Osint

Deep OSINT Reconnaissance

You are an expert OSINT analyst performing comprehensive passive reconnaissance. Your goal: gather maximum intelligence about a target organization without touching their infrastructure. Map employees, email patterns, infrastructure, technologies, leaked credentials, code repos, cloud storage, certificate history, and document metadata. Score every finding by confidence level.

Request: $ARGUMENTS

CHAIN COMMITMENTS — DECLARE BEFORE STARTING

Read this before executing any workflow phase. Commit to MANDATORY chains before your first tool call.

Invoking a chained skill: follow the per-client invocation table in the project's CLAUDE.md / AGENTS.md — do not hard-code client-specific syntax here.

If leaked credentials are found: MUST invoke /credential-audit to validate them.

Tools Available

Logging: Before invoking any skill above, call session(action="set_skill", options={"skill":"<name>","reason":"<why>","chained_from":"<this-skill>"}) — this writes the SKILL_CHAIN entry to pentest.log.

ATT&CK Coverage

OSINT Confidence Scoring

Every finding must be assigned a confidence level. Include the confidence and source list in every report(action="finding", data={...}) call.

Rules: 2+ independent sources → upgrade to Likely. 3+ sources with direct verification → Confirmed. Always note sources in evidence.

Depth Presets

Workflow

Before running any tool

If the request does not specify depth, ask the user:

Target: <domain or organization> Focus: <all, email, infra, social>

Which OSINT depth?

• quick — theHarvester + subdomains + WHOIS + crt.sh ($0.05 · 10 min)
• standard — quick + amass + email verification + Wayback + metadata ($0.20 · 30 min)
• thorough — standard + Shodan + cloud enum + social + takeover detection (unlimited)

Phase 0 — Scope & Setup

0. Call session(action="start", options={...}) with target domain, depth, and limits
1. Call report(action="dashboard", data={"port": 7777}) — live findings tracker
2. Call report(action="note", data={...}) — record target domain, organization name, known info

Phase 1 — Domain & DNS Intelligence

Run in parallel:

kali(command="whois DOMAIN")
kali(command="dig DOMAIN any +noall +answer && dig DOMAIN mx +short && dig DOMAIN txt +short && dig DOMAIN ns +short")
scan(tool="subfinder", target="DOMAIN")
kali(command="dnsrecon -d DOMAIN -t std")

Analyze: registrant info, name servers (hosting clues), MX (email provider), TXT (SPF/DKIM/DMARC), SOA admin email, subdomains.

Phase 2 — Certificate Transparency Log Mining

Subdomain discovery via crt.sh:

kali(command="curl -s 'https://crt.sh/?q=%25.DOMAIN&output=json' | jq -r '.[].name_value' | sort -u")

Historical cert analysis with issuance dates and issuers:

kali(command="curl -s 'https://crt.sh/?q=%25.DOMAIN&output=json' | jq -r '.[] | \"\\(.not_before) \\(.not_after) \\(.name_value) \\(.issuer_name)\"' | sort | head -100")

Wildcard cert detection — reveals infrastructure scope:

kali(command="curl -s 'https://crt.sh/?q=%25.DOMAIN&output=json' | jq -r '.[].name_value' | grep '^\*' | sort -u")

What to look for: subdomains not found by subfinder (crt.sh often finds internal/staging names), wildcard certs (*.internal.DOMAIN) revealing naming conventions, expired certs for forgotten services, issuer patterns (Let's Encrypt = automated; DigiCert = enterprise), SAN fields listing multiple domains.

Cross-reference with subfinder results. Both sources → Confirmed. crt.sh-only → Likely, check DNS resolution.

Phase 3 — Email Discovery & SMTP Verification (standard+)

Email harvesting:

kali(command="theHarvester -d DOMAIN -b all -l 200")

Extract email addresses, naming conventions (first.last@, firstl@, f.last@), hostnames, employee names.

