skills.rest
GhostPWN
GhostPWNOFFICIAL
Explore all skills by this author →
GitHub

Reconnaissance & OSINT Automation

Map external attack surfaces by discovering subdomains, DNS records, and web technology fingerprints.

4|Updated Mar 10, 2026
Search Tags:#reconnaissance#subdomain enumeration#attack surface#osint#technology fingerprinting#security research#dns analysis
One-click install
npx skills add https://github.com/GhostPWN/ghostpwn --skill reconnaissance-osint-automation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Reconnaissance & OSINT Automation
Source: https://github.com/GhostPWN/ghostpwn/tree/main/src/skills/01-recon-osint
Command: npx skills add https://github.com/GhostPWN/ghostpwn --skill reconnaissance-osint-automation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, dnspython, and includes scripts (resource) components.

What problem does it solve?

This Skill removes the manual overhead of early-stage security research by organizing subdomain discovery, DNS review, web technology fingerprinting, and OSINT correlation into one guided workflow.

Core Features & Use Cases

  • Passive and active reconnaissance: Discover subdomains from Certificate Transparency logs, DNS records, wildcard checks, and optional brute-force enumeration.
  • DNS and email posture analysis: Review A, AAAA, MX, NS, TXT, SOA, SRV, CNAME, CAA, and PTR data, plus SPF, DMARC, DKIM, and zone transfer exposure.
  • Web technology fingerprinting: Identify servers, CMS platforms, frameworks, CDNs, WAFs, analytics, and missing security headers from live URLs.
  • Use case: A security assessor can start with a single domain and quickly produce a confirmed asset list, live host inventory, and prioritized follow-up targets for deeper testing.

Quick Start

Ask the skill to perform authorized reconnaissance on a target domain and return discovered subdomains, DNS findings, technology fingerprints, and notable exposure risks.

Frequently Asked Questions about Reconnaissance & OSINT Automation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automate subdomain enumeration and DNS analysis for a domain?▼

Subdomain enumeration and DNS analysis are automated by querying Certificate Transparency logs and resolving records like A, MX, NS, and TXT to map the attack surface. The workflow uses dnspython and requests to discover assets and review DNS configurations.

How to perform passive reconnaissance and check email posture for an organization?▼

Passive reconnaissance discovers assets via Certificate Transparency logs and DNS lookups without touching live hosts. Email posture is assessed by reviewing SPF, DMARC, DKIM records, and zone transfer exposure to identify misconfigurations.

Does this reconnaissance workflow require installing requests and dnspython?▼

Yes, this reconnaissance workflow requires installing requests and dnspython. These dependencies are necessary to query Certificate Transparency logs, resolve DNS data, and fingerprint HTTP responses during the attack surface mapping process.

What is the best way to map an authorized external attack surface during a security assessment?▼

The best way to map an authorized attack surface is starting with a target domain to discover subdomains, review DNS records, fingerprint web technologies, and produce a prioritized asset list for deeper security testing.

What are the limitations of active reconnaissance when brute-forcing subdomains?▼

Active reconnaissance limitations include potential detection by WAFs and rate limits when brute-forcing subdomains. It should only target explicitly authorized domains to avoid legal issues and ensure DNS wildcard checks are performed to filter false positives.

Related Skills

Explore More Education & Research Skills→
macaughmacaugh
5

Automated Subdomain Enumeration

Enumerate subdomains via passive sources and active DNS techniques.

Community
Advanced
yhy0yhy0
518

web-recon

Enumerate web attack surfaces with curl, dirsearch, gobuster, ffuf, nmap, and whatweb.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
AeonDaveAeonDave
15

amass

Enumerate subdomains and map attack surfaces for a domain.

Community
Advanced