reconnaissance capabilities, enabling users to discover subdomains, inspect SSL certificates, perform WHOIS lookups, analyze DNS records, check domain availability, and conduct bulk multi-domain analysis without requiring API keys.

Core Features & Use Cases

  • Subdomain Discovery: Find subdomains from certificate transparency logs.
  • SSL Certificate Inspection: Inspect TLS certificate details such as expiry, cipher, SANs, and issuer.
  • WHOIS Lookup: Retrieve registration information, registrar, dates, and name servers.
  • DNS Records Analysis: Resolve A, AAAA, MX, NS, TXT, and CNAME records.
  • Domain Availability Check: Check if a domain is registered using DNS, WHOIS, and SSL signals.
  • Bulk Analysis: Run multiple checks on multiple domains in parallel.
  • Use Case: Use this Skill to perform a comprehensive analysis on a set of domains to gather intelligence for security assessments or competitive analysis.

Quick Start

Run the domain-intel skill to discover subdomains for example.com.

Frequently Asked Questions about domain-intel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive domain reconnaissance without API keys?▼

Passive domain reconnaissance identifies subdomains and inspects SSL certificates using Python stdlib without API keys. It leverages certificate transparency logs and DNS protocols for security assessments and competitive analysis.

What is the best way to discover subdomains from certificate transparency logs?▼

Subdomain discovery queries certificate transparency logs to enumerate active subdomains for a target domain. This passive method extracts domains from SSL certificate SANs without sending direct probe traffic to servers.

Can I check domain availability using DNS and WHOIS signals in Python?▼

Yes, domain availability checks combine DNS resolution, WHOIS registration data, and SSL certificate presence. By cross-referencing these three signals, you can accurately determine if a domain is currently registered or available for purchase.

How do I resolve and analyze DNS records like MX, TXT, and CNAME?▼

DNS records analysis resolves A, AAAA, MX, NS, TXT, and CNAME entries for a target domain. This reveals mail server configurations, text verification records, and domain alias mappings for network troubleshooting or security profiling.

Does Python stdlib support bulk WHOIS lookup and multi-domain analysis?▼

Yes, bulk multi-domain analysis runs WHOIS lookups, DNS resolution, and SSL inspection across multiple domains in parallel. Using Python stdlib, you can concurrently gather registration information and network details for comprehensive security assessments.

How do I inspect SSL certificate details such as expiry and issuer programmatically?▼

SSL certificate inspection connects to a target's TLS endpoint to extract certificate details like expiry date, cipher suite, SANs, and issuer. This identifies expiring certificates and verifies the certificate authority for security assessments.

Related Skills

Explore More Software Engineering Skills→
aayushsoamaayushsoam
1

domain-intel

Perform passive domain reconnaissance using Python stdlib without API keys.

Community
Intermediate
matthew-johnsonmatthew-johnson

domain-intel

Identify passive domain intelligence data using Python standard library without external APIs.

Community
Intermediate
ArianHobson333ArianHobson333
7

reconnaissance

Identify subdomains, ports, endpoints, APIs, and attack surfaces.

Community
Advanced
brittaniebuffiecsubrittaniebuffiecsu
1

sherlock

Search for social media profiles by username across over 400 platforms.

Community
Intermediate