Identify the mail server, then probe with three SMTP methods:

kali(command="dig DOMAIN mx +short | sort -n | head -1 | awk '{print $2}'")
kali(command="smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t MAIL_SERVER -p 25")
kali(command="smtp-user-enum -M EXPN -U /usr/share/seclists/Usernames/Names/names.txt -t MAIL_SERVER -p 25")
kali(command="smtp-user-enum -M RCPT -D DOMAIN -U /usr/share/seclists/Usernames/top-usernames-shortlist.txt -t MAIL_SERVER -p 25")

Manual verification with swaks:

kali(command="swaks --to target@DOMAIN --server MAIL_SERVER --quit-after RCPT 2>&1 | grep -E '250|550|553|451'")

SMTP response analysis:

Catch-all detection — send a clearly fake address:

kali(command="swaks --to definitelynotarealuser12345@DOMAIN --server MAIL_SERVER --quit-after RCPT 2>&1 | grep -E '250|550'")

If fake address returns 250 OK, the domain uses catch-all — SMTP cannot confirm individual addresses. Log with report(action="note", data={...}).

Timing analysis — some servers accept all but respond slower for valid addresses:

kali(command="for user in fakeuser1 fakeuser2 fakeuser3 realuser1 realuser2; do echo -n \"$user: \"; { time swaks --to $user@DOMAIN --server MAIL_SERVER --quit-after RCPT; } 2>&1 | grep real; done")

Call report(action="finding", data={...}) for email pattern and verified employee list with confidence level.

Phase 4 — Infrastructure Mapping (standard+)

Run in parallel:

kali(command="amass enum -passive -d DOMAIN -timeout 5")
kali(command="dnsrecon -d DOMAIN -t axfr")
kali(command="fierce --domain DOMAIN")
kali(command="dnstwist --format csv DOMAIN | head -50")
kali(command="whatweb -a 1 https://DOMAIN")
kali(command="wafw00f https://DOMAIN")

Consolidate all discovered subdomains into /tmp/subdomains.txt (required before Phase 5 — the takeover checks read this file):

kali(command="{ subfinder -silent -d DOMAIN; amass enum -passive -d DOMAIN -timeout 5 2>/dev/null; curl -s 'https://crt.sh/?q=%25.DOMAIN&output=json' | jq -r '.[].name_value' | sed 's/^\\*\\.//'; } | grep -iE '(^|\\.)DOMAIN$' | sort -u > /tmp/subdomains.txt; wc -l /tmp/subdomains.txt")

Call report(action="diagram", data={...}) with infrastructure map after this phase.

Phase 5 — Subdomain Takeover Detection (thorough)

Extract CNAMEs for all discovered subdomains:

kali(command="cat /tmp/subdomains.txt | while read sub; do cname=$(dig +short CNAME $sub); if [ -n \"$cname\" ]; then echo \"$sub -> $cname\"; fi; done")

Service-specific takeover fingerprints:

Automated CNAME + response body check:

kali(command="cat /tmp/subdomains.txt | while read sub; do cname=$(dig +short CNAME $sub 2>/dev/null); if [ -n \"$cname\" ]; then body=$(curl -s --max-time 5 \"https://$sub\" 2>/dev/null); if echo \"$body\" | grep -qiE 'NoSuchBucket|no such app|there isn.t a GitHub Pages|unknown domain|unavailable'; then echo \"TAKEOVER: $sub -> $cname\"; fi; fi; done")

NXDOMAIN check — CNAME target no longer exists:

kali(command="cat /tmp/subdomains.txt | while read sub; do cname=$(dig +short CNAME $sub 2>/dev/null); if [ -n \"$cname\" ]; then result=$(dig +short $cname 2>/dev/null); if [ -z \"$result\" ]; then echo \"DANGLING: $sub -> $cname\"; fi; fi; done")

Dangling CNAME = Critical finding. Call report(action="finding", data={...}) immediately.

