skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

offensive-osint

Index probes, wordlists, and regexes for authorized external reconnaissance.

1.1k|191|Updated Jun 24, 2026
Search Tags:#reconnaissance#red-team#osint#secret-scanning#bug-bounty#subdomain-enumeration#vulnerability-assessment
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill offensive-osint-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: offensive-osint
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/offensive-osint
Command: npx skills add https://github.com/uphiago/recon-skills --skill offensive-osint-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This skill solves the problem of fragmented, time-consuming reconnaissance during authorized external red-team and bug-bounty operations. It consolidates field-validated probes, wordlists, regex patterns, and dorks into a single operational index, eliminating hours of manual searching across Shodan, crt.sh, GitHub, and breach databases.

Core Features & Use Cases

  • Concrete Probe Arsenal: 28 Swagger/OpenAPI paths, 13 GraphQL paths, 35 high-risk port fingerprints, cloud-bucket permutation generators (S3/GCS/Azure), vendor product fingerprints (Citrix, F5, Pulse, Fortinet, PaloAlto, Cisco, VMware), and CI/CD exposure checks.
  • Secret Triage Pipeline: 48-pattern secret catalog with severity ratings, 9 read-only validators for AWS, GitHub, Slack, Postman, JWT, Anthropic, OpenAI, npm, and Atlassian, plus post-discovery enumeration workflows.
  • Attack-Surface Scoring: Endpoint interest score (0-100 rubric), mobile app ownership confidence (0-100 rubric), severity decision matrix with 80+ worked examples, and 27 attack-path hint templates.
  • Sector & Mass Recon: Sector-specific notes for healthcare, finance, ICS/SCADA, IoT, and government, plus empirical mass-recon methodology for non-regulated US SMB sectors with parallel batch testing and false-positive filtering.

Quick Start

Use the offensive-osint skill to perform external reconnaissance on a target by scanning for subdomains and API endpoints, checking for exposed secrets in JavaScript bundles, and validating any discovered credentials with read-only checks.

Frequently Asked Questions about offensive-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enumerate subdomains and discover exposed APIs during external red-team reconnaissance?▼

Subdomain enumeration and API discovery are performed using a consolidated operational index of 28 Swagger/OpenAPI paths, 13 GraphQL paths, and curl one-liners. This probe arsenal eliminates fragmented manual searching across Shodan, crt.sh, and GitHub during authorized red-team operations.

How can I validate exposed secrets found in JavaScript bundles without modifying the target environment?▼

Exposed secrets are validated using 9 read-only validators designed for AWS, GitHub, Slack, Postman, JWT, Anthropic, OpenAI, npm, and Atlassian. This secret triage pipeline classifies 48 discovered patterns using severity ratings and executes post-discovery enumeration workflows safely.

What is the best way to score attack surface interest for web and mobile app targets during bug bounty operations?▼

Attack surface scoring applies a 0-100 endpoint interest rubric and a mobile app ownership confidence matrix. This severity decision matrix provides 80+ worked examples and 27 attack-path hint templates to prioritize vulnerabilities across web and mobile targets.

Does this OSINT skill provide probes for fingerprinting vendor products like Citrix and F5 during vulnerability assessments?▼

Vendor fingerprinting is supported with dedicated probes for Citrix, F5, Pulse, Fortinet, PaloAlto, Cisco, and VMware. The skill includes 35 high-risk port fingerprints and CI/CD exposure checks to identify specific vendor infrastructure during authorized vulnerability assessments.

Can I perform mass reconnaissance and cloud bucket enumeration for specific sectors like healthcare or finance?▼

Sector-specific reconnaissance notes cover healthcare, finance, ICS/SCADA, IoT, and government. An empirical mass-recon methodology for non-regulated US SMB sectors enables parallel batch testing and false-positive filtering, while cloud-bucket permutation generators target S3, GCS, and Azure.

Related Skills

Explore More Software Engineering Skills→
sseshachalasseshachala

offensive-osint

Load modular OSINT reference files for authorized external red-team reconnaissance.

Community
Advanced
infantesromeroadrianinfantesromeroadrian

pentest-ad-attacker

Execute Active Directory attacks and credential access techniques with Impacket, CrackMapExec, and Certipy.

Community
Advanced
zebbernzebbern
4.5k

WordPress Penetration Testing

Automate WordPress security testing with enumeration, vulnerability assessment, and exploitation workflows.

Community
Advanced
rafaelcallejarafaelcalleja
2

ffuf-web-fuzzing

Fuzz web resources to discover hidden directories, files, and subdomains.

Community
Advanced