skills.rest
brukal001
brukal001COMMUNITY
Explore all skills by this author →
GitHub

osint-methodology

Guides structured OSINT investigations covering geolocation, cryptocurrency tracing, and threat actor attribution.

Updated Jun 26, 2026
Search Tags:#investigation#reconnaissance#OSINT#geolocation#intelligence#cryptocurrency tracing#threat attribution
One-click install
npx skills add https://github.com/brukal001/brukal --skill osint-methodology-brukal001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: osint-methodology
Source: https://github.com/brukal001/brukal/tree/main/skills/claude-red/recon/offensive-osint-methodology
Command: npx skills add https://github.com/brukal001/brukal --skill osint-methodology-brukal001

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Open source intelligence investigations often fail due to ad-hoc searching, missed pivots, and poor evidence handling. This Skill provides a systematic operational checklist that walks an analyst through target definition, collection, correlation, and reporting so nothing important is overlooked. ## Core Features & Use Cases - Full OSINT workflow checklist: Covers OpSec and sock puppets, image and video geolocation, chronolocation via shadow and astronomical analysis, people and social media investigation, and infrastructure OSINT with concrete tool links for each step. - Specialized investigation tracks: Includes cryptocurrency transaction and wallet tracing (including Layer 2 and bridge obfuscation challenges), threat actor attribution workflows with Russia- and China-specific pivots, and malware artifact triage. - Use Case: An analyst investigating a suspicious wallet address uses the cryptocurrency investigation section to trace fund flows through block explorers, then pivots to infrastructure OSINT to map associated domains via certificate transparency logs and passive DNS. ## Quick Start Use the osint-methodology skill to plan and execute a structured OSINT investigation against my target, tracking each checklist step as we go.

Frequently Asked Questions about osint-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I run a structured OSINT investigation?▼

Follow the methodology checklist in order: establish OpSec with sock puppet accounts, define the target, select sources, collect data, correlate findings, and reconstruct a timeline. The skill tracks completed items and suggests next steps based on findings.

What tools are used for image geolocation in OSINT?▼

The methodology recommends reverse image search engines like Google Lens, Yandex Images, and TinEye, plus EXIF metadata extraction with ExifTool. For terrain matching it suggests PeakVisor and Peakfinder, and Google Street View or Overpass Turbo for manual comparison.

How do I trace cryptocurrency transactions across blockchains?▼

Start with L1 bridge deposit and withdrawal events to anchor activity to known addresses, then use chain-specific explorers like Arbiscan or zkSync Era explorer. Tools like Arkham, TRM, and MetaSleuth build relationship graphs, though bridges and mixers can break direct tracing.

Can OSINT attribution reliably identify threat actors?▼

Attribution requires discipline: the methodology mandates a rule-of-three with at least three independent weak signals or one strong plus one weak signal before asserting linkage. Durable pivots like registrar accounts and code-signing certificate reuse are preferred over ephemeral ones like resolving IPs.

What are the limitations of Layer 2 blockchain analysis?▼

Zero-knowledge rollups hide transaction details on L2, exposing only bridge events on L1, and privacy protocols like Railgun obscure sender, receiver, and amount. Many L2 networks lack mature analytics tooling, so investigators rely on timing analysis and deposit/withdrawal clustering.

Related Skills

Explore More Education & Research Skills→
UseOSINTUseOSINT
38

useosint

Routes identifiers like emails, domains, and usernames to OSINT investigation workflows.

Official
Intermediate
Liberty91LTDLiberty91LTD
15

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

Official
Intermediate
UseOSINTUseOSINT
38

find-hidden-subdomains

Enumerate subdomains and sibling domains from Certificate Transparency logs and passive DNS.

Official
Advanced
xalgordxalgord
954

collecting-open-source-intelligence

Collects OSINT on threat actors and malicious infrastructure using passive reconnaissance tools.

Community
Intermediate