skills.rest
hypnguyen1209
hypnguyen1209COMMUNITY
Explore all skills by this author →
Website𝕏@meulody_GitHub

recon-osint

Map target attack surfaces using open-source intelligence and structured outputs.

338|59|Updated May 19, 2026
Search Tags:#reconnaissance#cve#osint#attack-surface#subdomain#breach-intel
One-click install
npx skills add https://github.com/hypnguyen1209/offensive-claude --skill recon-osint
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: recon-osint
Source: https://github.com/hypnguyen1209/offensive-claude/tree/main/skills/recon-osint
Command: npx skills add https://github.com/hypnguyen1209/offensive-claude --skill recon-osint

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

OSINT reconnaissance and attack surface mapping to provide full visibility into a target's exposure and risk assessment, allowing security teams to plan assessments with confidence.

Core Features & Use Cases

  • Subdomain enumeration and domain profiling
  • CVE lookup and breach intelligence aggregation
  • DNS history, technology fingerprinting, and asset discovery
  • Attack surface mapping to prioritize remediation and monitoring
  • Use Case: prepare for a web-app pentest by profiling external exposure and potential misconfigurations

Quick Start

Run an OSINT reconnaissance workflow to enumerate targets and surface intelligence.

Frequently Asked Questions about recon-osint

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I map a target's attack surface using OSINT?▼

Subdomain enumeration discovers exposed assets by resolving DNS records and aggregating data from sources like Shodan and Wayback URLs, outputting a structured subdomain_list for ongoing assessments and web-app pentest preparation.

What is the best way to perform subdomain enumeration for a security assessment?▼

Subdomain enumeration discovers exposed assets by resolving DNS records and aggregating data from sources like Shodan and Wayback URLs, outputting a structured subdomain_list for ongoing assessments and web-app pentest preparation.

Can I aggregate CVE lookup and breach intelligence during reconnaissance?▼

CVE lookup and breach intelligence aggregation consolidates vulnerability data and exposed credentials into a structured cve_list, enabling security teams to assess target risk and plan engagements with full visibility.

Do I need OSINT toolchain knowledge to use this reconnaissance workflow?▼

Yes, OSINT reconnaissance requires toolchain knowledge of utilities like subfinder, amass, theHarvester, Shodan, and waybackurls to effectively discover assets and produce structured technology fingerprints.

Does DNS history and technology fingerprinting help prioritize remediation?▼

DNS history and technology fingerprinting identify past misconfigurations and exposed software stacks, directly feeding the attack surface map to help security teams prioritize remediation and continuous monitoring.

Related Skills

Explore More Data & Analytics Skills→
jd-opensourcejd-opensource
299

pentest-osint-recon

Gather public OSINT data to map external attack surfaces.

Official
Intermediate
Steffen025Steffen025
186

Recon

Automate passive and authorized active infrastructure reconnaissance across domains, IPs, netblocks, and ASNs.

Community
Advanced
valITinovalITino
7

recon-deep

Automate comprehensive reconnaissance to map a target's attack surface.

Community
Advanced
transilienceaitransilienceai
462

domain-assessment

Coordinate subdomain discovery and port scanning to build a domain attack surface inventory.

Official
Basic