skills.rest
Carlos-Reyes-UTP
Carlos-Reyes-UTPCOMMUNITY
Explore all skills by this author →
GitHub

offensive-osint

Generate structured external reconnaissance probes and triage guidance for authorized OSINT.

2|Updated Apr 11, 2025
Search Tags:#graphql#osint#recon#secret scanning#severity scoring#identity fabric#cloud bucket enum
One-click install
npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill offensive-osint-carlos-reyes-utp
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-osint
Source: https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda/tree/main/.agent/skills/offensive-osint
Command: npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill offensive-osint-carlos-reyes-utp

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It solves the problem of turning scattered public and technical signals into a structured, probe-ready external reconnaissance plan, including concrete paths, wordlists, regexes, and triage rubrics.

Core Features & Use Cases

  • Recon probe arsenal: Provides ready-to-run endpoints, high-risk ports, and copy-paste curl one-liners for discovery tasks like Swagger/OpenAPI, GraphQL, cloud buckets, SSO/identity endpoints, CDN/WAF/origin checks, and vendor fingerprinting.
  • Secret detection + validation: Delivers a secret-pattern catalog plus a read-only secret validator workflow and a runnable stdlib helper script to confirm live credentials safely.
  • Triage and prioritization: Supplies scoring rubrics (endpoint interest score, mobile ownership confidence) and a severity decision matrix with worked examples so findings are actionable and consistently prioritized.

Quick Start

Use the offensive-osint skill to help you run authorized external recon by asking: "Provide the exact Swagger/OpenAPI probe paths and the GraphQL introspection POST body for https://target.example/graphql."

Frequently Asked Questions about offensive-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate GraphQL introspection probes for external recon?▼

External recon for GraphQL uses structured POST bodies and endpoint catalogs to query introspection schemas. You supply a target URL, and the skill provides exact curl one-liners to enumerate available queries, mutations, and types.

What is the best way to find exposed Swagger or OpenAPI endpoints during OSINT?▼

OSINT for OpenAPI discovery involves probing concrete paths using generated wordlists. The skill outputs exact probe paths and copy-paste curl commands to locate leaked API documentation on target web surfaces.

Can I safely validate discovered secrets without accidentally exploiting them?▼

Safe secret validation uses read-only pattern matching and a stdlib helper script to confirm live credentials. This ensures you verify exposed secrets without executing write operations or triggering active exploitation.

How do I enumerate cloud buckets and CDN origins for bug bounty reconnaissance?▼

Cloud bucket and CDN origin investigation applies targeted enumeration probes and severity scoring. The skill provides structured wordlists and curl one-liners to discover misconfigured storage and bypass CDN restrictions.

Does this OSINT skill provide triage guidance for identity fabric endpoints like Entra and Okta?▼

Identity fabric endpoint targeting includes probing Entra, Okta, ADFS, and M365 configurations. The skill supplies endpoint catalogs and confidence rubrics to assess mobile ownership and target SSO infrastructure accurately.

How do I prioritize external recon findings consistently for red-team operations?▼

Prioritizing recon findings uses an endpoint interest score and a severity decision matrix with worked examples. This triage guidance ensures red-team and bug-bounty results are actionable and consistently ranked.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

offensive-osint

Index probes, wordlists, and regexes for authorized external reconnaissance.

Community
Advanced
superfhpsuperfhp

siyuan

Interact with the SiYuan Notebase API using curl commands.

Community
Intermediate
EntroVyxEntroVyx
3

offensive-osint

Index probes, wordlists, and regex patterns for authorized external reconnaissance.

Community
Advanced
dreadnodedreadnode
11

vuln-critic

Filter low-quality and false positive vulnerability findings from scanners and agent output.

Official
Intermediate