#413 by GitHub stars
elementalsouls/Claude-OSINT
8 Claude skills · 100+ recon capabilities · 80 secret-regex patterns · 80+ dorks · 9 read-only credential validators · 27 attack-path templates · ~10,000 lines of structured tradecraft. Drop-in SKILL.md files that turn Claude into a god-mode external recon operator for authorized red-team and bug-bounty engagements.
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
skills/cloud-saas-exposure/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/continuous-exposure-monitoring/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/email-domain-security/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/exposure-risk-quantification/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Instructions only → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Instructions only
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/identity-provider-recon/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/offensive-osint/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/org-attack-surface/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/osint-autopilot/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → c359ec1b44d0
No earlier version was observed for comparison.
skills/osint-methodology/SKILL.md
Week of Nov 2, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
c359ec1b44d0 → c359ec1b44d0
Week of Oct 26, 2026 · Line counts unavailable
Before Not checked yet → After Network or broad shell
First observation → c359ec1b44d0
No earlier version was observed for comparison.
View on GitHubAdd to my skills
Verified commit c359ec1b44d01d324ba98698277e96ccbcd3e890
git clone --filter=blob:none --no-checkout https://github.com/elementalsouls/Claude-OSINT.git .hotskills/elementalsouls-claude-osint && git -C .hotskills/elementalsouls-claude-osint checkout --detach c359ec1b44d01d324ba98698277e96ccbcd3e890
# Copy each selected skill directory from .hotskills/elementalsouls-claude-osint into .claude/skills/<skill-name>/3kGitHub stars
43stars in 7 days
9skills in this repository
2commits in 30 days
Heat
6.7- Star growth, last 7 daysAhead of 89% of tracked repositories
- Star growth, last 24 hoursAhead of 95% of tracked repositories
- Rank movement, last 7 daysAhead of 45% of tracked repositories
- Commits, last 30 daysAhead of 60% of tracked repositories
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekAhead of 0% of tracked repositories
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
Individual skills in this repository
- cloud-saas-exposure
skills/cloud-saas-exposure - continuous-exposure-monitoring
skills/continuous-exposure-monitoring - email-domain-security
skills/email-domain-security - exposure-risk-quantification
skills/exposure-risk-quantification - identity-provider-recon
skills/identity-provider-recon - offensive-osint
skills/offensive-osint - org-attack-surface
skills/org-attack-surface - osint-autopilot
skills/osint-autopilot - osint-methodology
skills/osint-methodology
How it works
cloud-saas-exposure
When your agent uses it
Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuance the public search API misses); and passive cloud-native/container/Kubernetes/CI control-plane fingerprinting (Lambda URLs, API Gateway, Cloud Run, App Service, kubelet/etcd/K8s API/dashboard, Jenkins/GitLab/Argo CD) as an org-attribution and exposure surface. Passive/discovery only -- no exploitation, no credential submission, no active control-plane confirmation (a stage-6 validate_cloud active tier is described but out of scope). Use when enumerating a target's cloud storage footprint, recovering an AWS account ID from a leaked key, confirming a supply-chain dependency-confusion vector, or fingerprinting cloud-native/K8s/CI infrastructure for an authorized external recon engagement.
What it loads into context
Frontmatter
706 tokensAlways available to the agent
SKILL.md
11,518 tokensWhen the skill is activated
Reference documents
1,697 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Authorization & Legal Posture
- 2. Confidence Levels
- 3. Output Format
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. Storage Bucket Discovery — Candidate Generation, Existence vs. Listing, and the Ownership-Gated Severity Model
- 7. AWS Account-ID Recovery from a Leaked Access Key (Offline Decode)
- 8. Dependency Confusion — Internal Signal + Public-Registry Unclaimed Confirmation
- 9. Cloud-Native & Container/K8s/CI Control-Plane Fingerprinting — an Org-Attribution Surface
- 10. Severity & Business Translation
- 11. Skill Self-Test
- 12. Changelog
Files
README.mddoc7,129 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytesSKILL.mdcore44,737 bytes
Read SKILL.md
# Cloud & SaaS Exposure — Buckets, Offline AWS Account-ID Recovery, Dependency Confusion, and Cloud-Native/K8s Fingerprinting
> Companion skills: `osint-methodology` (the pipeline this plugs into — Stage 2 asset
> expansion, Stage 4 exposure analysis, Stage 5 supply-chain confirmation). `offensive-osint`
> §16.8 (bucket-permutation raw wordlist), §16.17 (cloud-native URL pattern table), §16.18–
> §16.19 (container/K8s/CI paths + active curl recipes), §44 (package-registry search). This
> skill does not repeat those lists — it builds the reasoning layer on top: the
> ownership-gated bucket severity model, the offline AKIA→account-ID decode, the
> dependency-confusion two-part confirmation contract, and cloud-native/K8s as an
> org-attribution surface, not just another probe list.
## 0. When to Use / When NOT
**Use this skill when:** you're mapping an authorized target's cloud and supply-chaincontinuous-exposure-monitoring
When your agent uses it
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. Passive OSINT and analysis only -- no new active-intrusion technique. Use when setting up ongoing monitoring for a retainer or MSSP engagement, tuning alert thresholds to avoid fatigue, triaging a finding's lifecycle status, investigating adversary chatter about a brand, building a 'what changed on the perimeter since last week' report, or deciding whether a persisting finding should re-alert.
What it loads into context
Frontmatter
740 tokensAlways available to the agent
SKILL.md
12,572 tokensWhen the skill is activated
Reference documents
1,664 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Authorization & Legal Posture
- 2. Confidence Levels
- 3. Output Format
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. The Monitoring Loop Model
- 7. CTI / Adversary Chatter Monitoring
- 8. Infrastructure Tracking Over Time
- 9. Finding Lifecycle & False-Positive Discipline
- 10. Alert Delivery Reliability
- 11. Scheduler Recipes
- 12. Skill Self-Test
- 13. Changelog
Files
README.mddoc6,952 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytesSKILL.mdcore49,173 bytes
Read SKILL.md
# Continuous Exposure Monitoring — Loop, Diff, Chatter, Lifecycle
> Companion skills: [`osint-methodology`](../osint-methodology/) (the 5-stage pipeline this skill
> loops — see its §7.2 "ongoing weekly diff" profile, which this skill fills in with concrete
> mechanics), [`offensive-osint`](../offensive-osint/) (§29 Threat Intel & IOCs — this skill
> **deepens** that section's advisory/IOC-feed directory with the continuous adversary-chatter
> watch loop and CTI-feed cadence it explicitly lacks; use §29 for indicator enrichment and
> vulnerability-prioritization data sources, this skill for the standing collection loop),
> [`org-attack-surface`](../org-attack-surface/) (the org-first discovery this skill's re-scans
> re-run on a schedule), [`exposure-risk-quantification`](../exposure-risk-quantification/) (reads
> this skill's finding-lifecycle suppression state to compute `risk_trend` and the FAIR score — see
> its risk-score model). This skill answers a different question than all four: not "what does the
> target expose right now," but **"is what the target exposes changing, and should anyone be told."**
email-domain-security
When your agent uses it
Rigorous, defensible email-spoofability verdict and SPF supply-chain risk analysis computed from published DNS alone. Deepens the record-level SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC fetch recipes in the offensive-osint arsenal (§16.14) with the reasoning that section doesn't do: a priority-ordered composite verdict for whether an attacker can actually land header-From-spoofed mail in an inbox, and by which vector (exact-domain vs subdomain) — grounded in the single most-misunderstood distinction in email security: the envelope MAIL FROM that SPF authenticates vs the visible header From: that only DMARC governs. Explains precisely why SPF -all/~all alone is NOT spoof-proof without DMARC enforcement, and why SPF +all bypasses DMARC even under p=reject pct=100. Covers RFC 7208 §4.6.4's 10-DNS-lookup / 2-void-lookup PermError fail-open condition with a runnable stdlib-only lookup-counter script, plus the SPF-include-takeover supply-chain vector (an attacker re-registering a dead include inherits SPF-pass authority over the victim domain) with strict transient-vs-NXDOMAIN discrimination discipline so a temporary SERVFAIL is never mistaken for a takeover lead. Fully passive: DNS TXT reads only, no mail sent, no RCPT TO probe, no API keys. Use when auditing a domain's real spoofing resistance (not just its published records), explaining to a client why 'we have SPF -all' does not mean they're covered, investigating an SPF PermError or an unusually long include chain, evaluating a dead SPF include as a takeover lead, or writing a defensible spoofability finding for a deliverable.
What it loads into context
Frontmatter
570 tokensAlways available to the agent
SKILL.md
11,697 tokensWhen the skill is activated
Reference documents
1,466 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Scope & Authorization Posture
- 2. Confidence Levels
- 3. Output Format
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. The Mental Model — Envelope vs Header (read this first)
- 7. The Composite Spoofability Verdict — Priority-Ordered Decision Tree
- 8. SPF Supply-Chain Analysis (RFC 7208 §4.6.4)
- 9. Recipes — Fetching the Records
- 10. Runnable Helper — SPF Lookup Counter
- 11. Severity Mapping & Business-Language Risk Translation
- 12. Worked Examples
- 13. Anti-Patterns & Common Misreadings
- 14. Active-Verification Boundary
- 15. Skill Self-Test
- 16. Changelog
Files
README.mddoc6,028 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytesSKILL.mdcore47,075 bytes
Read SKILL.md
# Email Domain Security — Spoofability Verdict & SPF Supply-Chain Analysis
> Companion skills: **`offensive-osint` §16.14** (raw record-fetch recipes — dig/PowerShell one-liners for SPF/DMARC/DKIM/BIMI/MTA-STS/TLS-RPT/DNSSEC/CAA, the MX→IdP inference table, the DMARC reporting-vendor table). **`osint-methodology`** (confidence levels, output format, severity rubric this skill inherits). Fetch the records with §16.14 first; bring the raw TXT text here for the verdict. This skill does not re-list what a record *is* — it reasons about what a domain's *combination* of records actually lets an attacker do.
## 0. When to Use / When NOT
**Use this skill when:**
- Asked to audit spoof feasibility, produce an email-spoofability verdict, or explain "is domain X spoofable."
- You already have raw SPF/DMARC TXT text (via `offensive-osint` §16.14 or your own `dig`) and need the *verdict*, not just the record dump.
- Investigating an SPF PermError, a long or unusual include chain, or a dead `include:` target.
- Writing a client-facing finding that has to survive the pushback "we have SPF `-all`, why is this flagged?"
- Reasoning about DMARC subdomain policy inheritance, `pct=` partial enforcement, or duplicate-record handling.
exposure-risk-quantification
When your agent uses it
FAIR-aligned exposure quantification: turns a pile of recon findings into a defensible 0-100 + A-F org risk score (Likelihood x Impact, three ownership-aware factors: exposure/threat/impact), an ownership + proof demotion cap so unproven or weakly-owned findings can't inflate the number, a $-denominated FAIR loss-magnitude estimate (IBM/Ponemon per-record cost bands, cross-source record dedup, threat-factor annualization), attack-path amplification (curated red-team chain catalog + generic graph-walk engine, with a kill-chain vs shared-fate honesty gate), and a board-ready one-pager deliverable (hero $ + letter grade + top-3 findings + top attack path + the ask). Extends osint-methodology's severity rubric and client deliverable templates with quantification. Passive analysis only -- operates on findings already collected, no target traffic, no API keys. Use when asked to score risk, quantify exposure, estimate breach cost, build a board report, translate technical findings to dollars, or explain why a grade or dollar figure came out the way it did.
What it loads into context
Frontmatter
520 tokensAlways available to the agent
SKILL.md
10,962 tokensWhen the skill is activated
Reference documents
1,174 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Posture: Passive Analysis, Not New Recon
- 2. Confidence Levels
- 3. Output Format
- 4. Source Hygiene & Assumption Disclosure
- 5. Do NOT
- 6. FAIR Primer — Mapping Recon Findings onto Risk = LEF × LM
- 7. The 0–100 + A–F Score
- 8. The $-Loss Model
- 9. Attack-Path Amplification — How Chains Raise Likelihood
- 10. The Board Deliverable
- 11. Risk Translation Table — Extending `osint-methodology` §16
- 12. Honesty Guardrails & Anti-Patterns
- 13. Skill Self-Test
- 14. Changelog
Files
README.mddoc4,670 bytesSKILL.mdcore41,746 bytesSKILL.mdcore41,746 bytesSKILL.mdcore41,746 bytesSKILL.mdcore41,746 bytesSKILL.mdcore41,746 bytesSKILL.mdcore41,746 bytesSKILL.mdcore41,746 bytes
Read SKILL.md
# Exposure Risk Quantification — FAIR Scoring, $-Loss, and the Board Deliverable
> Companion skill: `osint-methodology` (the "how to think" recon skill — see its §9 severity
> rubric and §16 client deliverable templates). This skill is the "how to quantify and
> present" layer on top of a finished recon pass: it takes findings the methodology skill's
> pipeline already produced and turns them into a number a board will act on.
## 0. When to Use / When NOT
**Use this skill when:** you have a completed set of recon findings (from any engagement,
not just one tool's output) and need to (a) compute a defensible 0–100 + A–F risk score,
(b) estimate a $-denominated loss range, (c) rank attack-path chains by exploitability, or
(d) assemble a board/exec one-pager. Also use it to *explain* a score — "why did this grade
come out D and not F" is exactly what §7 is for.identity-provider-recon
When your agent uses it
Organization-grade identity-fabric mapping: tenant/federation fingerprinting and the pre-auth user-ENUMERATION oracle methodology — enumeration and fingerprint only, never credential submission. Covers domain-to-tenant resolution (Microsoft getuserrealm.srf Managed/Federated namespace check, Entra OIDC metadata tenant-GUID extraction, Autodiscover v2), keyless Microsoft tenant-federation mapping (GetFederationInformation SOAP -> sibling-domain discovery, discover-only ROE, FEDERATED_WITH provenance edge held out of attack-path pivoting), Okta org-slug derivation + OIDC fingerprint + governed custom-domain enumeration, ADFS passive/active fingerprint + version inference, Google Workspace MX-correlated detection, generic OIDC (Auth0/Keycloak/Ping Identity/OneLogin/Duo) discovery, SAML metadata (5 paths), Azure AD Seamless-SSO Negotiate-challenge detection, Microsoft Defender for Identity (MDI) sensor-API presence check, the user-enumeration oracle methodology for Microsoft GetCredentialType (IfExistsResult semantics: exists / doesn't-exist / exists-in-federated-tenant / throttled) and Okta /api/v1/authn (errorCode differential), Medium-detectability discipline with a hard 20-candidate-per-tenant cap and admin/role interest-based ranking, and name x confirmed-email-pattern login-candidate synthesis that FAILS CLOSED with zero output when no org pattern is confirmed. Grounded directly in a production ASM implementation's sso_idp.py, tenant_recon.py, and core/email_patterns.py modules. Deepens — does not duplicate — offensive-osint skill's Identity Fabric endpoint reference with the tenant-federation MAP, the oracle WORKFLOW, and the candidate-SYNTHESIS methodology that reference lacks. Use when fingerprinting an organization's identity provider, mapping its tenant/federation boundary, running an authorized pre-auth user-enumeration pass, or synthesizing login candidates from harvested names to feed that oracle — never for password spray, credential submission, or auth bypass.
What it loads into context
Frontmatter
801 tokensAlways available to the agent
SKILL.md
14,293 tokensWhen the skill is activated
Reference documents
1,933 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Authorization & Legal Posture
- 2. Confidence Levels
- 3. Output Format
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. The Identity-Fabric Map — Mental Model
- 7. Domain → Tenant Resolution
- 8. Federation Mapping — the Tenant Boundary
- 9. IdP Fingerprint — Distinguishing Signals at a Glance
- 10. Seamless-SSO & MDI Presence Detection
- 11. The User-Enumeration Oracle Methodology
- 12. Name x Pattern Login-Candidate Synthesis
- 13. End-to-End Workflow
- 14. The Hard Boundary — Enumeration Ends Here
- 15. Anti-Patterns & Common Failure Modes
- 16. Skill Self-Test
- 17. Changelog
Files
README.mddoc8,060 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytesSKILL.mdcore58,414 bytes
Read SKILL.md
# Identity-Provider Recon — Tenant, Federation & User-Enumeration Oracle Mapping
> Companion skills: [`osint-methodology`](../osint-methodology/) (§6.2 detectability tagging, §11
> identity-fabric pointer — the "how to think" skill this plugs into) and
> [`offensive-osint`](../offensive-osint/) (§22 Identity Fabric — the concrete endpoint/payload
> reference this skill builds a workflow on top of, rather than re-listing). This skill answers the
> question those two don't: **how do the tenant, its federation partners, its IdP, and its
> user-enumeration oracle fit together as one map** — and where exactly enumeration stops and
> credential submission begins.
