skills.rest
karenrebecag
karenrebecagCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

offensive-osint

Guides OSINT reconnaissance workflows using curated tools for domains, people, infrastructure, and cryptocurrency.

Updated Sep 17, 2026
Search Tags:#reconnaissance#red team#threat intelligence#attack surface#geolocation#osint#cryptocurrency tracing
One-click install
npx skills add https://github.com/karenrebecag/spec-driven-standards --skill offensive-osint-karenrebecag
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-osint
Source: https://github.com/karenrebecag/spec-driven-standards/tree/main/plugins/security/skills/offensive-osint
Command: npx skills add https://github.com/karenrebecag/spec-driven-standards --skill offensive-osint-karenrebecag

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers, red teamers, and bug bounty hunters need a structured, comprehensive methodology for open-source intelligence gathering instead of searching for the right tool across dozens of scattered bookmark lists. ## Core Features & Use Cases - Full-spectrum recon coverage: Organized tool directories for domain and infrastructure enumeration (Shodan, Censys, Amass), email and username investigation (Sherlock, Holehe, Hunter.io), breach data lookup (Have I Been Pwned, Dehashed), and social media profiling. - Specialized intelligence tracks: Dedicated sections for cryptocurrency tracing (Arkham, Etherscan, MetaSleuth), geospatial intelligence (Sentinel Hub, SunCalc, flight and maritime tracking), media forensics (ExifTool, InVID, reverse image search), and threat intel/IOC sources. - Evidence handling discipline: Prescribes archiving every artifact with URL, timestamp, screenshot, and SHA-256 hash, plus JSONL logging with run IDs for reproducible investigations. - Use Case: Given a target domain for an authorized bug bounty program, work top-down through subdomain enumeration, certificate transparency logs, breach data, and employee profiling to build a complete attack-surface map with archived evidence. ## Quick Start Ask the AI to build an attack-surface map and OSINT profile for a target domain you are authorized to assess, following the offensive-osint methodology.

Frequently Asked Questions about offensive-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform OSINT reconnaissance against a target domain?▼

Start with passive subdomain discovery using Amass or Subfinder, then pivot through certificate transparency logs on crt.sh and infrastructure search engines like Shodan and Censys. Archive every artifact with URL, timestamp, screenshot, and SHA-256 hash for reproducibility.

What tools find email addresses and usernames for OSINT investigations?▼

Sherlock and Maigret search usernames across social networks, while Holehe checks whether an email is registered on platforms. Hunter.io finds emails for a domain, and theHarvester harvests emails, subdomains, and metadata in one pass.

How do I trace cryptocurrency transactions for an investigation?▼

Use chain-specific explorers like Etherscan or Blockchain.com for raw transactions, then Arkham, MetaSleuth, or Breadcrumbs for entity labels and visual flow graphs. Whale Alert monitors large transactions and Dune supports custom blockchain queries.

Can I use ChatGPT or Claude for sensitive OSINT analysis?▼

Avoid pasting PII, sensitive IOCs, or unique pivots into cloud LLMs because they log inputs and may train on them. Use local models through Ollama, LM Studio, or GPT4All for sensitive analysis instead.

How should OSINT evidence be preserved for investigations?▼

Capture each finding with its URL, timestamp, PNG screenshot, and a WARC or SingleFileZ archive, then hash all downloaded files with SHA-256. Log findings in JSONL with a run_id and tool versions, and store evidence read-only in per-case containers.

What are the limitations of offensive OSINT gathering?▼

OSINT only surfaces publicly exposed data, so it cannot replace active scanning or authenticated testing, and many sources are freemium or region-gated. It must only be used against authorized targets, since unauthorized reconnaissance may violate laws or platform terms.

Related Skills

Explore More Software Engineering Skills→
UseOSINTUseOSINT
38

useosint

Routes identifiers like emails, domains, and usernames to OSINT investigation workflows.

Official
Intermediate
xijunwwxijunww
1

recon

Automate penetration testing reconnaissance to discover assets and attack surfaces.

Community
Advanced
Liberty91LTDLiberty91LTD
15

darkweb-collection

Collects and synthesizes dark web intelligence from surface-web sources into structured summaries.

Official
Intermediate
Yenn503Yenn503
1

conducting-external-reconnaissance-with-osint

Maps an organization's external attack surface using passive OSINT sources and reconnaissance tools.

Community
Intermediate