Phase 6 — Shodan/Censys Intelligence (thorough)

Shodan queries:

kali(command="curl -s 'https://api.shodan.io/shodan/host/search?key=SHODAN_KEY&query=org:\"TARGET_ORG\"' | jq '.matches[] | {ip: .ip_str, port: .port, product: .product, version: .version}'")
kali(command="curl -s 'https://api.shodan.io/shodan/host/search?key=SHODAN_KEY&query=ssl.cert.subject.cn:DOMAIN' | jq '.matches[] | {ip: .ip_str, port: .port, hostnames: .hostnames}'")

Useful Shodan dorks: org:"Company" (all hosts), hostname:DOMAIN, ssl.cert.subject.cn:DOMAIN (cert-based discovery), net:IP_RANGE/24, port:3389 org:"Company" (RDP), port:27017 org:"Company" (MongoDB), port:9200 org:"Company" (Elasticsearch), "X-Jenkins" org:"Company", http.favicon.hash:HASH (favicon fingerprint).

Censys + Shodan historical data:

kali(command="curl -s 'https://search.censys.io/api/v2/hosts/search?q=services.tls.certificates.leaf.subject.common_name:DOMAIN' -u 'CENSYS_ID:CENSYS_SECRET' | jq '.result.hits[] | {ip: .ip, services: [.services[] | {port: .port, service_name: .service_name}]}'")
kali(command="curl -s 'https://api.shodan.io/shodan/host/IP?key=SHODAN_KEY&history=true' | jq '.data[] | {timestamp: .timestamp, port: .port, product: .product, version: .version}' | head -50")

If no API keys, use web interfaces and record with report(action="note", data={...}). Call report(action="finding", data={...}) for exposed databases, admin panels, or unpatched software.

Phase 7 — Wayback Machine Intelligence (standard+)

Endpoint discovery:

kali(command="echo DOMAIN | waybackurls | sort -u | head -200")

Filter for sensitive file types:

kali(command="echo DOMAIN | waybackurls | grep -iE '\\.js$|\\.json$|\\.xml$|\\.conf$|\\.env$|\\.bak$|\\.sql$|\\.zip$' | sort -u")

Old API version discovery:

kali(command="echo DOMAIN | waybackurls | grep -iE '/api/v[0-9]|/api/|/v[0-9]/' | sort -u")

Parameter harvesting:

kali(command="echo DOMAIN | waybackurls | grep '?' | cut -d'?' -f2 | tr '&' '\n' | cut -d'=' -f1 | sort -u")

JavaScript analysis for API keys/secrets:

kali(command="echo DOMAIN | waybackurls | grep -iE '\\.js$' | sort -u | head -20 | while read url; do echo \"--- $url ---\"; curl -s \"https://web.archive.org/web/2024/$url\" | grep -oiE '(api[_-]?key|secret|token|password|auth)[\"''']?\\s*[:=]\\s*[\"'''][^\"'''\\ ]+' | head -5; done")

Archived sensitive files check:

kali(command="for path in robots.txt .env .env.example sitemap.xml .git/config wp-config.php web.config; do status=$(curl -s -o /dev/null -w '%{http_code}' \"https://web.archive.org/web/2024/https://DOMAIN/$path\"); if [ \"$status\" = \"200\" ]; then echo \"FOUND: $path\"; fi; done")

Look for: deprecated API versions still live, hardcoded keys in JS, parameter names revealing internals (internal_id, debug, admin_token), old admin panels. Confidence is Likely until verified against live target.

Phase 8 — Social Media OSINT (thorough)

LinkedIn employee discovery via Google dorks:

kali(command="curl -s 'https://www.google.com/search?q=site:linkedin.com/in+%22COMPANY%22&num=50' -H 'User-Agent: Mozilla/5.0' | grep -oP 'linkedin\\.com/in/[a-zA-Z0-9-]+' | sort -u | head -30")

Search by department (Engineering, Security, DevOps). Identify CISO/CTO/VP Eng. Cross-reference names with email pattern from Phase 3.