## 0. When to Use / When NOT
**Use this skill when:**
offensive-osint
When your agent uses it
Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud bucket permutations, JS guess-paths, vendor product fingerprints for Citrix/F5/Pulse/Fortinet/Cisco/PaloAlto/VMware/Exchange, cloud-native service fingerprints, container/K8s exposure paths, CI/CD platform paths, documentation/wiki leak paths, WHOIS/RDAP, DNS record catalog, Wayback CDX recipes), 80-pattern secret-regex catalog (incl. modern AI API keys: Anthropic/OpenAI/HuggingFace/Cloudflare/DigitalOcean/npm/PyPI/Docker Hub/Atlassian/DataDog/Sentry/ngrok; plus a provider-expansion tier: Postman PMAK/GitLab/Square/Shopify/Mailchimp/PagerDuty/Asana/Databricks/Grafana/Terraform Cloud/Fastly/Algolia/Segment/Airtable/GCP+Google OAuth/Azure AD/Facebook OAuth/RubyGems/JFrog/Okta/Slack app-level/Dropbox/Doppler/HashiCorp Vault/Firebase Cloud Messaging), 80+ dork corpus across 9 categories, GitHub code-search dorks, copy-paste curl/httpie probes for every check, post-discovery enumeration workflows (AWS/GitHub/Slack/JWT/PMAK/Anthropic/OpenAI), endpoint interest scoring rubric (0–100), mobile app ownership confidence + APK static-analysis pipeline (acquisition, apktool/aapt2/jadx/androguard decompile, manifest exported-component/deep-link/misconfig extraction, Firebase config, network-security-config, embedded-secret scan), identity-fabric endpoints (Entra/Okta/ADFS/Google/SAML/M365 Teams+SharePoint+OneDrive+OAuth + user-enum), GraphQL field-suggestion enumeration when introspection disabled, 9 read-only secret validators (Postman/AWS/GitHub/Slack/Anthropic/OpenAI/npm/Atlassian/DataDog), Postman workspace search (verified endpoint), Stack Exchange sweep, public SaaS dorks, email security analysis (SPF/DMARC/DKIM/BIMI/MTA-STS/DNSSEC), origin-discovery / CDN bypass techniques, TLS deep audit (sslyze/testssl.sh/JA3/JA4), reverse-DNS sweep + IPv6 enum, vulnerability prioritization data sources (NVD/EPSS/CISA KEV/ExploitDB/Metasploit), 27 attack-path hint templates, 80+ severity-matrix examples, LinkedIn employee enumeration, job posting tech-stack analysis, Slack/Discord workspace discovery, package registry leak hunting (npm/PyPI/Docker Hub/Quay/GHCR), sat imagery for physical recon, tooling quick-install one-liners, sector-specific recon notes (healthcare/finance/ICS-SCADA/IoT/government), runnable stdlib-only secret_scan.py helper, plus the existing tool references for username/email/phone/people/social/breach/infrastructure/crypto/media/geospatial/AI/archiving/automation. Use when you need concrete probe paths, regexes, payloads, scoring rules, curl one-liners, and tool URLs for an authorized external recon engagement.
What it loads into context
Frontmatter
1,488 tokensAlways available to the agent
SKILL.md
67,201 tokensWhen the skill is activated
Reference documents
1,520 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to use / When NOT
- 1. Authorization & Legal Posture
- 2. Confidence Levels
- 3. Output Format Conventions
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. General OSINT (curated tool refs)
- 7. Search Engines
- 8. Username & Email Investigation
- 9. People Search
- 10. Phone Number OSINT
- 11. Email-Pattern Inference (TENTATIVE candidates)
- 12. Email-Harvest Source Stack
- 13. Social Media
- 14. Public Records & Company Information
- 15. Breach & Leak Data
- 16. Pre-built Wordlists & Probe Paths
- 17. Secret-Pattern Catalog — 80 patterns (29 base + 19 modern + 32 provider expansion)
- 18. Dork Corpus — 80+ templates, 9 categories
- 19. GitHub Code-Search Dorks for Targets — 13 dorks
- 20. Endpoint Interest Score — 0–100 rubric
- 21. Mobile App Ownership Confidence — 0–100 rubric
- 22. Identity Fabric — Concrete Endpoints
- 23. Read-Only Secret Validators
- 24. Postman Public Workspace Universal Search
- 25. Stack Exchange OSINT Sweep
- 26. Public SaaS Collaboration Surfaces
- 27. Subdomain-Source Stack (Passive)
- 28. Infrastructure & Attack-Surface OSINT
- 29. Threat Intel & IOCs
- 30. Cryptocurrency OSINT
- 31. Media Intelligence
- 32. Geospatial Intelligence
- 33. AI-Assisted OSINT
- 34. Archiving & Evidence Preservation
- 35. Automation & Workflows
- 36. Cross-Module Sidecar Coordination
- 37. Regional Search Engines
- 38. Telegram & Messaging Intelligence
- 39. Attack-Path Hint Patterns
- 40. Severity Decision Matrix — Worked Examples
- 41. LinkedIn Employee Enumeration
- 42. Job Posting Tech-Stack Analysis
- 43. Slack / Discord / Telegram Workspace Discovery
- 44. Package Registry Leak Hunting
- 45. Sat Imagery for Physical Recon
- 46. Tooling Quick-Install
- 47. Sector-Specific Recon Notes
- 48. Runnable Helper — `secret_scan.py`
- 49. Skill Self-Test
- 50. Changelog
Scripts executed separately
scripts/h1_reference.pyscripts/secret_scan.py
Files
README.mddoc5,799 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesSKILL.mdcore232,735 bytesscripts/h1_reference.pyruns12,938 bytesscripts/secret_scan.pyruns12,538 bytes
Read SKILL.md
# Offensive OSINT — External Red-Team Arsenal
> Companion skill: `osint-methodology` (the "how to think" skill). This skill is the "what to reach for." Use them together.
## 0. When to use / When NOT
**Use this skill when:**
- You need concrete probe paths, wordlists, regexes, payloads, scoring rules, or tool URLs.
- You're executing reconnaissance and need the actual technical reference (vs. methodology).
- You're building a recon automation and need specific lists to seed it.
**Do NOT use this skill when:**
org-attack-surface
When your agent uses it
Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint — corporate family -> owned domains -> owned netblocks/ASN -> live assets — with attribution discipline, not just DNS breadth. The org-first attribution pyramid (legal entity -> LEI/registration -> corporate family -> owned domains -> owned netblocks/ASN -> live assets). Corporate-identity resolution via the GLEIF LEI API (legal name -> LEI, exact-LEI direct-children expansion, downward-only depth-capped BFS, NEVER a name re-resolution), SEC-EDGAR full-text search + Exhibit-21 subsidiary entity names, OpenCorporates entity corroboration, Wikidata SPARQL corporate graph (P856/P355/P749/P1830). Domain attribution via reverse-WHOIS (WhoisXML preview-then-purchase quota guard, SecurityTrails associated-domains — both paid), crt.sh O= certificate-transparency organization pivot (keyless), infrastructure correlation (shared NS/MX/SaaS-TXT, netblock membership, reverse-DNS PTR), and the independent-evidence combiner (1-prod(1-w_i), rule of three, OwnerTier NONE/WEAK/MODERATE/STRONG/CONFIRMED) — discover-only `related:` candidates are NEVER auto-scanned. Netblock/ASN attribution via org-first RIR queries (ARIN Whois-RWS org-handle search, RIPE DB organisation + inverse-org search) that recover 'dark netblocks' with no DNS link to the seed, ASN discovery (RIPEstat + BGPView union), the HYPERSCALER-SCOPE GUARD (never attribute a whole AWS/GCP/Azure/Cloudflare announced range to a tenant — keep only the seed-containing block, tag shared_hosting_cdn), and org-identity-seeded internet-scan-index queries (Shodan/Censys/ZoomEye/FOFA/BinaryEdge org: filters + an always-on keyless crt.sh fallback). Promote-to-scan triage ranks forgotten discover-only netblocks by remote-access exposure (gateway-vendor/KEV/control-plane/datastore port scoring) into an operator queue. Attribution confidence rubric + anti-patterns (namesake grafting via GLEIF name re-resolution, single-signal ownership, hyperscaler over-attribution, privacy-WHOIS pivot poisoning, RIR org-name collisions). Passive/keyless-first OSINT only — every paid-key dependency is enrichment on top of a keyless core, never a hard requirement. Use when mapping an organization's full corporate-family internet footprint, resolving a legal entity to its LEI/subsidiaries, discovering domains/netblocks/ASNs an org owns beyond its one seed domain, auditing M&A/shadow-IT sprawl, or scoping an engagement that starts from a company NAME rather than a domain.
What it loads into context
Frontmatter
1,028 tokensAlways available to the agent
SKILL.md
16,357 tokensWhen the skill is activated
Reference documents
1,597 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Authorization & Legal Posture
- 2. Confidence Levels & Ownership Tiers (two axes — do not conflate them)
- 3. Output Format
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. The Org-First Attribution Pyramid
- 7. Corporate Identity Resolution
- 8. Domain Attribution
- 9. Netblock & ASN Attribution
- 10. Promote-to-Scan Triage
- 11. Attribution Confidence Rubric & Anti-Patterns
- 12. End-to-End Workflow
- 13. Skill Self-Test
- 14. Changelog
Files
README.mddoc6,094 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytesSKILL.mdcore64,123 bytes
Read SKILL.md
# Org Attack Surface — Corporate-Family Footprint Mapping
> Companion skills: [`osint-methodology`](../osint-methodology/) (the "how to think" 5-stage recon
> pipeline this plugs into) and [`offensive-osint`](../offensive-osint/) (the per-host arsenal you run
> once this skill hands you owned domains/netblocks — see its §14 Public Records and §28 Infrastructure
> OSINT for the tool directory this skill deepens rather than duplicates). This skill answers a
> different, upstream question: **not** "what does `acme.com` expose", but "what does **Acme
> Corporation, the legal entity**, own across every domain, netblock, and subsidiary it has — including
> the parts with no DNS trail back to the seed at all."
## 0. When to Use / When NOT
**Use this skill when:**
osint-autopilot
When your agent uses it
End-to-end external OSINT engagement autopilot. Run the FULL osint-methodology pipeline to completion in ONE go for an authorized domain — engagement folder, Stages 1-5 (seed, expansion, enrichment, exposure, convergence), multi-agent per-host content+JS fan-out, headline verification, auto-generated findings, and a consolidated multi-tab .xlsx deliverable. Stops ONLY for Stage 6 (active exploitation) arming and out-of-scope sibling assets. Use whenever asked to "run OSINT / recon / attack-surface" on a target — do NOT deliver a thin passive first pass.
What it loads into context
Frontmatter
208 tokensAlways available to the agent
SKILL.md
1,452 tokensWhen the skill is activated
Reference documents
1,365 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Hard gates (the ONLY reasons to stop and ask)
- Run sequence
- Deliverable
- Time budget
- Scale note
Scripts executed separately
scripts/build_xlsx.pyscripts/findings_gen.pyscripts/host_enum.workflow.jsscripts/recon_pipeline.shscripts/test_domain_guard.sh
Files
README.mddoc5,403 bytesSKILL.mdcore5,665 bytesSKILL.mdcore5,665 bytesSKILL.mdcore5,665 bytesSKILL.mdcore5,665 bytesscripts/build_xlsx.pyruns5,420 bytesscripts/findings_gen.pyruns10,108 bytesscripts/host_enum.workflow.jsruns3,980 bytesscripts/recon_pipeline.shruns9,111 bytesscripts/requirements.txtdoc9 bytesscripts/test_domain_guard.shruns1,553 bytesscripts/wordlist.txtdoc1,005 bytes
Read SKILL.md
# OSINT Autopilot
Purpose: eliminate the "thin first pass, then user pushes for more" failure. When the user says *run OSINT/recon on `<domain>`* (authorized), execute the whole pipeline to completion and hand back the consolidated workbook — no stopping to ask except the two hard gates below.
Read the companion `osint-methodology` skill for the framework; this skill is the executable runbook. Feedback memory `osint-full-pipeline-default` governs the default.
## Hard gates (the ONLY reasons to stop and ask)
1. **Authorization** — if not already asserted, ask the one scope question, then proceed. (Here it's typically already signed.)
2. **Stage 6 (active exploitation)** — BOLA/IDOR, credential replay, injection confirmation. Never run under autopilot; present the ranked target queue and wait for arming.
3. **Out-of-scope siblings** — a newly-discovered sibling domain/brand (e.g. `<company>.io` when scope was `.com`). Flag; don't scan until confirmed.
Everything in Stages 1–5 runs without pausing for questions.
osint-methodology
When your agent uses it
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → asset expansion → enrichment → exposure analysis → convergence → operator-armed active validation) with connector-resilience and stage-vs-gating discipline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation with per-person identity dossiers, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables.
What it loads into context
Frontmatter
460 tokensAlways available to the agent
SKILL.md
8,681 tokensWhen the skill is activated
Reference documents
897 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- 0. When to Use / When NOT
- 1. Authorization & Legal Posture
- 2. Confidence Levels
- 3. Output Format
- 4. Source Hygiene & Citations
- 5. Do NOT
- 6. OpSec
- 7. External Red-Team Recon Pipeline
- 8. Asset Graph Discipline
- 9. Findings Rubric & Severity Mapping
- 10. Pivot Modes & Scale Tactics
- 11. Implementation: Companion Skill Pointers
- 12. Breach × Identity Correlation
- 13. Specialty OSINT Domains
- 14. Anti-Patterns & Common Failure Modes
- 15. Bug Bounty Submission & Responsible Disclosure
- 16. Client Deliverable Templates
- 17. Skill Self-Test
- 18. Changelog
Files
README.mddoc3,568 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytesSKILL.mdcore35,200 bytes
Read SKILL.md
# OSINT Methodology — External Red-Team Edition
## 0. When to Use / When NOT
**Use this skill when:** planning or executing authorized external recon (red team, bug bounty, ASM); mapping an org's attack surface; investigating a person/entity/threat-actor; producing client deliverables.
**Do NOT use this skill when:** the user needs active exploitation, post-exploitation, or malware dev; blue-team/detection content; or the target's authorization is unclear — surface the scope question first.
---
## 1. Authorization & Legal Posture
Intended for assets the operator owns or has **written authorization** to assess.
