skills.rest
defconxt
defconxtCOMMUNITY
Explore all skills by this author →
GitHub

OSINT and Reconnaissance

Automate OSINT and reconnaissance tasks to enumerate subdomains, services, and user identities.

Updated Aug 27, 2026
Search Tags:#reconnaissance#cybersecurity#subdomain enumeration#cloud security#network scanning#attack surface#osint
One-click install
npx skills add https://github.com/defconxt/CIPHER --skill osint-and-reconnaissance
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: OSINT and Reconnaissance
Source: https://github.com/defconxt/CIPHER/tree/main/skills/osint-recon
Command: npx skills add https://github.com/defconxt/CIPHER --skill osint-and-reconnaissance

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the complex and time-consuming process of gathering intelligence on targets, identifying their digital presence, and mapping their attack surface.

Core Features & Use Cases

  • Passive Reconnaissance: Gathers information from public sources like Certificate Transparency logs, WHOIS records, and Shodan without directly interacting with the target.
  • Active Enumeration: Discovers subdomains, open ports, and live web services through DNS queries, port scanning, and web probing.
  • Cloud Asset Discovery: Identifies cloud storage buckets and other cloud-specific assets.
  • Username & Social OSINT: Maps user identities across various platforms.
  • Use Case: An organization needs to understand its external attack surface. This Skill can be used to discover all publicly accessible subdomains, identify running services on those subdomains, and find associated cloud assets, providing a comprehensive view of potential vulnerabilities.

Quick Start

Use the OSINT and Reconnaissance skill to discover all subdomains for the target domain 'example.com'.

Frequently Asked Questions about OSINT and Reconnaissance

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and network scanning for a target domain?▼

Automate subdomain enumeration and network scanning by integrating tools like subfinder, dnsx, and httpx to systematically discover subdomains, resolve DNS records, and probe live web services for a target domain.

What is passive reconnaissance and how does it map an external attack surface?▼

Passive reconnaissance maps an external attack surface by gathering public intelligence from Certificate Transparency logs, WHOIS records, and Shodan without directly interacting with the target's network.

Can I discover cloud storage buckets and associated assets during OSINT?▼

Yes, you can discover cloud storage buckets and cloud-specific assets during OSINT by systematically enumerating public sources and identifying associated cloud resources tied to the target.

How do I find user identities and social profiles across platforms using OSINT?▼

Find user identities and social profiles across platforms by utilizing tools like sherlock and ghunt to map target usernames and uncover associated accounts during the reconnaissance process.

Does this OSINT skill support active port scanning and service detection?▼

Yes, this OSINT skill supports active port scanning and service detection by leveraging nmap to discover open ports and identify running network services on enumerated target subdomains.

What is the best way to build a comprehensive target profile for cybersecurity?▼

Build a comprehensive target profile by combining passive OSINT gathering with active enumeration, systematically aggregating subdomains, network services, cloud assets, and user identities into a detailed map.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

asn-infrastructure-mapping

Map organizational IP infrastructure by pivoting from domains to ASNs and extracting CIDR ranges.

Community
Advanced
uphiagouphiago
1.1k

wp-mass-recon

Batch scan domains for WordPress vulnerabilities and generate prioritized reports.

Community
Advanced
refractionPOINTrefractionPOINT
29

threat-report-evaluation

Evaluate threat reports to extract IOCs and behaviors across LimaCharlie organizations.

Official
Advanced
jaskaranhundaljaskaranhundal
3

attack-surface-management

Discover, inventory, and risk-score internet-facing assets continuously.

Community
Advanced