skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

osint-methodology

Guides authorized external reconnaissance using a five-stage OSINT pipeline with asset graphs and severity rubrics.

10|3|Updated Aug 10, 2026
Search Tags:#reconnaissance#red team#threat intelligence#asset discovery#attack surface#osint#bug bounty
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill osint-methodology-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: osint-methodology
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/osint-methodology
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill osint-methodology-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security professionals running authorized external red-team engagements, bug bounty recon, or attack-surface assessments often lack a consistent methodology for scoping, evidence handling, confidence grading, and reporting. This Skill provides a structured operational framework that turns ad-hoc reconnaissance into a repeatable, defensible workflow. ## Core Features & Use Cases - Five-Stage Recon Pipeline: Seed discovery, asset expansion, enrichment, exposure analysis, and reporting, with priority ordering and time budgets for 1-hour to 1-week engagement profiles. - Asset Graph & Severity Discipline: 29 typed asset types, per-type triage rules, a three-tier confidence model (TENTATIVE/FIRM/CONFIRMED), and a CRITICAL-to-INFO severity rubric with escalation rules. - OpSec & Detection Awareness: Detectability tagging for probes, validator discipline for found credentials, and a back-off ladder when WAF blocks or rate limits appear. - Deliverable Templates: Bug bounty submission formats (HackerOne, Bugcrowd, Intigriti), executive summaries, risk translation tables, and reproduction packages. - Use Case: During an authorized bug bounty engagement, use the pipeline to enumerate subdomains, correlate breach data with the target's SSO tenant to produce an SSO_EXPOSURE finding, then generate a client-ready report with evidence hashes and remediation steps. ## Quick Start Ask the assistant to plan an external recon engagement against a domain you are authorized to test, starting with seed discovery and a scoped time budget.

Frequently Asked Questions about osint-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I start external recon on an authorized target?▼

Begin with Stage 1 seed discovery: WHOIS, ASN enumeration, DNS records, and certificate transparency history via crt.sh and Censys. Then expand assets through passive subdomain enumeration before any active probing, following the pipeline's priority order.

What is the best way to prioritize reconnaissance findings?▼

Use the severity rubric anchored on concrete examples: listable buckets with PII or live credentials are CRITICAL, exposed admin panels are HIGH, missing security headers are MEDIUM or LOW. Escalation rules bump findings like wildcard CORS with credentials from MEDIUM to HIGH.

How should I validate credentials found during OSINT work?▼

Use read-only validator endpoints only, such as /me, auth.test, or sts:GetCallerIdentity, and never create, modify, or delete anything. Record the UTC timestamp, truncated response, and account scope for each validation.

What should I do when reconnaissance probes get blocked by a WAF?▼

Follow the back-off ladder: halve concurrency with jitter, stop hitting the triggering path, rotate user agent and egress IP, then pause. If you see WAF block pages, status drift, or direct contact, stop and consult the engagement lead.

When should this OSINT methodology not be used?▼

Do not use it for active exploitation, post-exploitation, malware development, or blue-team detection content. It is also inappropriate when target authorization is unclear; the skill requires confirming written authorization or ownership first.

Related Skills

Explore More Software Engineering Skills→
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
rocklambrosrocklambros
2

writing-pentest-finding

Generate client-deliverable penetration-test findings with CVSS v3.1 vectors and remediation.

Community
Advanced
DCx7C5DCx7C5

vulnerabilities-SKILL.md

Prioritize CVEs by CVSS scores enriched with EPSS and KEV data.

Community
Advanced
n4igmen4igme

web2-recon

Automate web2 reconnaissance with subdomain enumeration, live host discovery, and URL crawling.

Community
Intermediate