Skills included
- cloud-saas-exposure
- continuous-exposure-monitoring
- email-domain-security
- exposure-risk-quantification
- identity-provider-recon
- offensive-osint
- org-attack-surface
- osint-autopilot
- osint-methodology
Repository facts
- License
- MIT
- Created
- Apr 26, 2026
- Last pushed
- Oct 20, 2026
- Forks
- 541
- Open issues
- 0
- Project activity
- Active
Rank over the last 12 weeks
Now #413 · best #348 · down 45 in 30 days
- #406 from Oct 30 to Nov 1
- #407 on Nov 2
- #408 on Nov 3
- #409 on Nov 4
- #412 from Nov 5 to Nov 6
- #413 since Nov 7
79 earlier periods
- #341 on Aug 2
- #343 on Aug 7
- #345 on Aug 8
- #342 on Aug 9
- #356 on Aug 10
- #354 on Aug 11
- #348 on Aug 12
- #353 on Aug 13
- #351 on Aug 14
- #350 on Aug 15
- #356 on Aug 16
- #354 on Aug 17
- #360 on Aug 18
- #356 on Aug 19
- #358 on Aug 20
- #357 on Aug 21
- #353 on Aug 22
- #360 on Aug 23
- #362 on Aug 24
- #360 on Aug 25
- #364 on Aug 26
- #365 on Aug 27
- #367 on Aug 28
- #362 on Aug 29
- #356 on Aug 30
- #359 from Aug 31 to Sep 1
- #352 on Sep 2
- #355 on Sep 3
- #348 on Sep 4
- #352 on Sep 5
- #351 on Sep 6
- #361 on Sep 7
- #357 on Sep 8
- #360 on Sep 9
- #359 on Sep 10
- #354 on Sep 11
- #357 on Sep 12
- #356 on Sep 13
- #358 on Sep 14
- #364 on Sep 15
- #363 on Sep 16
- #360 on Sep 17
- #362 on Sep 18
- #354 on Sep 19
- #367 on Sep 20
- #365 on Sep 21
- #367 on Sep 22
- #362 on Sep 23
- #359 on Sep 24
- #358 on Sep 25
- #353 on Sep 26
- #358 on Sep 27
- #360 on Sep 28
- #370 on Sep 29
- #365 from Sep 30 to Oct 1
- #366 on Oct 2
- #356 on Oct 3
- #354 on Oct 4
- #359 on Oct 5
- #360 on Oct 6
- #365 on Oct 7
- #368 on Oct 8
- #375 on Oct 9
- #363 on Oct 10
- #366 on Oct 11
- #373 on Oct 12
- #377 on Oct 13
- #380 on Oct 14
- #377 on Oct 15
- #383 on Oct 16
- #382 on Oct 18
- #384 on Oct 19
- #387 on Oct 20
- #386 from Oct 21 to Oct 22
- #384 on Oct 23
- #379 on Oct 24
- #397 on Oct 25
- #404 on Oct 28
- #405 on Oct 29
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 2, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 287 notes
skills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/cloud-saas-exposure/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/continuous-exposure-monitoring/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/continuous-exposure-monitoring/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/continuous-exposure-monitoring/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/continuous-exposure-monitoring/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/continuous-exposure-monitoring/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/continuous-exposure-monitoring/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 4 dangerous shell commandsin 3 files: offensive-osint/SKILL.md:3287 osint-autopilot/scripts/test_domain_guard.sh:8 osint-methodology/SKILL.md:302
- 875 network referencesin 14 files: offensive-osint/SKILL.md:1 org-attack-surface/SKILL.md:320 identity-provider-recon/SKILL.md:284 and 11 more
- No hidden or obfuscated text
- 8 instruction override signalsin 2 files: identity-provider-recon/SKILL.md:214 identity-provider-recon/README.md:65
- 7 executable scriptsin 7 files: offensive-osint/scripts/h1_reference.py:1 offensive-osint/scripts/secret_scan.py:1 osint-autopilot/scripts/build_xlsx.py:1 and 4 more
- 54 references to secretsin 8 files: offensive-osint/SKILL.md:823 offensive-osint/scripts/secret_scan.py:36 org-attack-surface/SKILL.md:539 and 5 more
- No requests to vote in Hot
Show all 948 signals by file
skills/cloud-saas-exposure/README.md
- Network accessline 83
`offensive-osint` §16.8 (bucket permutation raw lists), §16.17 (cloud-native URL patterns), §16.18–§16.19 (container/K8s/CI paths + active probe recipes), and §44 (package registry search) already carry the wordlists and curl one-liners. Th - Network accessline 84
§16.18–§16.19 (container/K8s/CI paths + active probe recipes), and §44 (package registry search) already carry the wordlists and curl one-liners. This skill is the reasoning layer on top: which bucket hit is actually the client's risk, how - Network accessline 85
search) already carry the wordlists and curl one-liners. This skill is the reasoning layer on
skills/cloud-saas-exposure/SKILL.md
- Network accessline 63
> expansion, Stage 4 exposure analysis, Stage 5 supply-chain confirmation). `offensive-osint` > §16.8 (bucket-permutation raw wordlist), §16.17 (cloud-native URL pattern table), §16.18– > §16.19 (container/K8s/CI paths + active curl recipes - Network accessline 64
> §16.8 (bucket-permutation raw wordlist), §16.17 (cloud-native URL pattern table), §16.18– > §16.19 (container/K8s/CI paths + active curl recipes), §44 (package-registry search). This > skill does not repeat those lists — it builds the rea - Network accessline 65
> §16.19 (container/K8s/CI paths + active curl recipes), §44 (package-registry search). This - Network accessline 232
| Provider | URL | Listing marker (200) | Exists, no listing | Not found | |---|---|---|---|---| | S3 | `GET https://{name}.s3.amazonaws.com/` | `<ListBucketResult` → **LISTABLE** | 200/301/307 (no marker) or 403 → exists (403 = private; pa - Network accessline 233
|---|---|---|---|---| | S3 | `GET https://{name}.s3.amazonaws.com/` | `<ListBucketResult` → **LISTABLE** | 200/301/307 (no marker) or 403 → exists (403 = private; parse `<Code>` for the deny reason) | `NoSuchBucket` (404) → absent | | GCS | - Network accessline 234
| S3 | `GET https://{name}.s3.amazonaws.com/` | `<ListBucketResult` → **LISTABLE** | 200/301/307 (no marker) or 403 → exists (403 = private; parse `<Code>` for the deny reason) | `NoSuchBucket` (404) → absent | - Network accessline 235
| GCS | `GET https://storage.googleapis.com/{name}` | `<ListBucketResult` → **LISTABLE** | 403 → exists, private | 404 → absent | - Network accessline 236
| Azure Blob | `GET https://{name}.blob.core.windows.net/?comp=list` | `<EnumerationResults` → **LISTABLE** | 400/403 → account exists, private | 404 → absent | - Network accessline 313
NAME="acme-backup" for url in \ "https://${NAME}.s3.amazonaws.com/" \ - Network accessline 314
for url in "https://${NAME}.s3.amazonaws.com/" - Network accessline 315
"https://${NAME}.s3.amazonaws.com/" \ - Network accessline 316
"https://storage.googleapis.com/${NAME}" \ - Network accessline 317
"https://${NAME}.blob.core.windows.net/?comp=list"; do echo "== $url ==" curl -sk -m 8 -o /tmp/body.xml -w 'status=%{http_code}\n' "$url" - Network accessline 318
echo "== $url ==" curl -sk -m 8 -o /tmp/body.xml -w 'status=%{http_code}\n' "$url" grep -oE '<(ListBucketResult|EnumerationResults)|<Key>[^<]+</Key>|<Code>[A-Za-z]+</Code>' /tmp/body.xml | head -20 - Network accessline 319
curl -sk -m 8 -o /tmp/body.xml -w 'status=%{http_code}\n' "$url" - Network accessline 327
$Name = "acme-backup" $Targets = @( "https://$Name.s3.amazonaws.com/", - Network accessline 328
$Targets = @( "https://$Name.s3.amazonaws.com/", "https://storage.googleapis.com/$Name", - Network accessline 329
"https://$Name.s3.amazonaws.com/", - Network accessline 330
"https://storage.googleapis.com/$Name", - Network accessline 331
"https://$Name.blob.core.windows.net/?comp=list" - Network accessline 423
Published by Aidan Steele / Tenable; reference implementation credit to A. Frichetten ([hackingthe.cloud](https://hackingthe.cloud/aws/enumeration/account_id_from_keys/)). - Network accessline 424
([hackingthe.cloud](https://hackingthe.cloud/aws/enumeration/account_id_from_keys/)). - Network accessline 603
GET https://www.npmjs.com/org/{scope} -> 200 = scope owned as an org - Network accessline 604
GET https://www.npmjs.com/~{scope} -> 200 = scope owned as a user - Network accessline 628
# unscoped npm curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://registry.npmjs.org/acme-internal-utils" - Network accessline 629
curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://registry.npmjs.org/acme-internal-utils" - Network accessline 630
# scoped npm -- package + both scope-ownership pages curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://registry.npmjs.org/@acme%2Fdesign-system" curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://www.npmjs.com/org/acme" - Network accessline 631
curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://registry.npmjs.org/@acme%2Fdesign-system" - Network accessline 632
curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://www.npmjs.com/org/acme" - Network accessline 633
curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://www.npmjs.com/~acme" - Network accessline 635
curl -sk -m 15 -o /dev/null -w '%{http_code}\n' "https://pypi.org/pypi/acme-internal-tools/json" - Network accessline 646
} catch { return "error" } } Test-RegistryStatus "https://registry.npmjs.org/acme-internal-utils" - Network accessline 647
} Test-RegistryStatus "https://registry.npmjs.org/acme-internal-utils" Test-RegistryStatus "https://www.npmjs.com/org/acme" - Network accessline 648
Test-RegistryStatus "https://registry.npmjs.org/acme-internal-utils" - Network accessline 649
Test-RegistryStatus "https://www.npmjs.com/org/acme" - Network accessline 650
Test-RegistryStatus "https://www.npmjs.com/~acme" - Network accessline 651
Test-RegistryStatus "https://pypi.org/pypi/acme-internal-tools/json" - Network accessline 675
network calls of this skill's own. `offensive-osint` §16.17–§16.19 carries the fuller URL-pattern and active-probe tables (20 cloud-native providers, the full container-registry search list, 11 CI/CD platforms with active curl recipes); thi - Network accessline 676
URL-pattern and active-probe tables (20 cloud-native providers, the full container-registry search list, 11 CI/CD platforms with active curl recipes); this section is the reasoning layer that decides what a hit is *worth* and whether it's t - Network accessline 677
search list, 11 CI/CD platforms with active curl recipes); this section is the reasoning - Network accessline 732
(`offensive-osint` §16.18 has the fuller table — kube-proxy/controller-manager/scheduler health/metrics endpoints, cAdvisor, Helm Tiller — plus the active curl recipe for each and - Network accessline 733
health/metrics endpoints, cAdvisor, Helm Tiller — plus the active curl recipe for each and
skills/continuous-exposure-monitoring/SKILL.md
- Network accessline 319
| Source | Kind | Endpoint | Cadence | Key | |---|---|---|---|---| | `ransomwatch` | leak_site | `https://raw.githubusercontent.com/joshhighet/ransomwatch/main/posts.json` | 300s (5 min) | none | - Network accessline 320
|---|---|---|---|---| | `ransomwatch` | leak_site | `https://raw.githubusercontent.com/joshhighet/ransomwatch/main/posts.json` | 300s (5 min) | none | | `ransomware_live` | leak_site | `https://api.ransomware.live/v2/recentvictims` | 300s | - Network accessline 321
| `ransomwatch` | leak_site | `https://raw.githubusercontent.com/joshhighet/ransomwatch/main/posts.json` | 300s (5 min) | none | - Network accessline 322
| `ransomware_live` | leak_site | `https://api.ransomware.live/v2/recentvictims` | 300s | none | - Network accessline 323
| `hackernews` | forum | `https://hn.algolia.com/api/v1/search` (Algolia HN search) | 600s (10 min) | none | - Network accessline 324
| `reddit` | forum | `https://www.reddit.com/r/<sub>/.rss` across `cybersecurity`, `netsec`, `InfoSecNews`, `blueteamsec`, `Pwned`, `AskNetsec`, `sysadmin` | 600s | none | - Network accessline 325
| `paste:gist` | paste | `https://api.github.com/search/code` (filtered to `gist.github.com` results) | 900s (15 min) | `GITHUB_TOKEN` | - Network accessline 326
| `telegram` | telegram | `https://t.me/s/<channel>` public web preview | 1800s (30 min) | none, but needs channels configured under `market_intel.telegram.channels` (seed with `asm-cli breach discover --kind telegram`) | - Network accessline 453
asm-cli chatter watch --webhook https://hooks.slack.com/services/XXX/YYY/ZZZ \ - Network accessline 458
asm-cli chatter watch --webhook https://hooks.slack.com/services/XXX/YYY/ZZZ `
skills/exposure-risk-quantification/SKILL.md
- Access to secretsline 278
[Credential-related source omitted]
skills/identity-provider-recon/README.md
- Instruction override signalline 65
called out explicitly between the passive and active halves. - **§14 — The hard boundary.** A dedicated section enumerating exactly what's OUT of scope: password spray, credential submission, token forge/replay, auth-bypass confirmation — - Instruction override signalline 67
spray, credential submission, token forge/replay, auth-bypass confirmation — and a mature ASM - Instruction override signalline 86
Password spray, credential replay, token forgery, and auth-bypass confirmation are explicitly
skills/identity-provider-recon/SKILL.md
- Instruction override signalline 214
return nothing rather than spray 8 unverified permutations per name at a live oracle. - Do NOT run §11 (the active oracle) without the sharper authorization posture in §1. - Do NOT proceed past §11 into password spray, credential replay, or - Instruction override signalline 215
- Do NOT run §11 (the active oracle) without the sharper authorization posture in §1. - Do NOT proceed past §11 into password spray, credential replay, or auth-bypass confirmation — that is explicitly out of scope everywhere in this skill - Instruction override signalline 216
- Do NOT proceed past §11 into password spray, credential replay, or auth-bypass confirmation — that - Network accessline 284
GET https://login.microsoftonline.com/getuserrealm.srf?login={probe-user}@{domain}&xml=1 - Network accessline 292
D="target.example"; U="admin" curl -sk -m 15 "https://login.microsoftonline.com/getuserrealm.srf?login=${U}@${D}&xml=1" - Network accessline 293
curl -sk -m 15 "https://login.microsoftonline.com/getuserrealm.srf?login=${U}@${D}&xml=1" - Network accessline 297
$D = "target.example"; $U = "admin" Invoke-RestMethod -Uri "https://login.microsoftonline.com/getuserrealm.srf?login=$U@$D&xml=1" - Network accessline 298
Invoke-RestMethod -Uri "https://login.microsoftonline.com/getuserrealm.srf?login=$U@$D&xml=1" - Network accessline 317
GET https://login.microsoftonline.com/{domain}/.well-known/openid-configuration - Network accessline 334
GET https://autodiscover-s.outlook.com/autodiscover/autodiscover.json/v1.0/{email}?Protocol=Autodiscoverv1 - Network accessline 366
GET https://{slug}.okta.com/.well-known/openid-configuration - Network accessline 378
GET https://{slug}.okta.com/api/v1/domains - Network accessline 393
GET https://adfs.{domain}/adfs/ls/idpinitiatedsignon.aspx - Network accessline 405
GET https://adfs.{domain}/adfs/services/trust/mex - Network accessline 426
Any MX host containing `aspmx.l.google.com` or `googlemail.com` confirms Google Workspace. Emit the tenant node with `tenant_id = domain` (there is no separate tenant GUID to extract) and `issuer = https://accounts.google.com` for consisten - Network accessline 427
tenant node with `tenant_id = domain` (there is no separate tenant GUID to extract) and `issuer = https://accounts.google.com` for consistency with the other tenant nodes, but be explicit in the evidence block that the corroborating signal - Network accessline 428
`issuer = https://accounts.google.com` for consistency with the other tenant nodes, but be explicit - Network accessline 502
POST https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc - Network accessline 503
SOAPAction: "http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation" - Network accessline 510
<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:exm="http://schemas.microsoft.com/exchange/services/2006/messages" - Network accessline 511
<soap:Envelope xmlns:exm="http://schemas.microsoft.com/exchange/services/2006/messages" - Network accessline 512
xmlns:ext="http://schemas.microsoft.com/exchange/services/2006/types" - Network accessline 513
xmlns:a="http://www.w3.org/2005/08/addressing" - Network accessline 514
xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" - Network accessline 515
xmlns:autodiscover="http://schemas.microsoft.com/exchange/2010/Autodiscover"> - Network accessline 516
<soap:Header> <a:Action soap:mustUnderstand="1">http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation</a:Action> <a:To soap:mustUnderstand="1">https://autodiscover-s.outlook.com/autodiscover/a - Network accessline 517
<a:Action soap:mustUnderstand="1">http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation</a:Action> - Network accessline 518
<a:To soap:mustUnderstand="1">https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc</a:To> - Network accessline 519
<a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo> - Network accessline 532
D="target.example" BODY="<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:a=\"http://www.w3.org/2005/08/addressing\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:autodiscover=\"http://schemas.microsoft.com/ex - Network accessline 533
BODY="<?xml version=\"1.0\" encoding=\"utf-8\"?><soap:Envelope xmlns:a=\"http://www.w3.org/2005/08/addressing\" xmlns:soap=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:autodiscover=\"http://schemas.microsoft.com/exchange/2010/Autodis - Network accessline 534
curl -sk -m 20 -X POST "https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc" \ - Network accessline 535
-H 'Content-Type: text/xml; charset=utf-8' \ -H 'SOAPAction: "http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation"' \ -H 'User-Agent: AutodiscoverClient' \ - Network accessline 536
-H 'SOAPAction: "http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation"' \ - Network accessline 543
$body = @" <?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:autodiscover="http://schemas.microsoft.com/exchange/2010/Autodiscov - Network accessline 544
<?xml version="1.0" encoding="utf-8"?> <soap:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:autodiscover="http://schemas.microsoft.com/exchange/2010/Autodiscover"> <soap: - Network accessline 545
<soap:Envelope xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:autodiscover="http://schemas.microsoft.com/exchange/2010/Autodiscover"> - Network accessline 546
<soap:Header><a:Action soap:mustUnderstand="1">http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation</a:Action> - Network accessline 547
<a:To soap:mustUnderstand="1">https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc</a:To> - Network accessline 548
<a:ReplyTo><a:Address>http://www.w3.org/2005/08/addressing/anonymous</a:Address></a:ReplyTo></soap:Header> - Network accessline 550
<autodiscover:Domain>$D</autodiscover:Domain></autodiscover:Request></autodiscover:GetFederationInformationRequestMessage></soap:Body></soap:Envelope> "@ Invoke-RestMethod -Uri "https://autodiscover-s.outlook.com/autodiscover/autodiscover.s - Network accessline 551
"@ Invoke-RestMethod -Uri "https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc" -Method Post ` -Headers @{ SOAPAction = '"http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation"'; "User- - Network accessline 552
Invoke-RestMethod -Uri "https://autodiscover-s.outlook.com/autodiscover/autodiscover.svc" -Method Post ` - Network accessline 553
-Headers @{ SOAPAction = '"http://schemas.microsoft.com/exchange/2010/Autodiscover/Autodiscover/GetFederationInformation"'; "User-Agent" = "AutodiscoverClient" } ` - Network accessline 642
GET https://autologon.microsoftazuread-sso.com/{domain}/winauth/trust/2005/usernamemixed - Network accessline 646
D="target.example" curl -sk -m 15 -D - -o /dev/null "https://autologon.microsoftazuread-sso.com/${D}/winauth/trust/2005/usernamemixed" - Network accessline 647
curl -sk -m 15 -D - -o /dev/null "https://autologon.microsoftazuread-sso.com/${D}/winauth/trust/2005/usernamemixed" - Network accessline 651
$D = "target.example" try { Invoke-WebRequest -Uri "https://autologon.microsoftazuread-sso.com/$D/winauth/trust/2005/usernamemixed" -UseBasicParsing } - Network accessline 652
try { Invoke-WebRequest -Uri "https://autologon.microsoftazuread-sso.com/$D/winauth/trust/2005/usernamemixed" -UseBasicParsing } - Network accessline 717
POST https://login.microsoftonline.com/common/GetCredentialType - Network accessline 723
curl -sk -m 15 -X POST "https://login.microsoftonline.com/common/GetCredentialType" \ - Network accessline 729
$body = @{ Username = "alice@target.example"; isOtherIdpSupported = $true } | ConvertTo-Json Invoke-RestMethod -Uri "https://login.microsoftonline.com/common/GetCredentialType" -Method Post ` - Network accessline 730
Invoke-RestMethod -Uri "https://login.microsoftonline.com/common/GetCredentialType" -Method Post ` - Network accessline 749
POST https://{org}.okta.com/api/v1/authn - Network accessline 755
curl -sk -m 15 -X POST "https://acme.okta.com/api/v1/authn" \ - Network accessline 761
[Credential-related source omitted] - Network accessline 762
Invoke-RestMethod -Uri "https://acme.okta.com/api/v1/authn" -Method Post -ContentType "application/json" -Body $body - Instruction override signalline 902
- **Token forging or replay** — JWT forgery, SAML golden-ticket construction, Kerberos silver-ticket use against a Seamless-SSO computer account this skill merely *detected* the presence of (§10.1). - **Auth-bypass confirmation** — MFA by - Instruction override signalline 904
- **Auth-bypass confirmation** — MFA bypass, conditional-access bypass, legacy-auth-door exploitation.
