skills.rest
Wyl-cmd
Wyl-cmdCOMMUNITY
Explore all skills by this author →
GitHub

osint-methodology

Guides external red-team OSINT reconnaissance through a five-stage pipeline with asset graphs and severity rubrics.

6|Updated Jan 31, 2026
Search Tags:#reconnaissance#red team#threat intelligence#asset discovery#attack surface#osint#bug bounty
One-click install
npx skills add https://github.com/Wyl-cmd/kxns-cli --skill osint-methodology-wyl-cmd
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: osint-methodology
Source: https://github.com/Wyl-cmd/kxns-cli/tree/main/src/kxns_cli/skills/osint-methodology
Command: npx skills add https://github.com/Wyl-cmd/kxns-cli --skill osint-methodology-wyl-cmd

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? External reconnaissance engagements often produce unstructured, uncorroborated findings with no consistent severity grading, confidence tracking, or reproducible evidence trail. This Skill provides a complete methodology for planning and executing authorized OSINT and attack-surface assessments, from seed discovery through client-ready reporting. ## Core Features & Use Cases - Five-Stage Recon Pipeline: Structured workflow covering seed discovery, asset expansion, enrichment, exposure analysis, and reporting, with time budgets for 1-hour to 1-week engagement profiles. - Asset Graph Discipline: 29 typed asset types, 23 typed edges, confidence levels (TENTATIVE/FIRM/CONFIRMED), and per-asset-type triage and upgrade rules. - Specialized Modules: Identity-fabric mapping (Entra/Okta/ADFS/M365), breach×identity correlation, WAF/CDN bypass and origin discovery, vulnerability prioritization (CVE/EPSS/KEV), phishing infrastructure planning, and bug bounty submission templates. - Use Case: During an authorized red-team engagement against acme.com, use the pipeline to enumerate subdomains, fingerprint the SSO tenant, correlate leaked credentials from breach corpora, and deliver a severity-graded findings report with an executive summary. ## Quick Start Ask the assistant to plan and execute an external reconnaissance engagement against an authorized target domain using the five-stage OSINT pipeline with a one-day time budget.

Frequently Asked Questions about osint-methodology

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I structure an external reconnaissance engagement?▼

Use the five-stage pipeline: seed discovery (WHOIS, ASN, DNS, CT logs), asset expansion (subdomains, buckets, mobile apps), enrichment (ports, TLS, tech detection), exposure analysis (Nuclei, breach correlation), and reporting. Time budgets range from 1-hour rapid recon to 1-week deep assessments.

What is the difference between TENTATIVE, FIRM, and CONFIRMED confidence levels?▼

TENTATIVE means plausible from indirect evidence, FIRM means directly observed but uncorroborated, and CONFIRMED requires multiple independent corroborations or direct verification. Each asset type has documented upgrade paths, such as a subdomain moving from passive-source mention to DNS resolution to live banner confirmation.

When should I not use this OSINT methodology?▼

Do not use it for active exploitation, post-exploitation, lateral movement, malware development, or blue-team detection engineering, as those are out of scope. It also requires confirmed authorization for the target before proceeding with any reconnaissance.

How does detection-aware probing work during reconnaissance?▼

Every probe is tagged Low, Medium, or High detectability based on its SIEM footprint. When signs of detection appear (rate limits, WAF pages, status drift), a back-off ladder applies: slow down, switch endpoints, rotate persona or IP, pause, then document and consult the engagement lead.

Can leaked credentials be validated during an engagement?▼

Yes, but only through read-only validator endpoints such as /me, auth.test, or sts:GetCallerIdentity. The credential must never be used to create, modify, delete, or send anything, and each validation attempt is logged with UTC timestamp and returned scope.

How are vulnerabilities prioritized in the exposure analysis stage?▼

Findings are scored by cross-referencing CVE identifiers with EPSS exploit probability scores, CISA KEV catalog membership, and public proof-of-concept availability. This rubric ranks which exposures warrant immediate escalation in the client report.

Related Skills

Explore More Software Engineering Skills→
dreadnodedreadnode
11

hackerone-recon

Enumerate HackerOne program scope and generate prioritized target inventories.

Official
Intermediate
Yenn503Yenn503
1

exploiting-vulnerabilities-with-metasploit-framework

Validates scanner-reported vulnerabilities by testing exploitability with Metasploit Framework modules.

Community
Intermediate
zebbernzebbern
34

External Network Penetration Testing

Executes multi-phase external network penetration testing with OSINT, reconnaissance, and vulnerability scanning.

Community
Advanced
trungdo9trungdo9
3

cti-expert

Automate cyber threat intelligence investigations using OSINT and forensic analysis.

Community
Advanced