skills.rest
chainreactors
chainreactorsOFFICIAL
Explore all skills by this author →
WebsiteGitHub

passive

Query multiple search engine APIs to map domains and ICP records to IPs, ports, and URLs.

235|25|Updated May 7, 2026
Search Tags:#reconnaissance#cybersecurity#asset discovery#osint#shodan#fofa
One-click install
npx skills add https://github.com/chainreactors/aiscan --skill passive-chainreactors
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: passive
Source: https://github.com/chainreactors/aiscan/tree/main/skills/passive
Command: npx skills add https://github.com/chainreactors/aiscan --skill passive-chainreactors

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of manually discovering internet-facing assets by automating the querying of multiple cyberspace search engines to map domains and ICP records to IPs, URLs, and ports.

Core Features & Use Cases

  • Multi-Source Recon: Aggregates data from providers like FOFA, Hunter, Shodan, and Censys.
  • Pipeline Integration: Seamlessly feeds discovered assets into active scanning tools like gogo, spray, or katana.
  • Use Case: Quickly identify all exposed infrastructure associated with a specific company domain or ICP registration number before launching a security assessment.

Quick Start

Use the passive skill to search for all assets associated with the domain example.com using the fofa source.

Frequently Asked Questions about passive

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map a domain to exposed IP addresses and ports using cyberspace search APIs?▼

To discover internet-facing assets, the Skill queries configured search engine APIs using a target domain or ICP registration number, aggregating the returned IPs, URLs, and open ports into a structured JSON output.

What is the best way to automate OSINT reconnaissance for a company's ICP registration number?▼

Automating OSINT reconnaissance involves querying multiple cyberspace search providers with an ICP registration number to instantly identify all associated technical infrastructure before launching a security assessment.

Do I need API credentials for Shodan and FOFA to perform passive asset discovery?▼

Yes, you need valid API credentials for your selected search providers like Shodan or FOFA to authenticate queries and retrieve structured asset discovery data during the reconnaissance process.

Can I feed discovered cyberspace assets directly into active scanning tools?▼

Yes, discovered assets can be seamlessly integrated into security workflows by feeding the structured JSON output into active scanning tools like gogo, spray, or katana for further pipeline analysis.

What search engine sources are supported for multi-source cyberspace reconnaissance?▼

Supported cyberspace search sources include FOFA, Hunter, Shodan, and Censys, allowing you to aggregate comprehensive infrastructure data across multiple providers for thorough security assessments.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

recon-favicon-fingerprint

Compute MurmurHash3 fingerprints of favicon files to identify web technologies.

Community
Advanced
refractionPOINTrefractionPOINT
29

sensor-coverage

Inventory assets and assess sensor coverage for LimaCharlie endpoints.

Official
Advanced
AeonDaveAeonDave
15

nmap

Scan networks for hosts, ports, services, and operating systems.

Community
Intermediate
Steffen025Steffen025
186

OSINT

Gather and verify open-source information about people, companies, domains, and threats.

Community
Advanced