osint

Automate OSINT collection from public sources using Unix tools.

7|1|Updated Dec 15, 2025
One-click install
npx skills add https://github.com/kiwamizamurai/cctf --skill osint
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: osint
Source: https://github.com/kiwamizamurai/cctf/tree/main/.claude/skills/osint
Command: npx skills add https://github.com/kiwamizamurai/cctf --skill osint

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes reference (resource) components.

What problem does it solve?

This Skill helps you systematically collect, correlate, and document public information about targets, domains, people, and online presence.

Core Features & Use Cases

  • Public metadata & asset discovery: Extract metadata from images, domains, and social footprints.
  • Cross-platform cross-checks: Correlate findings across platforms and archives.
  • Documentation: Compile findings for reporting and situational awareness.

Quick Start

Quick OSINT workflow: search for a username across platforms and pull available metadata:

  • exiftool image.jpg
  • sherlock username

Frequently Asked Questions about osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I extract metadata from images and documents for investigation?

Metadata extraction retrieves embedded information like GPS coordinates, timestamps, and camera details from images and files. Use exiftool to parse EXIF data from photos, which reveals geolocation, device info, and creation timestamps useful for source verification and timeline building in OSINT investigations.

Can I search for a username across multiple social media platforms automatically?

Yes, sherlock automates cross-platform username searches by checking hundreds of social networks simultaneously, returning profile matches and URLs. This streamlines the initial reconnaissance phase when investigating an identity or online presence across distributed platforms.

What's the best way to gather domain and IP intelligence?

Domain and IP reconnaissance uses dig for DNS queries, whois for registrant and ownership data, and archive checks for historical snapshots. Together these tools correlate IP blocks, nameserver changes, registration history, and cached web content to build comprehensive infrastructure profiles.

How do I correlate information from multiple sources into a cohesive report?

Public source correlation combines findings from metadata extraction, platform searches, DNS records, and archives into documented intelligence. Unix utilities like grep and standard reporting compile raw data into structured findings that establish connections and timelines across disparate sources.

Do I need specialized tools to perform OSINT reconnaissance?

OSINT uses standard Unix utilities—exiftool, dig, whois, grep—plus specialized tools like sherlock for platform searches. This combination of command-line and supported tools works on any system with Bash, making OSINT accessible without proprietary infrastructure.

What information can I recover about archived web content and historical domain records?

Archive checks retrieve cached snapshots of websites, historical DNS records, and past registrant information, revealing how domains and online presence evolved. This historical layer uncovers changes, past infrastructure, and abandoned content useful for attribution and timeline reconstruction.