offensive-osint

External reconnaissance involves probing target surfaces like web, cloud, and mobile assets. This skill provides pre-built wordlists, regex patterns, and probe paths to systematically discover subdomains, exposed CI/CD pipelines, and misconfigured cloud buckets during authorized assessments.

Prioritizing bug-bounty findings requires standardized rubrics for endpoint interest and mobile app ownership. This skill provides severity scoring methodologies to triage discovered secrets and misconfigurations, ensuring consistent evaluation across web and cloud surfaces.

Yes, you can enumerate cloud buckets and triage leaked secrets. The skill supplies operational reference files containing specific probe paths and regex patterns designed to identify exposed cloud storage and sensitive credentials across authorized external targets.

Yes, strict authorization is required. The skill is designed exclusively for authorized external red-team and bug-bounty reconnaissance, adhering to legal posture guidelines to ensure all asset discovery, identity fabric enumeration, and probing activities remain compliant.

You execute specific reconnaissance tasks by modularly loading the appropriate reference files. The skill supports targeted operations like identity fabric analysis by providing structured probes and regex patterns that must be loaded to perform the selected scan.

Pre-built wordlists are limited to discovering assets matching known patterns and require valid authorization. This skill provides structured probe paths for subdomain enumeration but cannot find unlisted assets outside its wordlist scope or bypass external access controls.