skills.rest
grivera82
grivera82COMMUNITY
Explore all skills by this author →
GitHub

offensive-osint

Identifies and maps external OSINT surfaces for authorized red-team and bug-bounty reconnaissance.

Updated May 31, 2026
Search Tags:#swagger#red-team#osint#graphQL#subdomain-enumeration#dorks
One-click install
npx skills add https://github.com/grivera82/pi-bughunter --skill offensive-osint-grivera82
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-osint
Source: https://github.com/grivera82/pi-bughunter/tree/main/skills/offensive-osint
Command: npx skills add https://github.com/grivera82/pi-bughunter --skill offensive-osint-grivera82

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.

Core Features & Use Cases

  • Probes, wordlists, and curl one-liners for external recon across subdomains, APIs, identity fabrics, cloud exposures, and security data leaks.
  • Modular reference delivery: heavy content lives in 15 modular references loaded on demand to keep workloads efficient.
  • Ideal for security consultants conducting authorized bug-bounty engagements, red-team assessments, or enterprise threat-hunting operations.

Quick Start

Use the offensive-osint skill to kick off an external reconnaissance task with a focused prompt that loads the most relevant references.

Frequently Asked Questions about offensive-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains and discover API endpoints for external red-team reconnaissance?▼

External red-team reconnaissance uses modular OSINT probes to enumerate subdomains and discover API endpoints like Swagger, GraphQL, and OpenAPI. It applies targeted curl one-liners and wordlists to map exposed attack surfaces during authorized engagements.

What is the best way to discover exposed cloud buckets and identity fabric leaks during OSINT scoping?▼

OSINT scoping for cloud buckets and identity fabric leaks involves querying S3, GCS, and Azure storage, alongside probing Entra, Okta, ADFS, and M365 services. It uses specialized regexes and dorks to identify exposed authentication surfaces and storage misconfigurations.

How does TLS JA3 analysis and certificate transparency help map external attack surfaces?▼

TLS JA3 analysis and certificate transparency monitoring map external attack surfaces by fingerprinting client communications and tracking newly issued certificates. This reveals hidden subdomains, vendor fingerprints like Citrix or F5, and potential origin servers behind CDN WAFs.

Can I use dorks and curl one-liners to find CI/CD exposures and secret leaks in package registries?▼

Dorks and curl one-liners effectively find CI/CD exposures and secret leaks by querying package registries like npm and PyPI. The process applies a 48-pattern secret-scan catalog covering AWS, GitHub, Stripe, and OpenAI credentials to triage discovered exposures.

Does this OSINT toolkit support sector-specific reconnaissance for healthcare DICOM and ICS SCADA Modbus?▼

The OSINT toolkit supports sector-specific reconnaissance for healthcare DICOM, finance SWIFT, and ICS/SCADA Modbus or BACnet protocols. It loads modular reference files on demand to provide tailored probes for these specialized external attack surfaces.

What are the limitations of using dorks for external recon against WAF-protected targets?▼

Dorks for external recon against WAF-protected targets face limitations when CDN WAFs block direct probing or obscure origin servers. Reconnaissance must pivot to JS endpoint extraction, TLS certificate analysis, and breach correlation via HudsonRock or HIBP to bypass these constraints.

Related Skills

Explore More Data & Analytics Skills→
LerianStudioLerianStudio
205

pre-dev-prd-creation

Generate a complete PRD with problem discovery, user stories, and success metrics.

Official
Basic
realsigridjinrealsigridjin
20

security-review

Identify and prioritize security vulnerabilities with OWASP Top 10 analysis.

Community
Advanced
adaptive-enforcement-labadaptive-enforcement-lab
3

secure

Scan code, dependencies, and containers for vulnerabilities and generate SBOMs.

Official
Advanced
uphiagouphiago
1.1k

web2-recon

Automate web2 attack surface mapping with subdomain enumeration, URL crawling, and JavaScript analysis.

Community
Advanced