skills/offensive-osint/README.md
- Network accessline 26
- `shodan recon`, `censys recon`, `certificate transparency`, `crt.sh`, `JARM`, `favicon mmh3` - `JS endpoint extraction`, `sourcemap leak` - `copy paste probes`, `curl one-liner` - Network accessline 27
- `JS endpoint extraction`, `sourcemap leak` - `copy paste probes`, `curl one-liner` - `email security analysis`, `SPF DMARC DKIM` - Network accessline 28
- `copy paste probes`, `curl one-liner` - Network accessline 56
- **§16 — Pre-built wordlists & probe paths** including 28 Swagger paths, 13 GraphQL paths + introspection POST body, 35 high-risk ports, 6 missing security headers, 15 always-on HTTP checks, 5 SAML metadata paths, 8 SSO subdomain prefixes,
skills/offensive-osint/SKILL.md
- Network accessline 1
--- name: offensive-osint description: "Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks - Network accessline 2
name: offensive-osint description: "Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 - Network accessline 3
description: "Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud buck - Network accessline 62
- sourcemap leak - copy paste probes - curl one-liner - Network accessline 63
- copy paste probes - curl one-liner - email security analysis - Network accessline 64
- curl one-liner - Network accessline 194
- [OSINT Bookmarks](https://tools.myosint.training/) — comprehensive bookmarks. - Network accessline 195
- [OSINT Framework](https://osintframework.com/) — tool/resource directory. - Network accessline 196
- [IntelTechniques Tools](https://inteltechniques.com/tools/) — investigative suite. - Network accessline 197
- [Bellingcat Toolkit](https://www.bellingcat.com/resources/2024/09/24/bellingcat-online-investigations-toolkit/) — investigative journalism. - Network accessline 198
- [CyberSudo OSINT Toolkit](https://docs.google.com/spreadsheets/d/1EC0sKA_W9znzsxUt0wye9UYtyATXw5m8) — OSINT websites list. - Network accessline 199
- [Google Dorks](https://dorksearch.com/) — efficient Google searching. - Network accessline 200
- [Distributed Denial of Secrets](https://ddosecrets.com/) — leaked datasets. - Network accessline 201
- [Country-Specific Resources](https://digitaldigging.org/osint/) — country-targeted OSINT. - Network accessline 205
| Tool | Notes | |------|-------| | [Carrot2](https://search.carrot2.org/#/search/web) | Clusters results by topic | - Network accessline 206
|------|-------| | [Carrot2](https://search.carrot2.org/#/search/web) | Clusters results by topic | | [etools](https://www.etools.ch/) | Metasearch | - Network accessline 207
| [Carrot2](https://search.carrot2.org/#/search/web) | Clusters results by topic | - Network accessline 208
| [etools](https://www.etools.ch/) | Metasearch | - Network accessline 209
| [Kagi](https://kagi.com/) | Privacy-first, non-personalized | - Network accessline 210
| [Brave Search](https://search.brave.com/) | Independent index; Goggles for custom ranking | - Network accessline 211
| [PDF Search](https://www.pdfsearch.io/) | PDF + table of contents | - Network accessline 212
| [Google Fact Check Explorer](https://toolbox.google.com/factcheck/explorer) | Cross-site fact-check | - Network accessline 218
| Tool | Purpose | |------|---------| | [Sherlock](https://github.com/sherlock-project/sherlock) | Username search across social networks | - Network accessline 219
|------|---------| | [Sherlock](https://github.com/sherlock-project/sherlock) | Username search across social networks | | [Maigret](https://github.com/soxoj/maigret) | Profile collector by username | - Network accessline 220
| [Sherlock](https://github.com/sherlock-project/sherlock) | Username search across social networks | - Network accessline 221
| [Maigret](https://github.com/soxoj/maigret) | Profile collector by username | - Network accessline 222
| [What's My Name](https://whatsmyname.app/) | Username search | - Network accessline 223
| [Holehe](https://github.com/megadose/holehe) | Email registration check | - Network accessline 224
| [Epieos](https://epieos.com/) | Email pivots and metadata | - Network accessline 225
| [OSINT Industries](https://osint.industries/) | Email/username/phone lookups | - Network accessline 226
| [Hunter.io](https://hunter.io/) | Domain → emails | - Network accessline 227
| [EmailRep](https://emailrep.io/) | Email reputation | - Network accessline 228
| [Emailable](https://emailable.com/) | Email verification | - Network accessline 229
| [Mugetsu](https://mugetsu.io/) | X/Twitter username history | - Network accessline 230
| [RocketReach](https://rocketreach.co/) / [Apollo](https://www.apollo.io/) | Email enrichment + pattern guessing | - Network accessline 231
| [PhoneInfoga](https://github.com/sundowndev/phoneinfoga) | Phone number intelligence | - Network accessline 233
Browser extensions: [GetProspect](https://chromewebstore.google.com/detail/email-finder-getprospect/bhbcbkonalnjkflmdkdodieehnmmeknp), [SignalHire](https://chrome.google.com/webstore/detail/signalhire-find-email-or/aeidadjdhppdffggfgjpanbaf - Network accessline 239
- [TruePeopleSearch](https://www.truepeoplesearch.com/) — free U.S. people search. - Network accessline 240
- [WhitePages](https://www.whitepages.com/), [Spokeo](https://www.spokeo.com/), [Webmii](https://webmii.com/), [Pipl](https://pipl.com/) (paid). - Network accessline 241
- [Clearbit](https://clearbit.com/) — company/individual data enrichment. - Network accessline 242
- [FaceCheck](https://facecheck.id/) / [FaceSeek](https://faceseek.online/) — reverse face search. - Network accessline 248
- [TrueCaller](https://www.truecaller.com/) — caller ID + spam blocking. - Network accessline 249
- [ThatsThem](https://thatsthem.com/) — reverse phone search. - Network accessline 250
- [Infobel](https://infobel.com/) — non-USA phone search. - Network accessline 251
- [FreeCarrierLookup](https://freecarrierlookup.com/) — carrier/type (US). - Network accessline 252
- [NumlookupAPI](https://numlookupapi.com/) [Freemium] — programmatic carrier checks. - Network accessline 253
- [CallerIDTest](https://calleridtest.com/), [Advanced Background Checks](https://www.advancedbackgroundchecks.com/). - Network accessline 305
| Platform | Tool | |----------|------| | Instagram | [Picuki](https://www.picuki.com/) — profile view without account | - Network accessline 306
|----------|------| | Instagram | [Picuki](https://www.picuki.com/) — profile view without account | | X/Twitter | [snscrape](https://github.com/snscrape/snscrape) — preferred CLI scraper; Twint as fallback | - Network accessline 307
| Instagram | [Picuki](https://www.picuki.com/) — profile view without account | - Network accessline 308
| X/Twitter | [snscrape](https://github.com/snscrape/snscrape) — preferred CLI scraper; Twint as fallback | - Network accessline 309
| Facebook | [Graph Search](https://inteltechniques.com/tools/Facebook.html), [sowsearch.info](https://sowsearch.info/), [lookup-id.com](https://lookup-id.com/), [whopostedwhat.com](https://whopostedwhat.com/) | - Network accessline 310
| Facebook (research) | [Meta Content Library](https://transparency.meta.com/researcher) — CrowdTangle successor (researcher-gated) | - Network accessline 311
| YouTube/Twitch | [Social Blade](https://socialblade.com/) — analytics | - Network accessline 312
| TikTok | [Tokboard](https://tokboard.com/) — trends + profile analytics | - Network accessline 313
| Reddit | [Reveddit](https://www.reveddit.com/) — removed content; [RedTrack.social](https://redtrack.social/) — user history | - Network accessline 314
| Bluesky | [Firesky](https://firesky.tv/) — real-time firehose; [SkyView](https://bsky.jazco.dev/) — follower graphs | - Network accessline 315
| Mastodon | [FediSearch](https://fedisearch.skorpil.cz/) — cross-instance search; [Fedifinder](https://fedifinder.glitch.me/) — find Twitter users on Mastodon | - Network accessline 316
| Faces | [Search4Faces](https://search4faces.com/) | - Network accessline 322
- [OpenCorporates](https://opencorporates.com/) — world's largest open company DB. - Network accessline 323
- [SEC EDGAR](https://www.sec.gov/edgar.shtml) — U.S. company filings. - Network accessline 324
- [OpenOwnership Register](https://register.openownership.org/) — beneficial ownership. - Network accessline 325
- [MuckRock](https://www.muckrock.com/) — FOIA repository + request tracking. - Network accessline 326
- [EU Tenders (TED)](https://ted.europa.eu/) — EU procurement notices. - Network accessline 327
- [World Bank Projects](https://projects.worldbank.org/) — project + procurement records. - Network accessline 328
- [UK Companies House](https://find-and-update.company-information.service.gov.uk/) — UK companies + officers + filings. - Network accessline 332
[Rusprofile](https://www.rusprofile.ru/), [Kontur.Focus](https://focus.kontur.ru/) (freemium), [zakupki.gov.ru](https://zakupki.gov.ru/) (procurement), EGRUL/EGRIP (official, captcha-gated). - Network accessline 336
- **GSXT** — [gsxt.gov.cn](https://www.gsxt.gov.cn/) National Enterprise Credit Info; cross-check with Tianyancha / Qichacha. - Network accessline 337
- **USCC (Unified Social Credit Code)** — 18-character entity ID assigned to all CN legal entities. Format: `<region:6><authority:2><type:1><serial:9>`. Useful for joining GSXT records to ICP filings. - **ICP Beian** — [beian.miit.gov.cn](h - Network accessline 338
- **ICP Beian** — [beian.miit.gov.cn](https://beian.miit.gov.cn/) — every domain serving traffic in mainland CN must register an ICP filing; the filing links the domain to a USCC, which links to the legal entity in GSXT. - Network accessline 343
- [OFAC SDN List](https://sanctionssearch.ofac.treas.gov/), [EU Sanctions Map](https://www.sanctionsmap.eu/). - Network accessline 344
- [OpenSanctions](https://www.opensanctions.org/) — aggregated. - Network accessline 345
- [OCCRP Aleph](https://aleph.occrp.org/) — investigative documents, leaks, company records. - Network accessline 351
- [Have I Been Pwned](https://haveibeenpwned.com/) — breach lookup; Pwned Passwords API (k-anonymity). - Network accessline 352
- [Dehashed](https://dehashed.com/) — credential search (paid). - Network accessline 353
- [IntelX](https://intelx.io/) — data intelligence. - Network accessline 354
- [LeakCheck](https://leakcheck.io/), [Snusbase](https://snusbase.com/), [BreachDirectory](https://breachdirectory.org/), [Scattered Secrets](https://scatteredsecrets.com/), [Phonebook](https://phonebook.cz/), [LeakPeek](https://leakpeek.co - Network accessline 355
- [Cavalier (Hudson Rock)](https://cavalier.hudsonrock.com/) — **infostealer log lookups; FREE; highest single-source ROI for finding compromised employee credentials in corporate SSO**. - Network accessline 362
# By domain (canonical first call) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq . - Network accessline 363
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=target.com" | jq . - Network accessline 365
# By email (single-account check) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq . - Network accessline 366
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-email?email=alice@target.com" | jq . - Network accessline 368
# By URL (when target's app is the breach victim) curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq . - Network accessline 369
curl -sk -m 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-url?url=https://app.target.com" | jq . - Network accessline 375
$hr = Invoke-RestMethod -Uri "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=$D" -TimeoutSec 30 - Network accessline 679
https://{candidate}.s3.amazonaws.com/ - Network accessline 680
https://{candidate}.s3-{region}.amazonaws.com/ # try us-east-1, us-west-2, eu-west-1, ap-southeast-1 first - Network accessline 681
https://s3.{region}.amazonaws.com/{candidate}/ - Network accessline 687
https://{candidate}.storage.googleapis.com/ - Network accessline 688
https://storage.googleapis.com/{candidate}/ - Network accessline 694
https://{candidate}.blob.core.windows.net/ - Network accessline 808
### 16.13 Copy-Paste Probes (curl one-liners) - Network accessline 815
T="https://target.example" - Network accessline 817
# .git/config (CRITICAL) curl -sk -m 10 "$T/.git/config" | grep -E '\[core\]|\[remote|repositoryformatversion' - Network accessline 818
curl -sk -m 10 "$T/.git/config" | grep -E '\[core\]|\[remote|repositoryformatversion' - Network accessline 820
# .git/HEAD (HIGH) curl -sk -m 10 "$T/.git/HEAD" | grep -E '^ref:' - Network accessline 821
curl -sk -m 10 "$T/.git/HEAD" | grep -E '^ref:' - Network accessline 823
[Credential-related source omitted] - Access to secretsline 823
[Credential-related source omitted] - Network accessline 824
[Credential-related source omitted] - Access to secretsline 824
[Credential-related source omitted] - Network accessline 826
# Apache /server-status (MEDIUM) curl -sk -m 10 "$T/server-status" | grep -i 'Apache Server Status' - Network accessline 827
curl -sk -m 10 "$T/server-status" | grep -i 'Apache Server Status' - Network accessline 829
# Apache /server-info (MEDIUM) curl -sk -m 10 "$T/server-info" | grep -i 'Apache Server Information' - Network accessline 830
curl -sk -m 10 "$T/server-info" | grep -i 'Apache Server Information' - Network accessline 832
# .DS_Store (LOW) curl -sk -m 10 "$T/.DS_Store" -o /tmp/dsstore && file /tmp/dsstore | grep -i 'data' - Network accessline 833
curl -sk -m 10 "$T/.DS_Store" -o /tmp/dsstore && file /tmp/dsstore | grep -i 'data' - Network accessline 835
# phpinfo.php (HIGH) curl -sk -m 10 "$T/phpinfo.php" | grep -E 'phpinfo\(\)|PHP Version' - Network accessline 836
curl -sk -m 10 "$T/phpinfo.php" | grep -E 'phpinfo\(\)|PHP Version' - Network accessline 838
# info.php (HIGH) curl -sk -m 10 "$T/info.php" | grep -E 'phpinfo\(\)|PHP Version' - Network accessline 839
curl -sk -m 10 "$T/info.php" | grep -E 'phpinfo\(\)|PHP Version' - Network accessline 841
# Spring Boot /actuator/env (CRITICAL) curl -sk -m 10 "$T/actuator/env" | grep -E '"propertySources"|systemProperties|systemEnvironment' - Network accessline 842
curl -sk -m 10 "$T/actuator/env" | grep -E '"propertySources"|systemProperties|systemEnvironment' - Network accessline 844
# Spring Boot /actuator/heapdump (CRITICAL — saves binary; check size) curl -sk -m 30 "$T/actuator/heapdump" -o /tmp/heap && file /tmp/heap | grep -i 'HPROF\|data' - Network accessline 845
curl -sk -m 30 "$T/actuator/heapdump" -o /tmp/heap && file /tmp/heap | grep -i 'HPROF\|data' - Network accessline 847
# Elasticsearch open (HIGH) curl -sk -m 10 "$T/_cat/indices?v" - Network accessline 848
curl -sk -m 10 "$T/_cat/indices?v" - Network accessline 850
# Jenkins script console (HIGH) curl -sk -m 10 "$T/script" | grep -iE 'Jenkins|Script Console' - Network accessline 851
curl -sk -m 10 "$T/script" | grep -iE 'Jenkins|Script Console' - Network accessline 853
# Tomcat manager (HIGH) curl -sk -m 10 "$T/manager/html" -w '%{http_code}\n' | tail -1 # 401 = present + auth-gated; 200 = no auth - Network accessline 854
curl -sk -m 10 "$T/manager/html" -w '%{http_code}\n' | tail -1 # 401 = present + auth-gated; 200 = no auth - Network accessline 856
# WordPress orphan installer (LOW) curl -sk -m 10 "$T/wp-admin/install.php" | grep -i 'WordPress Installation' - Network accessline 857
curl -sk -m 10 "$T/wp-admin/install.php" | grep -i 'WordPress Installation' - Network accessline 859
# security.txt (INFO) curl -sk -m 10 "$T/.well-known/security.txt" - Network accessline 860
curl -sk -m 10 "$T/.well-known/security.txt" - Network accessline 867
for prefix in auth login sso idp iam identity accounts oauth; do echo "=== ${prefix}.${D} ===" curl -sk -m 10 "https://${prefix}.${D}/.well-known/openid-configuration" -o /dev/null -w '%{http_code}\n' - Network accessline 868
echo "=== ${prefix}.${D} ===" curl -sk -m 10 "https://${prefix}.${D}/.well-known/openid-configuration" -o /dev/null -w '%{http_code}\n' done - Network accessline 869
curl -sk -m 10 "https://${prefix}.${D}/.well-known/openid-configuration" -o /dev/null -w '%{http_code}\n' - Network accessline 872
# Generic OIDC discovery on any host: curl -sk -m 10 "https://${HOST}/.well-known/openid-configuration" | jq . - Network accessline 873
curl -sk -m 10 "https://${HOST}/.well-known/openid-configuration" | jq . - Network accessline 884
/auth/saml2/metadata; do echo "=== $p ===" curl -sk -m 10 "https://${H}${p}" -o /dev/null -w '%{http_code} %{size_download}\n' - Network accessline 885
echo "=== $p ===" curl -sk -m 10 "https://${H}${p}" -o /dev/null -w '%{http_code} %{size_download}\n' done - Network accessline 886
curl -sk -m 10 "https://${H}${p}" -o /dev/null -w '%{http_code} %{size_download}\n' - Network accessline 895
# S3 (us-east-1 first) curl -sk -m 10 -I "https://${B}.s3.amazonaws.com/" -w 'STATUS:%{http_code}\n' | head -20 - Network accessline 896
curl -sk -m 10 -I "https://${B}.s3.amazonaws.com/" -w 'STATUS:%{http_code}\n' | head -20 - Network accessline 898
curl -sk -m 10 "https://${B}.s3.amazonaws.com/?list-type=2" | head -50 - Network accessline 900
# S3 region-specific for r in us-east-1 us-west-2 eu-west-1 ap-southeast-1; do curl -sk -m 10 -I "https://${B}.s3-${r}.amazonaws.com/" -w "${r}: %{http_code}\n" - Network accessline 901
for r in us-east-1 us-west-2 eu-west-1 ap-southeast-1; do curl -sk -m 10 -I "https://${B}.s3-${r}.amazonaws.com/" -w "${r}: %{http_code}\n" done - Network accessline 902
curl -sk -m 10 -I "https://${B}.s3-${r}.amazonaws.com/" -w "${r}: %{http_code}\n" - Network accessline 905
# GCS curl -sk -m 10 -I "https://${B}.storage.googleapis.com/" - Network accessline 906
curl -sk -m 10 -I "https://${B}.storage.googleapis.com/" - Network accessline 907
curl -sk -m 10 "https://storage.googleapis.com/${B}/" - Network accessline 909
# Azure Blob curl -sk -m 10 -I "https://${B}.blob.core.windows.net/" - Network accessline 910
curl -sk -m 10 -I "https://${B}.blob.core.windows.net/" - Network accessline 911
curl -sk -m 10 "https://${B}.blob.core.windows.net/?comp=list" - Network accessline 917
