offensive-osint

Subdomain enumeration combines passive sources (crt.sh, Censys, Subfinder, OTX) with active prefix probing using wordlists like Assetnote or SecLists. Passive enumeration alone misses 20-40% of high-value subdomains, so always pair it with an active prefix sweep.

Use the 48-pattern secret regex catalog covering AWS, GitHub, Stripe, Slack, Anthropic, OpenAI, npm, PyPI, and others, or run the bundled stdlib-only Python scanner against a directory, file list, or piped input. Validate any hits with read-only liveness checks only.

Probe 28 common Swagger/OpenAPI paths and 13 GraphQL paths, then POST a standard introspection query to discovered GraphQL endpoints. If introspection is disabled, use field-suggestion enumeration with alias batching to map the schema.

No. The skill explicitly requires that assets are owned by the operator or covered by written authorization, and it excludes active exploitation, post-exploitation, and destructive probes. It is scoped to reconnaissance only.

Apply the 0-100 endpoint interest rubric: unauthenticated write access adds 40 points, open GraphQL introspection 35, reflected CORS with credentials 25, and so on. Scores of 90 or above map to CRITICAL, 70-89 to HIGH, with an attack-path hint attached for scores of 70 or more.

The free HudsonRock Cavalier API returns counts and sample URLs only, redacts subdomain hostnames past the first few entries, and never exposes cleartext credentials. It rate-limits to roughly one request per second per IP, and unredacted data requires the paid tier.