skills.rest
stanz-stanz
stanz-stanzCOMMUNITY
Explore all skills by this author →
GitHub

osint

Convert passive website signals into structured detection rules and mapping updates.

Updated Aug 23, 2026
Search Tags:#wordpress#rest-api#osint#fingerprinting#cms-detection#passive-recon#slug-mapping
One-click install
npx skills add https://github.com/stanz-stanz/heimdall --skill osint-stanz-stanz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: osint
Source: https://github.com/stanz-stanz/heimdall/tree/main/.claude/agents/osint
Command: npx skills add https://github.com/stanz-stanz/heimdall --skill osint-stanz-stanz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify what a website exposes passively and convert voluntary signals into structured detection rules and mapping tables without performing active probing or content discovery.

Core Features & Use Cases

  • Passive web application fingerprinting: extract CMS indicators, plugin slugs, theme hints, CSS signatures, meta generators, and REST API namespaces from homepage HTML and headers.
  • Version and plugin inference: infer plugin or core versions from asset query parameters, meta tags, inline JS variables, and response headers to improve vulnerability matching.
  • Gap analysis and mapping maintenance: compare Heimdall output to competitor tools, expand slug_map and namespace mappings, and produce detection rules for inclusion in scanner logic.
  • Use Case: diagnose why a known WooCommerce installation appears in a competitor's passive scan but is not detected by Heimdall, then produce new HTML-based detection patterns.

Quick Start

Use the osint agent to analyze the homepage HTML, response headers, DNS and certificate metadata and produce a prioritized list of passive detection rules and namespace-to-slug mappings.

Frequently Asked Questions about osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform passive CMS fingerprinting and plugin detection without active probing?▼

Passive CMS fingerprinting extracts indicators like meta generators, CSS signatures, and REST API namespaces directly from homepage HTML and HTTP headers. It avoids probing unlinked paths by converting voluntary site signals into structured detection rules without active content discovery.

What is passive OSINT fingerprinting for WordPress REST API namespaces?▼

Passive OSINT fingerprinting for WordPress REST API namespaces involves mapping exposed endpoints from publicly served content. It captures namespace-to-slug mappings from homepage HTML and response headers to infer installed plugins and core versions safely.

How do I infer plugin and core versions from HTTP headers and HTML metadata?▼

Version inference extracts plugin and core versions by analyzing asset query parameters, meta tags, inline JavaScript variables, and response headers. This passive approach improves vulnerability matching without sending active probing requests to unlinked site paths.

Why does a known WooCommerce installation appear in competitor passive scans but not in my detection tool?▼

Detection gaps occur when scanner logic lacks specific HTML-based detection patterns for voluntary signals. Analyzing homepage HTML, HTTP headers, and DNS records helps produce new passive detection rules and slug mappings to identify missing installations.

Can I use httpx and webanalyze outputs for passive website technology fingerprinting?▼

Yes, optional tool outputs from httpx and webanalyze can be supplied alongside homepage HTML, DNS records, and SSL certificate data. These inputs generate detection patterns and expand namespace mappings while strictly avoiding active probing of unlinked paths.

Related Skills

Explore More Software Engineering Skills→
ragnarokhaaragnarokhaa
4

domain-intel

Identify subdomains, SSL details, WHOIS data, and DNS records using Python stdlib.

Community
Intermediate
dmbs335dmbs335
18

bchecks-generator

Generate Burp Suite BChecks and Bambdas from vulnerability taxonomy documents.

Community
Advanced
LeoWSY-hashblueLeoWSY-hashblue
3

techstack-frontend

Identify client-side frameworks and build tools from HTML and JavaScript signals.

Community
Intermediate
wgpsecwgpsec
1.6k

subdomain-deep

Enumerate subdomains via DNS brute-force, OSINT, and web crawling.

Official
Intermediate