H="https://target.example/graphql" - Network accessline 919
curl -sk -m 15 -X POST "$H" \ - Network accessline 930
[Credential-related source omitted] - Network accessline 931
[Credential-related source omitted] - Network accessline 933
# AWS (use boto3 instead of curl — pre-signing complexity) - Network accessline 936
[Credential-related source omitted] - Network accessline 937
[Credential-related source omitted] - Network accessline 940
[Credential-related source omitted] - Network accessline 941
[Credential-related source omitted] - Network accessline 943
[Credential-related source omitted] - Network accessline 944
[Credential-related source omitted] - Network accessline 946
[Credential-related source omitted] - Network accessline 947
[Credential-related source omitted] - Network accessline 949
[Credential-related source omitted] - Network accessline 950
[Credential-related source omitted] - Network accessline 952
# Atlassian (account) curl -sk -m 10 -u "email:ATATT3xFfGF0_..." https://your-domain.atlassian.net/rest/api/3/myself | jq . - Network accessline 953
curl -sk -m 10 -u "email:ATATT3xFfGF0_..." https://your-domain.atlassian.net/rest/api/3/myself | jq . - Network accessline 955
[Credential-related source omitted] - Network accessline 956
[Credential-related source omitted] - Network accessline 959
**Bulk webapp triage (httpx, faster than curl loop):** - Access to secretsline 966
[Credential-related source omitted] - Network accessline 972
mkdir -p evidence/$(date -u +%Y%m%d) T="https://target.example" - Network accessline 973
T="https://target.example" - Network accessline 975
TS=$(date -u +%Y%m%dT%H%M%SZ) SAFE_NAME=$(echo "${T}${P}" | tr '/:' '_') curl -sk -m 10 "$T$P" -o "evidence/$(date -u +%Y%m%d)/${TS}_${SAFE_NAME}.body" \ - Network accessline 976
SAFE_NAME=$(echo "${T}${P}" | tr '/:' '_') curl -sk -m 10 "$T$P" -o "evidence/$(date -u +%Y%m%d)/${TS}_${SAFE_NAME}.body" \ -D "evidence/$(date -u +%Y%m%d)/${TS}_${SAFE_NAME}.headers" - Network accessline 977
curl -sk -m 10 "$T$P" -o "evidence/$(date -u +%Y%m%d)/${TS}_${SAFE_NAME}.body" \ - Network accessline 1061
dig +short TXT "_mta-sts.${D}" curl -sk -m 10 "https://mta-sts.${D}/.well-known/mta-sts.txt" - Network accessline 1062
curl -sk -m 10 "https://mta-sts.${D}/.well-known/mta-sts.txt" - Network accessline 1143
https://www.cloudflare.com/ips-v4 - Network accessline 1146
**Akamai ASNs:** AS16625, AS20940, AS21342, AS21357. **Fastly:** AS54113. **AWS CloudFront:** published in `https://ip-ranges.amazonaws.com/ip-ranges.json` filter `service:CLOUDFRONT`. - Network accessline 1148
**AWS CloudFront:** published in `https://ip-ranges.amazonaws.com/ip-ranges.json` filter `service:CLOUDFRONT`. - Network accessline 1153
[Credential-related source omitted] - Network accessline 1154
[Credential-related source omitted] - Network accessline 1155
"https://api.securitytrails.com/v1/history/${D}/dns/a" | jq '.records[] | {ip:.values[].ip, first_seen, last_seen}' - Network accessline 1161
# Validin curl -sk "https://app.validin.com/api/axon/${D}/dns" | jq . - Network accessline 1162
curl -sk "https://app.validin.com/api/axon/${D}/dns" | jq . - Network accessline 1164
# RiskIQ Community (free tier; auth required) curl -sk -u "user:apikey" "https://api.riskiq.net/pt/v2/dns/passive?query=${D}" | jq . - Network accessline 1165
curl -sk -u "user:apikey" "https://api.riskiq.net/pt/v2/dns/passive?query=${D}" | jq . - Network accessline 1180
curl -sk "https://crt.sh/?q=%25.${D}&output=json" | jq -r '.[].name_value' | sort -u - Network accessline 1187
python3 -c " import urllib.request, codecs, mmh3 data = urllib.request.urlopen('https://target.example/favicon.ico').read() - Network accessline 1188
import urllib.request, codecs, mmh3 data = urllib.request.urlopen('https://target.example/favicon.ico').read() b64 = codecs.encode(data, 'base64') - Network accessline 1189
data = urllib.request.urlopen('https://target.example/favicon.ico').read() - Network accessline 1215
CANDIDATE_IP="203.0.113.42" curl -sk -m 10 -H "Host: target.example.com" "https://${CANDIDATE_IP}/" -o /tmp/candidate.html - Network accessline 1216
curl -sk -m 10 -H "Host: target.example.com" "https://${CANDIDATE_IP}/" -o /tmp/candidate.html - Network accessline 1217
diff <(curl -sk -m 10 https://target.example.com/) /tmp/candidate.html | head -50 - Network accessline 1244
# Trigger CDN-side 5xx (oversized request, malformed Host) curl -sk -m 10 -H "Host: " "https://target.example/" -o /tmp/err.html - Network accessline 1245
curl -sk -m 10 -H "Host: " "https://target.example/" -o /tmp/err.html - Network accessline 1246
curl -sk -m 10 -H "X-Forwarded-For: $(python3 -c 'print("a"*8000)')" "https://target.example/" - Network accessline 1284
T="https://target.example" # Citrix curl -sk -m 10 "$T/vpn/index.html" -o /tmp/c1 -w '%{http_code}\n' - Network accessline 1285
# Citrix curl -sk -m 10 "$T/vpn/index.html" -o /tmp/c1 -w '%{http_code}\n' grep -iE 'NetScaler|Citrix|version' /tmp/c1 - Network accessline 1286
curl -sk -m 10 "$T/vpn/index.html" -o /tmp/c1 -w '%{http_code}\n' - Network accessline 1287
grep -iE 'NetScaler|Citrix|version' /tmp/c1 # F5 curl -sk -m 10 "$T/tmui/login.jsp" -o /tmp/c2 -w '%{http_code}\n' - Network accessline 1288
# F5 curl -sk -m 10 "$T/tmui/login.jsp" -o /tmp/c2 -w '%{http_code}\n' grep -iE 'BIG-IP|version' /tmp/c2 - Network accessline 1289
curl -sk -m 10 "$T/tmui/login.jsp" -o /tmp/c2 -w '%{http_code}\n' - Network accessline 1340
| Target | Port | Probe | Severity if exposed | |---|---|---|---| | **Docker API (unencrypted)** | 2375 | `curl -sk -m 5 http://${IP}:2375/v1.40/info` | CRITICAL (container/host takeover) | - Network accessline 1341
|---|---|---|---| | **Docker API (unencrypted)** | 2375 | `curl -sk -m 5 http://${IP}:2375/v1.40/info` | CRITICAL (container/host takeover) | | **Docker API (TLS)** | 2376 | `curl -sk -m 5 https://${IP}:2376/v1.40/info` | HIGH (cert validat - Network accessline 1342
| **Docker API (unencrypted)** | 2375 | `curl -sk -m 5 http://${IP}:2375/v1.40/info` | CRITICAL (container/host takeover) | - Network accessline 1343
| **Docker API (TLS)** | 2376 | `curl -sk -m 5 https://${IP}:2376/v1.40/info` | HIGH (cert validation bypass possible) | - Network accessline 1344
| **Kubernetes API server** | 6443 / 8443 | `curl -sk -m 5 https://${IP}:6443/api` | HIGH if `system:anonymous` returns non-403 | - Network accessline 1345
| **Kubernetes Dashboard** | 8001 / 9090 / 30000+ | `curl -sk -m 5 http://${IP}:8001/api/v1/namespaces/kube-system/services/kubernetes-dashboard` | HIGH if reachable | - Network accessline 1346
| **kubelet** | 10250 (HTTPS), 10255 (HTTP, deprecated) | `curl -sk -m 5 https://${IP}:10250/pods` | CRITICAL (no auth = pod exec) | - Network accessline 1347
| **etcd** | 2379 (client), 2380 (peer) | `curl -sk -m 5 https://${IP}:2379/v2/keys/` (v2) or `etcdctl --endpoints=${IP}:2379 get /` (v3) | CRITICAL (cluster state + secrets) | - Network accessline 1348
| **kube-proxy** | 10256 | `curl http://${IP}:10256/healthz` | INFO | - Network accessline 1349
| **kube-controller-manager** | 10257 | `curl https://${IP}:10257/metrics` | MEDIUM | - Network accessline 1350
| **kube-scheduler** | 10259 | `curl https://${IP}:10259/metrics` | MEDIUM | - Network accessline 1351
| **cAdvisor** | 4194 (deprecated) | `curl http://${IP}:4194/metrics` | LOW (resource metrics) | - Network accessline 1356
| Registry | Search pattern | |---|---| | Docker Hub | `https://hub.docker.com/search?q=<target-keyword>&type=image` | - Network accessline 1357
|---|---| | Docker Hub | `https://hub.docker.com/search?q=<target-keyword>&type=image` | | Quay (Red Hat) | `https://quay.io/search?q=<target-keyword>` | - Network accessline 1358
| Docker Hub | `https://hub.docker.com/search?q=<target-keyword>&type=image` | - Network accessline 1359
| Quay (Red Hat) | `https://quay.io/search?q=<target-keyword>` | - Network accessline 1360
| GitHub Container Registry (GHCR) | enumerable via GitHub API: `https://api.github.com/orgs/<org>/packages?package_type=container` | - Network accessline 1361
| Amazon ECR Public | `https://gallery.ecr.aws/?searchTerm=<keyword>` | - Network accessline 1363
| Google Container Registry (public) | `https://console.cloud.google.com/gcr/images/<project>?project=<project>` | - Network accessline 1374
| Platform | Common exposure | Probe | |---|---|---| | **Jenkins** | `/script` (Groovy console = RCE if no auth), `/asynchPeople/`, `/jnlpJars/jenkins-cli.jar`, `/computer/`, `/job/<name>/api/json` | `curl -sk -m 10 "${T}/script"` and `curl - Network accessline 1375
|---|---|---| | **Jenkins** | `/script` (Groovy console = RCE if no auth), `/asynchPeople/`, `/jnlpJars/jenkins-cli.jar`, `/computer/`, `/job/<name>/api/json` | `curl -sk -m 10 "${T}/script"` and `curl -sk -m 10 "${T}/asynchPeople/api/json" - Network accessline 1376
| **Jenkins** | `/script` (Groovy console = RCE if no auth), `/asynchPeople/`, `/jnlpJars/jenkins-cli.jar`, `/computer/`, `/job/<name>/api/json` | `curl -sk -m 10 "${T}/script"` and `curl -sk -m 10 "${T}/asynchPeople/api/json"` | - Network accessline 1377
| **GitLab self-hosted** | `/users/sign_in` (version in HTML), `/-/oauth/applications` (auth-required), `/api/v4/version`, `/-/snippets/<id>/raw` | `curl -sk -m 10 "${T}/api/v4/version"` | - Network accessline 1378
| **GitHub Actions workflow files** | `.github/workflows/*.yml` in any public repo | Search via GitHub code search: `path:.github/workflows extension:yml secrets` | | **CircleCI config** | `.circleci/config.yml` in any repo | Search: `path: - Network accessline 1379
| **CircleCI config** | `.circleci/config.yml` in any repo | Search: `path:.circleci/config.yml` | | **TeamCity** | `/login.html`, `/agent.html?agentId=*`, `/admin/admin.html` | `curl -sk -m 10 "${T}/login.html" \| grep -i 'TeamCity'` — ver - Network accessline 1380
| **TeamCity** | `/login.html`, `/agent.html?agentId=*`, `/admin/admin.html` | `curl -sk -m 10 "${T}/login.html" \| grep -i 'TeamCity'` — version disclosure. CVE-2024-27198 (KEV). | - Network accessline 1381
| **Bamboo (Atlassian)** | `/userlogin.action`, `/rest/api/latest/info` | `curl -sk -m 10 "${T}/rest/api/latest/info"` | - Network accessline 1382
| **Drone CI** | `/api/info`, `/login` | `curl -sk -m 10 "${T}/api/info"` | - Network accessline 1383
| **Travis CI (legacy)** | `.travis.yml` in repos; `https://api.travis-ci.com/repos/<owner>/<repo>` | API often exposes build env. | | **Argo CD** | `/api/version`, `/applications` | `curl -sk -m 10 "${T}/api/version"`. Check anonymous-auth - Network accessline 1384
| **Argo CD** | `/api/version`, `/applications` | `curl -sk -m 10 "${T}/api/version"`. Check anonymous-auth posture. | - Network accessline 1385
| **Tekton** | `/apis/tekton.dev/v1beta1/pipelineruns` (K8s native) | Enumerate via K8s API. | | **Spinnaker** | `/gate/info`, `/applications` | `curl -sk -m 10 "${T}/gate/info"` | | **Buildkite** | per-org dashboards; usually behind auth. - Network accessline 1386
| **Spinnaker** | `/gate/info`, `/applications` | `curl -sk -m 10 "${T}/gate/info"` | - Access to secretsline 1393
[Credential-related source omitted] - Access to secretsline 1397
[Credential-related source omitted] - Network accessline 1417
| **Confluence Cloud (anonymous)** | `<target>.atlassian.net/wiki/spaces/` | Public spaces; check `/wiki/display/<SPACE>/`. | | **Atlassian Service Desk** | `<target>.atlassian.net/servicedesk/customer/portal/<N>` | Sometimes lists all inte - Network accessline 1418
| **Atlassian Service Desk** | `<target>.atlassian.net/servicedesk/customer/portal/<N>` | Sometimes lists all internal request types. | | **Trello board** | `https://trello.com/b/<id>/<slug>` | Public board with cards; check via Google `sit - Network accessline 1419
| **Trello board** | `https://trello.com/b/<id>/<slug>` | Public board with cards; check via Google `site:trello.com "${target}"`. | - Network accessline 1420
| **Asana public project** | `https://app.asana.com/0/<id>/<id>` | Public project view. | - Network accessline 1424
| **Slab** | `<workspace>.slab.com/posts/<id>` | Published posts. | | **Coda** | `coda.io/d/<doc-id>` | Public docs. | | **Miro** | `https://miro.com/app/board/<id>/` | Public boards (often architecture diagrams). | - Network accessline 1425
| **Coda** | `coda.io/d/<doc-id>` | Public docs. | | **Miro** | `https://miro.com/app/board/<id>/` | Public boards (often architecture diagrams). | | **Lucidchart** | `https://lucid.app/lucidchart/<id>/view` | Public diagrams. | - Network accessline 1426
| **Miro** | `https://miro.com/app/board/<id>/` | Public boards (often architecture diagrams). | - Network accessline 1427
| **Lucidchart** | `https://lucid.app/lucidchart/<id>/view` | Public diagrams. | - Network accessline 1428
| **Figma** | `https://www.figma.com/file/<key>/` | Public design files; sometimes leak product spec. | - Network accessline 1457
whois target.example # standard CLI curl -sk -m 10 "https://www.whois.com/whois/${D}" # web fallback - Network accessline 1458
curl -sk -m 10 "https://www.whois.com/whois/${D}" # web fallback - Network accessline 1464
# IANA bootstrap → returns the registry RDAP server curl -sk "https://rdap.org/domain/${D}" | jq . - Network accessline 1465
curl -sk "https://rdap.org/domain/${D}" | jq . - Network accessline 1466
curl -sk "https://www.iana.org/rdap" | jq . # bootstrap registry - Network accessline 1495
[Credential-related source omitted] - Network accessline 1496
[Credential-related source omitted] - Network accessline 1497
"https://api.domaintools.com/v1/reverse-whois/?terms=admin@target.example" - Network accessline 1593
D="target.example" curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*&output=json&fl=timestamp,original&limit=10000" - Network accessline 1594
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*&output=json&fl=timestamp,original&limit=10000" - Network accessline 1612
TS="20231215120000" URL="https://target.example/admin/dashboard" curl -sk "https://web.archive.org/web/${TS}/${URL}" - Network accessline 1613
URL="https://target.example/admin/dashboard" - Network accessline 1614
curl -sk "https://web.archive.org/web/${TS}/${URL}" - Network accessline 1620
LIVE=$(curl -sk -m 10 "${URL}") - Network accessline 1621
ARCHIVED=$(curl -sk -m 10 "https://web.archive.org/web/${TS}/${URL}") - Network accessline 1628
curl -sk -X POST "https://pragma.archivelab.org/" \ - Network accessline 1630
-d '{"url":"https://target.example/admin"}' - Network accessline 1636
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.js&output=json&fl=timestamp,original&filter=statuscode:200" | \ - Network accessline 1647
# ASP / ASP.NET classic curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.asp&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=500" - Network accessline 1648
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.asp&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=500" - Network accessline 1650
# PHP curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.php&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=500" - Network accessline 1651
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.php&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=500" - Network accessline 1654
for ext in aspx jsp cgi cfm; do echo "=== .$ext ===" curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=200" - Network accessline 1655
echo "=== .$ext ===" curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=200" done - Network accessline 1656
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=200" - Network accessline 1660
for ext in json xml yml yaml ini conf; do echo "=== .$ext ===" curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=100" - Network accessline 1661
echo "=== .$ext ===" curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=100" done - Network accessline 1662
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*.${ext}&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=100" - Network accessline 1665
# Anything indexed (broad sweep — useful for legacy enumeration) curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=10000" - Network accessline 1666
curl -sk "https://web.archive.org/cdx/search/cdx?url=${D}/*&output=json&fl=timestamp,original&filter=statuscode:200&collapse=urlkey&limit=10000" - Network accessline 1758
| 11 | Stripe Test Key | `\bsk_test_[0-9A-Za-z]{24,}\b` | LOW | stripe | | 12 | Slack Token | `\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b` | HIGH | slack | | 13 | Slack Webhook | `https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0- - Network accessline 1759
| 12 | Slack Token | `\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b` | HIGH | slack | | 13 | Slack Webhook | `https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+` | MEDIUM | slack | | 14 | SendGrid Key | `\bSG\.[A-Za-z0-9_\-]{22}\. - Network accessline 1760
| 13 | Slack Webhook | `https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+` | MEDIUM | slack | - Access to secretsline 1776
[Credential-related source omitted] - Network accessline 1789
[Credential-related source omitted] - Network accessline 1790
[Credential-related source omitted] - Access to secretsline 1790
[Credential-related source omitted] - Network accessline 1791
[Credential-related source omitted] - Access to secretsline 1884
[Credential-related source omitted] - Access to secretsline 2005
[Credential-related source omitted] - Access to secretsline 2009
[Credential-related source omitted] - Access to secretsline 2037
[Credential-related source omitted] - Network accessline 2083
[Credential-related source omitted] - Network accessline 2084
[Credential-related source omitted] - Network accessline 2130
[Credential-related source omitted] - Network accessline 2131
[Credential-related source omitted] - Access to secretsline 2135
[Credential-related source omitted] - Access to secretsline 2136
[Credential-related source omitted] - Network accessline 2196
[Credential-related source omitted] - Network accessline 2210
