Map target organizations through passive OSINT sources with confidence scoring.
npx skills add https://github.com/0x0pointer/skills --skill osint-0x0pointer
Please help me install this Agent Skill. Skill: osint Source: https://github.com/0x0pointer/skills/tree/main/osint Command: npx skills add https://github.com/0x0pointer/skills --skill osint-0x0pointer
This Skill enables comprehensive passive OSINT reconnaissance to map a target organization across people, infrastructure, technologies, and public footprints without touching the target's systems.
Initiate a target domain and preferred depth to begin passive OSINT collection and mapping of external surface area.
High-intent search queries and answers about installing and using this skill.
Passive OSINT reconnaissance maps a target organization's people, infrastructure, and public exposure using public sources without touching the target's systems, providing evidence-driven reporting with confidence scoring for threat modeling.
Subdomain enumeration and certificate transparency monitoring map a target's external infrastructure and historical SSL/TLS certificate registrations, detecting public exposure and subdomain takeover risks for threat modeling.
Wayback Machine artifacts and Shodan/Censys data gather historical web snapshots and cloud asset intelligence, while social media footprinting maps people and public exposure, cross-referencing findings to provide comprehensive threat intelligence reporting.
Email discovery and domain/DNS intelligence use tools like dnsrecon and theHarvester to map a target organization's email addresses, DNS records, and infrastructure, generating evidence-driven reports with confidence scoring for security assessments.
Passive OSINT reconnaissance relies on public sources without touching target systems, but explicitly requires authorization before chaining into active penetration testing workflows with /pentester.
Passive OSINT limitations include reliance on public source accuracy and historical data from certificate transparency and Wayback, meaning cloud asset mapping and subdomain takeover detection may miss recent infrastructure changes not yet indexed.
salmanabdurrahmanAggregate public data from search engines, DNS, and repositories for passive reconnaissance.
giosuetedeschi-specGuide authorized penetration tests through reconnaissance, scanning, exploitation, and reporting.
tcole333Maps digital infrastructure using public records, certificate logs, and DNS data.
macaughEnumerate subdomains via passive sources and active DNS techniques.