[Credential-related source omitted] - Network accessline 2218
[Credential-related source omitted] - Network accessline 2236
[Credential-related source omitted] - Network accessline 2243
[Credential-related source omitted] - Network accessline 2297
[Credential-related source omitted] - Network accessline 2305
[Credential-related source omitted] - Network accessline 2315
[Credential-related source omitted] - Network accessline 2318
[Credential-related source omitted] - Network accessline 2324
[Credential-related source omitted] - Network accessline 2325
[Credential-related source omitted] - Network accessline 2326
[Credential-related source omitted] - Network accessline 2327
[Credential-related source omitted] - Network accessline 2328
[Credential-related source omitted] - Network accessline 2329
[Credential-related source omitted] - Network accessline 2331
[Credential-related source omitted] - Network accessline 2384
[Credential-related source omitted] - Network accessline 2385
[Credential-related source omitted] - Network accessline 2387
[Credential-related source omitted] - Network accessline 2394
[Credential-related source omitted] - Network accessline 2395
[Credential-related source omitted] - Network accessline 2396
[Credential-related source omitted] - Network accessline 2411
[Credential-related source omitted] - Network accessline 2412
[Credential-related source omitted] - Network accessline 2413
[Credential-related source omitted] - Network accessline 2425
[Credential-related source omitted] - Network accessline 2426
[Credential-related source omitted] - Network accessline 2427
[Credential-related source omitted] - Access to secretsline 2427
[Credential-related source omitted] - Network accessline 2434
[Credential-related source omitted] - Network accessline 2441
[Credential-related source omitted] - Network accessline 2467
[Credential-related source omitted] - Network accessline 2476
[Credential-related source omitted] - Network accessline 2486
[Credential-related source omitted] - Network accessline 2547
[Credential-related source omitted] - Network accessline 2582
[Credential-related source omitted] - Network accessline 2594
[Credential-related source omitted] - Network accessline 2605
[Credential-related source omitted] - Network accessline 2619
[Credential-related source omitted] - Network accessline 2631
[Credential-related source omitted] - Network accessline 2655
[Credential-related source omitted] - Access to secretsline 2699
[Credential-related source omitted] - Network accessline 2739
[Credential-related source omitted] - Network accessline 2740
[Credential-related source omitted] - Network accessline 2742
[Credential-related source omitted] - Network accessline 2743
[Credential-related source omitted] - Network accessline 2745
[Credential-related source omitted] - Network accessline 2746
[Credential-related source omitted] - Network accessline 2748
[Credential-related source omitted] - Network accessline 2749
[Credential-related source omitted] - Network accessline 2750
[Credential-related source omitted] - Network accessline 2751
[Credential-related source omitted] - Network accessline 2752
[Credential-related source omitted] - Network accessline 2754
[Credential-related source omitted] - Network accessline 2756
[Credential-related source omitted] - Network accessline 2765
[Credential-related source omitted] - Network accessline 2767
[Credential-related source omitted] - Network accessline 2769
[Credential-related source omitted] - Network accessline 2770
[Credential-related source omitted] - Network accessline 2772
[Credential-related source omitted] - Network accessline 2773
[Credential-related source omitted] - Network accessline 2775
[Credential-related source omitted] - Network accessline 2776
[Credential-related source omitted] - Network accessline 2820
[Credential-related source omitted] - Network accessline 2821
[Credential-related source omitted] - Network accessline 2823
[Credential-related source omitted] - Network accessline 2824
[Credential-related source omitted] - Network accessline 2826
[Credential-related source omitted] - Network accessline 2827
[Credential-related source omitted] - Network accessline 2828
[Credential-related source omitted] - Network accessline 2829
[Credential-related source omitted] - Network accessline 2831
[Credential-related source omitted] - Network accessline 2832
[Credential-related source omitted] - Network accessline 2833
[Credential-related source omitted] - Network accessline 2836
[Credential-related source omitted] - Network accessline 2838
[Credential-related source omitted] - Network accessline 2848
[Credential-related source omitted] - Network accessline 2849
[Credential-related source omitted] - Network accessline 2851
[Credential-related source omitted] - Network accessline 2852
[Credential-related source omitted] - Network accessline 2863
[Credential-related source omitted] - Network accessline 2864
[Credential-related source omitted] - Network accessline 2866
[Credential-related source omitted] - Network accessline 2867
[Credential-related source omitted] - Network accessline 2869
[Credential-related source omitted] - Network accessline 2870
[Credential-related source omitted] - Network accessline 2871
[Credential-related source omitted] - Network accessline 2891
[Credential-related source omitted] - Network accessline 2892
[Credential-related source omitted] - Network accessline 2915
[Credential-related source omitted] - Network accessline 2916
[Credential-related source omitted] - Network accessline 2918
[Credential-related source omitted] - Network accessline 2925
[Credential-related source omitted] - Network accessline 2927
[Credential-related source omitted] - Network accessline 2929
[Credential-related source omitted] - Network accessline 2930
[Credential-related source omitted] - Network accessline 2931
[Credential-related source omitted] - Network accessline 2933
[Credential-related source omitted] - Network accessline 2935
[Credential-related source omitted] - Network accessline 2968
[Credential-related source omitted] - Network accessline 3068
[Credential-related source omitted] - Network accessline 3069
[Credential-related source omitted] - Network accessline 3072
[Credential-related source omitted] - Network accessline 3073
[Credential-related source omitted] - Network accessline 3078
[Credential-related source omitted] - Network accessline 3079
[Credential-related source omitted] - Network accessline 3082
[Credential-related source omitted] - Network accessline 3083
[Credential-related source omitted] - Network accessline 3085
[Credential-related source omitted] - Network accessline 3086
[Credential-related source omitted] - Network accessline 3089
[Credential-related source omitted] - Network accessline 3090
[Credential-related source omitted] - Network accessline 3098
[Credential-related source omitted] - Network accessline 3099
[Credential-related source omitted] - Network accessline 3100
[Credential-related source omitted] - Network accessline 3114
[Credential-related source omitted] - Network accessline 3115
[Credential-related source omitted] - Network accessline 3116
[Credential-related source omitted] - Network accessline 3117
[Credential-related source omitted] - Network accessline 3118
[Credential-related source omitted] - Network accessline 3119
[Credential-related source omitted] - Network accessline 3120
[Credential-related source omitted] - Network accessline 3121
[Credential-related source omitted] - Network accessline 3122
[Credential-related source omitted] - Network accessline 3123
[Credential-related source omitted] - Network accessline 3124
[Credential-related source omitted] - Network accessline 3125
[Credential-related source omitted] - Network accessline 3143
[Credential-related source omitted] - Network accessline 3144
[Credential-related source omitted] - Network accessline 3151
[Credential-related source omitted] - Network accessline 3152
[Credential-related source omitted] - Network accessline 3153
[Credential-related source omitted] - Network accessline 3154
[Credential-related source omitted] - Network accessline 3155
[Credential-related source omitted] - Network accessline 3156
[Credential-related source omitted] - Network accessline 3157
[Credential-related source omitted] - Network accessline 3158
[Credential-related source omitted] - Network accessline 3159
[Credential-related source omitted] - Network accessline 3160
[Credential-related source omitted] - Network accessline 3161
[Credential-related source omitted] - Network accessline 3162
[Credential-related source omitted] - Network accessline 3163
[Credential-related source omitted] - Network accessline 3167
[Credential-related source omitted] - Network accessline 3172
[Credential-related source omitted] - Network accessline 3173
[Credential-related source omitted] - Network accessline 3177
[Credential-related source omitted] - Network accessline 3178
[Credential-related source omitted] - Network accessline 3180
[Credential-related source omitted] - Network accessline 3181
[Credential-related source omitted] - Network accessline 3183
[Credential-related source omitted] - Network accessline 3184
[Credential-related source omitted] - Network accessline 3196
[Credential-related source omitted] - Network accessline 3222
[Credential-related source omitted] - Network accessline 3223
[Credential-related source omitted] - Network accessline 3254
[Credential-related source omitted] - Network accessline 3255
[Credential-related source omitted] - Dangerous shell operationline 3287
[Credential-related source omitted] - Network accessline 3308
[Credential-related source omitted] - Network accessline 3309
[Credential-related source omitted] - Network accessline 3320
[Credential-related source omitted] - Network accessline 3321
[Credential-related source omitted] - Network accessline 3322
[Credential-related source omitted] - Network accessline 3323
[Credential-related source omitted] - Network accessline 3324
[Credential-related source omitted] - Network accessline 3325
[Credential-related source omitted] - Network accessline 3326
[Credential-related source omitted] - Network accessline 3330
[Credential-related source omitted] - Network accessline 3331
[Credential-related source omitted] - Network accessline 3332
[Credential-related source omitted] - Network accessline 3333
[Credential-related source omitted] - Network accessline 3334
[Credential-related source omitted] - Network accessline 3340
[Credential-related source omitted] - Network accessline 3341
[Credential-related source omitted] - Network accessline 3342
[Credential-related source omitted] - Network accessline 3343
[Credential-related source omitted] - Network accessline 3344
[Credential-related source omitted] - Network accessline 3345
[Credential-related source omitted] - Network accessline 3346
[Credential-related source omitted] - Network accessline 3347
[Credential-related source omitted] - Network accessline 3348
[Credential-related source omitted] - Network accessline 3349
[Credential-related source omitted] - Network accessline 3350
[Credential-related source omitted] - Network accessline 3351
[Credential-related source omitted] - Network accessline 3352
[Credential-related source omitted] - Network accessline 3353
[Credential-related source omitted] - Network accessline 3354
[Credential-related source omitted] - Network accessline 3355
[Credential-related source omitted] - Network accessline 3356
[Credential-related source omitted] - Network accessline 3361
[Credential-related source omitted] - Network accessline 3362
[Credential-related source omitted] - Network accessline 3364
[Credential-related source omitted] - Network accessline 3365
[Credential-related source omitted] - Network accessline 3381
[Credential-related source omitted] - Network accessline 3382
[Credential-related source omitted] - Network accessline 3383
[Credential-related source omitted] - Network accessline 3384
[Credential-related source omitted] - Network accessline 3439
[Credential-related source omitted] - Network accessline 3440
[Credential-related source omitted] - Network accessline 3441
[Credential-related source omitted] - Network accessline 3442
[Credential-related source omitted] - Network accessline 3443
[Credential-related source omitted] - Network accessline 3444
[Credential-related source omitted] - Network accessline 3445
[Credential-related source omitted] - Network accessline 3446
[Credential-related source omitted] - Network accessline 3450
[Credential-related source omitted] - Network accessline 3451
[Credential-related source omitted] - Network accessline 3452
[Credential-related source omitted] - Network accessline 3453
[Credential-related source omitted] - Network accessline 3454
[Credential-related source omitted] - Network accessline 3455
[Credential-related source omitted] - Network accessline 3456
[Credential-related source omitted] - Network accessline 3457
[Credential-related source omitted] - Network accessline 3458
[Credential-related source omitted] - Network accessline 3459
[Credential-related source omitted] - Network accessline 3460
[Credential-related source omitted] - Network accessline 3464
[Credential-related source omitted] - Network accessline 3465
[Credential-related source omitted] - Network accessline 3466
[Credential-related source omitted] - Network accessline 3467
[Credential-related source omitted] - Network accessline 3468
[Credential-related source omitted] - Network accessline 3469
[Credential-related source omitted] - Network accessline 3470
[Credential-related source omitted] - Network accessline 3471
[Credential-related source omitted] - Network accessline 3472
[Credential-related source omitted] - Network accessline 3473
[Credential-related source omitted] - Network accessline 3474
[Credential-related source omitted] - Network accessline 3478
[Credential-related source omitted] - Network accessline 3479
[Credential-related source omitted] - Network accessline 3487
[Credential-related source omitted] - Network accessline 3491
[Credential-related source omitted] - Network accessline 3495
[Credential-related source omitted] - Network accessline 3499
[Credential-related source omitted] - Network accessline 3500
[Credential-related source omitted] - Network accessline 3501
[Credential-related source omitted] - Network accessline 3502
[Credential-related source omitted] - Network accessline 3503
[Credential-related source omitted] - Network accessline 3511
[Credential-related source omitted] - Network accessline 3512
[Credential-related source omitted] - Network accessline 3513
[Credential-related source omitted] - Network accessline 3514
[Credential-related source omitted] - Network accessline 3518
[Credential-related source omitted] - Network accessline 3520
[Credential-related source omitted] - Network accessline 3524
[Credential-related source omitted] - Network accessline 3525
[Credential-related source omitted] - Network accessline 3526
[Credential-related source omitted] - Network accessline 3527
[Credential-related source omitted] - Network accessline 3531
[Credential-related source omitted] - Network accessline 3532
[Credential-related source omitted] - Network accessline 3540
[Credential-related source omitted] - Network accessline 3541
[Credential-related source omitted] - Network accessline 3542
[Credential-related source omitted] - Network accessline 3543
[Credential-related source omitted] - Network accessline 3544
[Credential-related source omitted] - Network accessline 3545
[Credential-related source omitted] - Network accessline 3547
[Credential-related source omitted] - Network accessline 3551
[Credential-related source omitted] - Network accessline 3552
[Credential-related source omitted] - Network accessline 3553
[Credential-related source omitted] - Network accessline 3554
[Credential-related source omitted] - Network accessline 3558
[Credential-related source omitted] - Network accessline 3564
[Credential-related source omitted] - Network accessline 3565
[Credential-related source omitted] - Network accessline 3566
[Credential-related source omitted] - Network accessline 3567
[Credential-related source omitted] - Network accessline 3568
[Credential-related source omitted] - Network accessline 3569
[Credential-related source omitted] - Network accessline 3570
[Credential-related source omitted] - Network accessline 3578
[Credential-related source omitted] - Network accessline 3579
[Credential-related source omitted] - Network accessline 3580
[Credential-related source omitted] - Network accessline 3581
[Credential-related source omitted] - Network accessline 3582
[Credential-related source omitted] - Network accessline 3600
[Credential-related source omitted] - Network accessline 3601
[Credential-related source omitted] - Network accessline 3602
[Credential-related source omitted] - Network accessline 3603
[Credential-related source omitted] - Network accessline 3616
[Credential-related source omitted] - Network accessline 3617
[Credential-related source omitted] - Network accessline 3618
[Credential-related source omitted] - Network accessline 3619
[Credential-related source omitted] - Network accessline 3625
[Credential-related source omitted] - Network accessline 3626
[Credential-related source omitted] - Network accessline 3627
[Credential-related source omitted] - Network accessline 3628
[Credential-related source omitted] - Network accessline 3629
[Credential-related source omitted] - Network accessline 3630
[Credential-related source omitted] - Network accessline 3631
[Credential-related source omitted] - Network accessline 3632
[Credential-related source omitted] - Network accessline 3648
[Credential-related source omitted] - Network accessline 3649
[Credential-related source omitted] - Network accessline 3650
[Credential-related source omitted] - Access to secretsline 3653
[Credential-related source omitted] - Network accessline 3660
[Credential-related source omitted] - Network accessline 3661
[Credential-related source omitted] - Network accessline 3662
[Credential-related source omitted] - Network accessline 3789
[Credential-related source omitted] - Network accessline 3809
[Credential-related source omitted] - Network accessline 3810
[Credential-related source omitted] - Network accessline 3859
[Credential-related source omitted] - Network accessline 3860
[Credential-related source omitted] - Network accessline 3861
[Credential-related source omitted] - Network accessline 3881
[Credential-related source omitted] - Network accessline 3882
[Credential-related source omitted] - Network accessline 3883
[Credential-related source omitted] - Network accessline 3884
[Credential-related source omitted] - Network accessline 3885
[Credential-related source omitted] - Network accessline 3886
[Credential-related source omitted] - Network accessline 3887
[Credential-related source omitted] - Network accessline 3888
[Credential-related source omitted] - Network accessline 3889
[Credential-related source omitted] - Network accessline 3890
[Credential-related source omitted] - Network accessline 3891
[Credential-related source omitted] - Network accessline 3893
[Credential-related source omitted] - Network accessline 3922
[Credential-related source omitted] - Network accessline 3923
[Credential-related source omitted] - Network accessline 3924
[Credential-related source omitted] - Network accessline 3942
[Credential-related source omitted] - Network accessline 3943
[Credential-related source omitted] - Network accessline 3944
[Credential-related source omitted] - Network accessline 3945
[Credential-related source omitted] - Network accessline 3956
[Credential-related source omitted] - Network accessline 3957
[Credential-related source omitted] - Network accessline 3958
[Credential-related source omitted] - Network accessline 3966
[Credential-related source omitted] - Network accessline 3967
[Credential-related source omitted] - Network accessline 3968
[Credential-related source omitted] - Network accessline 3979
[Credential-related source omitted] - Network accessline 3998
[Credential-related source omitted] - Network accessline 3999
[Credential-related source omitted] - Network accessline 4012
[Credential-related source omitted] - Network accessline 4013
[Credential-related source omitted] - Network accessline 4026
[Credential-related source omitted] - Network accessline 4027
[Credential-related source omitted] - Network accessline 4037
[Credential-related source omitted] - Network accessline 4038
[Credential-related source omitted] - Network accessline 4042
[Credential-related source omitted] - Network accessline 4043
[Credential-related source omitted] - Network accessline 4047
[Credential-related source omitted] - Network accessline 4051
[Credential-related source omitted] - Network accessline 4183
[Credential-related source omitted] - Network accessline 4184
[Credential-related source omitted] - Network accessline 4209
[Credential-related source omitted] - Network accessline 4210
[Credential-related source omitted] - Network accessline 4233
[Credential-related source omitted] - Network accessline 4234
[Credential-related source omitted] - Network accessline 4239
[Credential-related source omitted] - Network accessline 4240
[Credential-related source omitted] - Network accessline 4246
[Credential-related source omitted] - Network accessline 4247
[Credential-related source omitted] - Network accessline 4249
[Credential-related source omitted] - Network accessline 4250
[Credential-related source omitted] - Network accessline 4268
[Credential-related source omitted] - Network accessline 4270
[Credential-related source omitted] - Network accessline 4287
[Credential-related source omitted] - Network accessline 4288
[Credential-related source omitted] - Dangerous shell operationline 4316
[Credential-related source omitted] - Network accessline 4326
[Credential-related source omitted] - Network accessline 4327
[Credential-related source omitted] - Network accessline 4329
[Credential-related source omitted] - Network accessline 4330
[Credential-related source omitted] - Access to secretsline 4443
[Credential-related source omitted] - Network accessline 4455
[Credential-related source omitted] - Network accessline 4457
[Credential-related source omitted] - Access to secretsline 4487
[Credential-related source omitted] - Network accessline 4514
[Credential-related source omitted] - Network accessline 4516
[Credential-related source omitted] - Access to secretsline 4538
[Credential-related source omitted] - Access to secretsline 4542
[Credential-related source omitted] - Access to secretsline 4546
[Credential-related source omitted] - Access to secretsline 4549
[Credential-related source omitted] - Access to secretsline 4554
[Credential-related source omitted] - Access to secretsline 4572
[Credential-related source omitted] - Access to secretsline 4573
[Credential-related source omitted] - Access to secretsline 4577
[Credential-related source omitted] - Access to secretsline 4580
[Credential-related source omitted] - Access to secretsline 4583
[Credential-related source omitted] - Access to secretsline 4586
[Credential-related source omitted] - Network accessline 4691
[Credential-related source omitted] - Network accessline 4692
[Credential-related source omitted] - Network accessline 4693
[Credential-related source omitted] - Network accessline 4730
[Credential-related source omitted] - Network accessline 4731
[Credential-related source omitted] - Network accessline 4732
[Credential-related source omitted] - Network accessline 4733
[Credential-related source omitted]
skills/offensive-osint/scripts/h1_reference.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 48
GRAPHQL_URL = "https://hackerone.com/graphql" - Network accessline 50
"Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "Origin": "https://hackerone.com", - Network accessline 51
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36", "Origin": "https://hackerone.com", "Referer": "https://hackerone.com/hacktivity", - Network accessline 52
"Origin": "https://hackerone.com", - Network accessline 53
"Referer": "https://hackerone.com/hacktivity", - Network accessline 100
def gql_raw(query: str) -> dict: payload = json.dumps({"query": query}).encode() req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST") - Network accessline 101
payload = json.dumps({"query": query}).encode() req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST") try: - Network accessline 102
req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST") - Network accessline 103
try: with urllib.request.urlopen(req, timeout=20) as resp: return json.loads(resp.read()) - Network accessline 104
with urllib.request.urlopen(req, timeout=20) as resp: - Network accessline 115
def gql_vars(query: str, variables: dict) -> dict: payload = json.dumps({"query": query, "variables": variables}).encode() req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST") - Network accessline 116
payload = json.dumps({"query": query, "variables": variables}).encode() req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST") try: - Network accessline 117
req = urllib.request.Request(GRAPHQL_URL, data=payload, headers=HEADERS, method="POST") - Network accessline 118
try: with urllib.request.urlopen(req, timeout=20) as resp: return json.loads(resp.read()) - Network accessline 119
with urllib.request.urlopen(req, timeout=20) as resp: - Network accessline 349
type=int, default=1, help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.", - Network accessline 350
default=1, help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.", ) - Network accessline 351
help="Number of pages to fetch (50 results/page, default: 1). Use 5-20 for keyword searches.",
skills/offensive-osint/scripts/secret_scan.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 36
[Credential-related source omitted] - Network accessline 49
("SLACK_TOKEN", SEV_HIGH, "slack", r"\bxox[abpors]-[0-9A-Za-z\-]{10,48}\b"), ("SLACK_WEBHOOK", SEV_MEDIUM, "slack", r"https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"), - Network accessline 50
("SLACK_WEBHOOK", SEV_MEDIUM, "slack", r"https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[A-Za-z0-9]+"), - Access to secretsline 80
[Credential-related source omitted] - Network accessline 107
[Credential-related source omitted] - Network accessline 109
[Credential-related source omitted] - Access to secretsline 131
[Credential-related source omitted] - Access to secretsline 135
[Credential-related source omitted] - Access to secretsline 139
[Credential-related source omitted] - Access to secretsline 142
[Credential-related source omitted] - Access to secretsline 147
[Credential-related source omitted] - Access to secretsline 165
[Credential-related source omitted] - Access to secretsline 166
[Credential-related source omitted] - Access to secretsline 170
[Credential-related source omitted] - Access to secretsline 173
[Credential-related source omitted] - Access to secretsline 176
[Credential-related source omitted] - Access to secretsline 179
[Credential-related source omitted]
skills/org-attack-surface/SKILL.md
- Network accessline 320
LEI=$(curl -sk "https://api.gleif.org/api/v1/lei-records?filter[entity.legalName]=Acme%20Corporation&page[size]=1" \ - Network accessline 326
$r = Invoke-RestMethod -Uri "https://api.gleif.org/api/v1/lei-records?filter[entity.legalName]=Acme%20Corporation&page[size]=1" ` - Network accessline 334
curl -sk "https://api.gleif.org/api/v1/lei-records/$LEI/direct-children?page[size]=100" \ - Network accessline 340
$children = Invoke-RestMethod -Uri "https://api.gleif.org/api/v1/lei-records/$lei/direct-children?page[size]=100" ` - Network accessline 384
curl -sk 'https://efts.sec.gov/LATEST/search-index?q=%22Acme%20Corporation%22&forms=10-K' \ - Network accessline 390
$headers = @{ "User-Agent" = "YourOrg-Recon research@yourdomain.example" } $r = Invoke-RestMethod -Uri 'https://efts.sec.gov/LATEST/search-index?q=%22Acme%20Corporation%22&forms=10-K' -Headers $headers - Network accessline 391
$r = Invoke-RestMethod -Uri 'https://efts.sec.gov/LATEST/search-index?q=%22Acme%20Corporation%22&forms=10-K' -Headers $headers - Network accessline 419
curl -sk "https://api.opencorporates.com/v0.4/companies/search?q=Acme+Corporation" | \ - Network accessline 424
$r = Invoke-RestMethod -Uri "https://api.opencorporates.com/v0.4/companies/search?q=Acme+Corporation" - Network accessline 448
curl -sk -G "https://query.wikidata.org/sparql" \ - Network accessline 470
} LIMIT 50 '@ $r = Invoke-RestMethod -Uri "https://query.wikidata.org/sparql" -Body @{ format = "json"; query = $query } ` - Network accessline 471
'@ $r = Invoke-RestMethod -Uri "https://query.wikidata.org/sparql" -Body @{ format = "json"; query = $query } ` -Headers @{ Accept = "application/sparql-results+json" } - Network accessline 472
$r = Invoke-RestMethod -Uri "https://query.wikidata.org/sparql" -Body @{ format = "json"; query = $query } ` - Network accessline 538
# 1. PREVIEW — free, returns a count, does not consume a purchase credit curl -sk -X POST "https://reverse-whois.whoisxmlapi.com/api/v2" \ - Network accessline 539
[Credential-related source omitted] - Access to secretsline 539
[Credential-related source omitted] - Access to secretsline 541
[Credential-related source omitted] - Network accessline 544
# 2. Only if 1 <= count < 200, PURCHASE — the real result curl -sk -X POST "https://reverse-whois.whoisxmlapi.com/api/v2" \ - Network accessline 545
[Credential-related source omitted] - Access to secretsline 545
[Credential-related source omitted] - Access to secretsline 547
[Credential-related source omitted] - Network accessline 552
[Credential-related source omitted] - Access to secretsline 552
[Credential-related source omitted] - Network accessline 553
basicSearchTerms = @{ include = @("Acme Corporation") } } | ConvertTo-Json $preview = Invoke-RestMethod -Uri "https://reverse-whois.whoisxmlapi.com/api/v2" -Method Post ` -ContentType "application/json" -Body $body - Network accessline 554
$preview = Invoke-RestMethod -Uri "https://reverse-whois.whoisxmlapi.com/api/v2" -Method Post ` - Access to secretsline 557
[Credential-related source omitted] - Network accessline 558
basicSearchTerms = @{ include = @("Acme Corporation") } } | ConvertTo-Json $result = Invoke-RestMethod -Uri "https://reverse-whois.whoisxmlapi.com/api/v2" -Method Post ` - Network accessline 559
$result = Invoke-RestMethod -Uri "https://reverse-whois.whoisxmlapi.com/api/v2" -Method Post ` - Network accessline 572
[Credential-related source omitted] - Access to secretsline 572
[Credential-related source omitted] - Network accessline 582
curl -sk "https://crt.sh/?O=Acme+Corporation&output=json" -H "User-Agent: Mozilla/5.0" | \ - Network accessline 587
$r = Invoke-RestMethod -Uri "https://crt.sh/?O=Acme+Corporation&output=json" -Headers @{ "User-Agent" = "Mozilla/5.0" } - Network accessline 707
# 1. Find org handles matching a name (wildcard suffix) curl -sk "https://whois.arin.net/rest/orgs;name=Acme*" -H "Accept: application/json" | \ - Network accessline 708
curl -sk "https://whois.arin.net/rest/orgs;name=Acme*" -H "Accept: application/json" | \ - Network accessline 711
# 2. For each matched handle, list its registered nets curl -sk "https://whois.arin.net/rest/org/ACME-1/nets" -H "Accept: application/json" | \ - Network accessline 712
curl -sk "https://whois.arin.net/rest/org/ACME-1/nets" -H "Accept: application/json" | \ - Network accessline 715
# 3. And its registered ASNs curl -sk "https://whois.arin.net/rest/org/ACME-1/asns" -H "Accept: application/json" | \ - Network accessline 716
curl -sk "https://whois.arin.net/rest/org/ACME-1/asns" -H "Accept: application/json" | \ - Network accessline 721
$orgs = Invoke-RestMethod -Uri "https://whois.arin.net/rest/orgs;name=Acme*" -Headers @{ Accept = "application/json" } - Network accessline 724
$nets = Invoke-RestMethod -Uri "https://whois.arin.net/rest/org/ACME-1/nets" -Headers @{ Accept = "application/json" } - Network accessline 727
$asns = Invoke-RestMethod -Uri "https://whois.arin.net/rest/org/ACME-1/asns" -Headers @{ Accept = "application/json" } - Network accessline 738
# 1. Find organisation objects matching a name curl -sk "https://rest.db.ripe.net/search.json?query-string=Acme%20Corporation&type-filter=organisation&flags=no-referenced" | \ - Network accessline 739
curl -sk "https://rest.db.ripe.net/search.json?query-string=Acme%20Corporation&type-filter=organisation&flags=no-referenced" | \ - Network accessline 742
# 2. Inverse-lookup everything registered TO that org handle (inetnum/inet6num/aut-num) curl -sk "https://rest.db.ripe.net/search.json?query-string=ORG-AC1-RIPE&inverse-attribute=org&type-filter=inetnum&type-filter=inet6num&type-filter=aut- - Network accessline 743
curl -sk "https://rest.db.ripe.net/search.json?query-string=ORG-AC1-RIPE&inverse-attribute=org&type-filter=inetnum&type-filter=inet6num&type-filter=aut-num&flags=no-referenced" | \ - Network accessline 748
$orgs = Invoke-RestMethod -Uri "https://rest.db.ripe.net/search.json?query-string=Acme%20Corporation&type-filter=organisation&flags=no-referenced" - Network accessline 750
$inv = Invoke-RestMethod -Uri "https://rest.db.ripe.net/search.json?query-string=ORG-AC1-RIPE&inverse-attribute=org&type-filter=inetnum&type-filter=inet6num&type-filter=aut-num&flags=no-referenced" - Network accessline 783
# IP → ASN (RIPEstat, free, CORS-friendly) curl -sk "https://stat.ripe.net/data/network-info/data.json?resource=8.8.8.8" | jq '.data.asns' - Network accessline 784
curl -sk "https://stat.ripe.net/data/network-info/data.json?resource=8.8.8.8" | jq '.data.asns' - Network accessline 786
# ASN → holder org (RIPEstat whois wrapper) curl -sk "https://stat.ripe.net/data/whois/data.json?resource=AS15169" | jq '.data.records' - Network accessline 787
curl -sk "https://stat.ripe.net/data/whois/data.json?resource=AS15169" | jq '.data.records' - Network accessline 789
# ASN → announced prefixes (RIPEstat) curl -sk "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS15169" | jq -r '.data.prefixes[].prefix' - Network accessline 790
curl -sk "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS15169" | jq -r '.data.prefixes[].prefix' - Network accessline 792
# ASN → announced prefixes (BGPView — complements RIPEstat, better ARIN/US coverage; keyless, light rate-limit) curl -sk "https://api.bgpview.io/asn/15169/prefixes" | jq -r '.data.ipv4_prefixes[].prefix, .data.ipv6_prefixes[].prefix' - Network accessline 793
curl -sk "https://api.bgpview.io/asn/15169/prefixes" | jq -r '.data.ipv4_prefixes[].prefix, .data.ipv6_prefixes[].prefix' - Network accessline 797
$net = Invoke-RestMethod -Uri "https://stat.ripe.net/data/network-info/data.json?resource=8.8.8.8" - Network accessline 800
$who = Invoke-RestMethod -Uri "https://stat.ripe.net/data/whois/data.json?resource=AS15169" - Network accessline 803
$pfx = Invoke-RestMethod -Uri "https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS15169" - Network accessline 806
$bgpview = Invoke-RestMethod -Uri "https://api.bgpview.io/asn/15169/prefixes" - Network accessline 814
echo -e "begin\nverbose\n8.8.8.8\n1.1.1.1\nend" | nc whois.cymru.com 43 - Network accessline 1040
14. *"How do I combine a cert_org_match signal and a shared_mx_custom signal into one confidence score?"* → §8.4 (the `1-Π(1-w_i)` formula + weight table). 15. *"Give me the ARIN and RIPE curl recipes for org-first netblock discovery."* - Network accessline 1041
score?"* → §8.4 (the `1-Π(1-w_i)` formula + weight table). 15. *"Give me the ARIN and RIPE curl recipes for org-first netblock discovery."* → §9.1. 16. *"Full external recon on a company name — where does this skill end and `offensive-osint - Network accessline 1042
15. *"Give me the ARIN and RIPE curl recipes for org-first netblock discovery."* → §9.1.
skills/osint-autopilot/SKILL.md
- Network accessline 64
Re-curl every CONFIRMED-worthy claim before reporting it: exposed secrets (fetch the JS/vars file), `/version` disclosures, Cognito/Auth0 config, any "unauth admin 200". Downgrade anything you can't reproduce.
skills/osint-autopilot/scripts/build_xlsx.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/osint-autopilot/scripts/findings_gen.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 147
for h in ([D, f"www.{D}"] + [x for x in live_hosts if x.startswith("www.")]): try: body = subprocess.run(["curl","-sk","--max-time","8",f"https://{h}/"], - Network accessline 148
try: body = subprocess.run(["curl","-sk","--max-time","8",f"https://{h}/"], capture_output=True, text=True, timeout=12).stdout - Network accessline 149
body = subprocess.run(["curl","-sk","--max-time","8",f"https://{h}/"],
skills/osint-autopilot/scripts/host_enum.workflow.js
- Executable scriptline 1
Executable file - Network accessline 31
For EACH host, using Bash, low-intrusion + rate-limited: 1. Content discovery: ${FFUF} -u https://HOST/FUZZ -w ${WL} -mc 200,201,204,301,302,307,401,403,405,500 -t 15 -rate 25 -timeout 8 -s -o ${OUT}/ffuf-HOST.json -of json - Network accessline 32
1. Content discovery: ${FFUF} -u https://HOST/FUZZ -w ${WL} -mc 200,201,204,301,302,307,401,403,405,500 -t 15 -rate 25 -timeout 8 -s -o ${OUT}/ffuf-HOST.json -of json Read the json; KEEP only interesting paths (200/201/401/403 OR admin/a - Network accessline 33
[Credential-related source omitted] - Access to secretsline 33
[Credential-related source omitted] - Network accessline 34
2. curl -sk https://HOST/ ; identify tech (WordPress, SPA/React, nginx, envoy, S3, ELB, login panel, API JSON). - Network accessline 35
3. Grep homepage for script src=*.js; for FIRST-PARTY app bundles (skip fontawesome/gtm/analytics CDNs) curl (cap 6MB) and grep for API routes ("/api..","/v1..","/iam-api","/graphql") and secrets (AKIA[0-9A-Z]{16}, AIza[0-9A-Za-z_-]{35}, ey
skills/osint-autopilot/scripts/recon_pipeline.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 2
# osint-autopilot deterministic driver — Stages 1-3 + endpoint harvest + breach + ports. # Usage: recon_pipeline.sh <domain> # Host-specific: uses dig/curl (dnsx + pd-httpx segfault on m1cpu); nmap kept bounded. - Network accessline 4
# Host-specific: uses dig/curl (dnsx + pd-httpx segfault on m1cpu); nmap kept bounded. - Network accessline 26
{ for r in A AAAA MX NS SOA TXT CAA; do echo "=== $r ==="; dig +noall +answer "$D" $r; done; } > "$S1/dns-records.txt" 2>&1 whois "$D" > "$S1/whois.txt" 2>&1 curl -s --max-time 20 "https://rdap.org/domain/$D" -o "$S1/rdap.json" 2>/dev/null - Network accessline 27
whois "$D" > "$S1/whois.txt" 2>&1 curl -s --max-time 20 "https://rdap.org/domain/$D" -o "$S1/rdap.json" 2>/dev/null { echo "=== SPF ==="; dig +short "$D" TXT | grep -i spf - Network accessline 28
curl -s --max-time 20 "https://rdap.org/domain/$D" -o "$S1/rdap.json" 2>/dev/null - Network accessline 34
echo "[2] Expansion: subfinder + certspotter + crt.sh (union), resolve, permutation" subfinder -d "$D" -silent -all 2>/dev/null | sort -u > "$S2/subs-subfinder.txt" curl -s --max-time 30 "https://api.certspotter.com/v1/issuances?domain=$D&i - Network accessline 35
subfinder -d "$D" -silent -all 2>/dev/null | sort -u > "$S2/subs-subfinder.txt" curl -s --max-time 30 "https://api.certspotter.com/v1/issuances?domain=$D&include_subdomains=true&expand=dns_names" \ | jq -r '.[].dns_names[]?' 2>/dev/null | - Network accessline 36
curl -s --max-time 30 "https://api.certspotter.com/v1/issuances?domain=$D&include_subdomains=true&expand=dns_names" \ - Network accessline 37
| jq -r '.[].dns_names[]?' 2>/dev/null | tr 'A-Z' 'a-z' | sed 's/\*\.//g' | grep "$D\$" | sort -u > "$S2/subs-certspotter.txt" curl -s --max-time 40 "https://crt.sh/?q=%25.$D&output=json" | jq -r '.[].name_value' 2>/dev/null \ | tr 'A-Z' - Network accessline 38
curl -s --max-time 40 "https://crt.sh/?q=%25.$D&output=json" | jq -r '.[].name_value' 2>/dev/null \ - Network accessline 49
echo "[3] Enrichment: HTTP probe (parallel curl)" probe(){ h="$1"; o=$(curl -skI --max-time 6 -w 'HTTPCODE=%{http_code}' "https://$h/" 2>/dev/null) - Network accessline 50
probe(){ h="$1"; o=$(curl -skI --max-time 6 -w 'HTTPCODE=%{http_code}' "https://$h/" 2>/dev/null) - Network accessline 60
echo "[3b] Identity fabric (Entra realm / OIDC / Okta)" curl -s --max-time 15 "https://login.microsoftonline.com/getuserrealm.srf?login=user@$D&xml=1" -o "$ID/getuserrealm.xml" 2>/dev/null - Network accessline 61
curl -s --max-time 15 "https://login.microsoftonline.com/getuserrealm.srf?login=user@$D&xml=1" -o "$ID/getuserrealm.xml" 2>/dev/null - Network accessline 62
curl -s --max-time 15 "https://login.microsoftonline.com/$D/.well-known/openid-configuration" -o "$ID/oidc-config.json" 2>/dev/null - Network accessline 64
[ -n "$OKTA" ] && curl -s --max-time 12 "https://$OKTA/.well-known/okta-organization" -o "$ID/okta-org.json" 2>/dev/null - Network accessline 67
: > "$S3/version-disclosure.txt" grep -iE '^(auth|iam)\.' "$S2/live-hosts.txt" | while read -r h; do v=$(curl -sk --max-time 6 "https://$h/version" 2>/dev/null | head -c 400) - Network accessline 68
grep -iE '^(auth|iam)\.' "$S2/live-hosts.txt" | while read -r h; do v=$(curl -sk --max-time 6 "https://$h/version" 2>/dev/null | head -c 400) echo "$v" | grep -qiE 'version|revision|hydra|kratos|keto|loki' && echo "$h :: $v" >> "$S3/ver - Network accessline 69
v=$(curl -sk --max-time 6 "https://$h/version" 2>/dev/null | head -c 400) - Network accessline 74
: > "$S3/s3-validation.txt" awk -F'|' '$3=="AmazonS3"{print $1}' "$S3/http-probe.txt" | while read -r h; do cn=$(dig +short "$h" CNAME | paste -sd, -); b=$(curl -sk --max-time 8 "https://$h/" 2>/dev/null | head -c 400) - Network accessline 75
awk -F'|' '$3=="AmazonS3"{print $1}' "$S3/http-probe.txt" | while read -r h; do cn=$(dig +short "$h" CNAME | paste -sd, -); b=$(curl -sk --max-time 8 "https://$h/" 2>/dev/null | head -c 400) t="-"; echo "$b" | grep -qi 'NoSuchBucket' && - Network accessline 76
cn=$(dig +short "$h" CNAME | paste -sd, -); b=$(curl -sk --max-time 8 "https://$h/" 2>/dev/null | head -c 400) - Network accessline 89
[Credential-related source omitted] - Access to secretsline 89
[Credential-related source omitted] - Network accessline 90
awk -F'|' '$2==200{print $1}' "$S3/http-probe.txt" | head -60 | while read -r h; do html=$(curl -sk --max-time 8 "https://$h/" 2>/dev/null) echo "$html" | grep -oE '(src|href)="[^"]+\.js[^"]*"' | sed -E 's/(src|href)="//;s/"//' | while - Network accessline 91
html=$(curl -sk --max-time 8 "https://$h/" 2>/dev/null) - Network accessline 92
echo "$html" | grep -oE '(src|href)="[^"]+\.js[^"]*"' | sed -E 's/(src|href)="//;s/"//' | while read -r j; do case "$j" in http*) u="$j";; /*) u="https://$h$j";; *) u="https://$h/$j";; esac echo "$j" | grep -qiE 'fontawesome|googlet - Network accessline 93
case "$j" in http*) u="$j";; /*) u="https://$h$j";; *) u="https://$h/$j";; esac echo "$j" | grep -qiE 'fontawesome|googletagmanager|google-analytics|gstatic|jquery|cloudflareinsights' && continue body=$(curl -sk --max-time 15 "$u" 2 - Network accessline 94
echo "$j" | grep -qiE 'fontawesome|googletagmanager|google-analytics|gstatic|jquery|cloudflareinsights' && continue body=$(curl -sk --max-time 15 "$u" 2>/dev/null | head -c 6000000) echo "$body" | grep -oE '"/(api|v[0-9]|iam-api|gra - Network accessline 95
body=$(curl -sk --max-time 15 "$u" 2>/dev/null | head -c 6000000) - Network accessline 104
echo "[4] Breach (HudsonRock free)" curl -s --max-time 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=$D" -o "$BR/hudsonrock-domain.json" 2>/dev/null - Network accessline 105
curl -s --max-time 30 "https://cavalier.hudsonrock.com/api/json/v2/osint-tools/search-by-domain?domain=$D" -o "$BR/hudsonrock-domain.json" 2>/dev/null
skills/osint-autopilot/scripts/test_domain_guard.sh
skills/osint-autopilot/scripts/wordlist.txt
- Access to secretsline 51
[Credential-related source omitted]
skills/osint-methodology/SKILL.md
- Access to secretsline 292
[Credential-related source omitted] - Dangerous shell operationline 302
**Email priority:** exec (CEO/CFO/CISO) → IT/helpdesk/security → dev/engineer/DBA → sales/HR/finance → generic role accounts. - Network accessline 350
The following modules have full implementation detail — probe paths, wordlists, curl one-liners, regexes, and scoring rubrics — in `offensive-osint`. This skill defines *what to do*; that skill defines *how to do it*.
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Combined signals: 3 facts
- Passes downloaded content to an interpreteroffensive-osint/SKILL.md:836High confidence
- Passes downloaded content to an interpreteroffensive-osint/SKILL.md:839High confidence
- Reads a credential store, and the same file sends data over the network or runs a command (line 2083)offensive-osint/SKILL.md:2009High confidence
Signal confidence: 497 facts
- Network access in prose of documentationcloud-saas-exposure/README.md:83Low confidence
- Network access in prose of documentationcloud-saas-exposure/README.md:84Low confidence
- Network access in prose of documentationcloud-saas-exposure/README.md:85Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:63Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:64Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:65Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:232Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:233Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:234Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:235Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:236Low confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:313High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:314High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:315High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:316High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:317High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:318High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:319High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:327High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:328High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:329High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:330High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:331High confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:423Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:424Low confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:603High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:604High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:628High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:629High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:630High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:631High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:632High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:633High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:635High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:646High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:647High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:648High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:649High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:650High confidence
- Network access in code of the SKILL.mdcloud-saas-exposure/SKILL.md:651High confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:675Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:676Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:677Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:732Low confidence
- Network access in prose of the SKILL.mdcloud-saas-exposure/SKILL.md:733Low confidence
- Network access in prose of the SKILL.mdcontinuous-exposure-monitoring/SKILL.md:319Low confidence
- Network access in prose of the SKILL.mdcontinuous-exposure-monitoring/SKILL.md:320Low confidence
- Network access in prose of the SKILL.mdcontinuous-exposure-monitoring/SKILL.md:321Low confidence
- Network access in prose of the SKILL.mdcontinuous-exposure-monitoring/SKILL.md:322Low confidence
- Network access in prose of the SKILL.mdcontinuous-exposure-monitoring/SKILL.md:323Low confidence
and 447 more
Only the first 500 facts are listed.
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Native | Path .claude/skills/run-claude-osint/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md skills/cloud-saas-exposure/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md skills/cloud-saas-exposure/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md skills/cloud-saas-exposure/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md skills/cloud-saas-exposure/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md skills/cloud-saas-exposure/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
Explore alternatives and comparisons
Add this badge to your README
It updates every night and links to this page.
[](https://hotskills.dev/skill/elementalsouls-claude-osint/)