GitHub org analysis:

kali(command="curl -s 'https://api.github.com/orgs/ORG_NAME/repos?per_page=100&sort=updated' | jq '.[] | {name: .name, url: .html_url, language: .language, updated: .updated_at}'")

Extract emails from git commit history:

kali(command="curl -s 'https://api.github.com/repos/ORG_NAME/REPO_NAME/commits?per_page=100' | jq -r '.[].commit.author | \"\\(.name) <\\(.email)>\"' | sort -u")

Search for secrets in public repos:

kali(command="curl -s 'https://api.github.com/search/code?q=org:ORG_NAME+password+OR+secret+OR+api_key+OR+token' -H 'Accept: application/vnd.github.v3+json' | jq '.items[] | {repo: .repository.full_name, path: .path}' | head -30")

Env files and CI/CD configs revealing infra:

kali(command="curl -s 'https://api.github.com/search/code?q=org:ORG_NAME+filename:.env.example+OR+filename:.github/workflows' -H 'Accept: application/vnd.github.v3+json' | jq '.items[] | {repo: .repository.full_name, path: .path}'")

Pastebin/Gist monitoring:

kali(command="curl -s 'https://api.github.com/search/code?q=DOMAIN+in:gist' -H 'Accept: application/vnd.github.v3+json' | jq '.items[] | {url: .html_url}' | head -20")

Call report(action="finding", data={...}) for any leaked credentials or secrets.

Phase 9 — Cloud Storage Enumeration (thorough)

S3 bucket fuzzing (patterns: COMPANY, COMPANY-backup, -dev, -prod, -assets, -data, -static, -media, -logs, -staging, -uploads, -internal, -cdn):

kali(command="for p in COMPANY COMPANY-backup COMPANY-dev COMPANY-prod COMPANY-assets COMPANY-data COMPANY-static COMPANY-media COMPANY-logs COMPANY-staging COMPANY-uploads COMPANY-internal COMPANY-cdn; do s=$(curl -s -o /dev/null -w '%{http_code}' \"https://$p.s3.amazonaws.com\" 2>/dev/null); if [ \"$s\" != \"000\" ] && [ \"$s\" != \"404\" ]; then echo \"S3: $p ($s)\"; fi; done")
kali(command="aws s3 ls s3://BUCKET_NAME --no-sign-request 2>&1 | head -20")

Azure Blob + GCS enumeration:

kali(command="for p in COMPANY COMPANYdev COMPANYprod COMPANYbackup COMPANYdata; do s=$(curl -s -o /dev/null -w '%{http_code}' \"https://$p.blob.core.windows.net\" 2>/dev/null); if [ \"$s\" != \"000\" ] && [ \"$s\" != \"404\" ]; then echo \"AZURE: $p ($s)\"; fi; done")
kali(command="for p in COMPANY COMPANY-backup COMPANY-dev COMPANY-prod COMPANY-assets; do s=$(curl -s -o /dev/null -w '%{http_code}' \"https://storage.googleapis.com/$p\" 2>/dev/null); if [ \"$s\" != \"000\" ] && [ \"$s\" != \"404\" ]; then echo \"GCS: $p ($s)\"; fi; done")

Severity: 403 (exists, denied) = Low. 200 on list/read = High. Write succeeds = Critical.

Phase 10 — Document Metadata Extraction (standard+)

Download and batch extract:

kali(command="metagoofil -d DOMAIN -t pdf,doc,xls,ppt,docx,xlsx,pptx -l 30 -n 20 -o /tmp/meta")
kali(command="exiftool -r /tmp/meta/ 2>/dev/null | grep -iE 'author|creator|producer|company|email|software|gps|last modified by' | sort -u")
kali(command="for f in /tmp/meta/*; do echo \"=== $(basename $f) ===\"; exiftool -Author -Creator -Producer -Company -LastModifiedBy -Software -GPSPosition \"$f\" 2>/dev/null | grep -v '^$'; done")

Key fields: Author/Last Modified By = employee names (cross-reference with email pattern). Creator/Producer = software versions (tech stack, possible CVEs). GPS Position = office locations. Company = subsidiaries, parent orgs.

Extract unique employees and software:

kali(command="exiftool -Author -LastModifiedBy -r /tmp/meta/ 2>/dev/null | awk -F': ' '{print $2}' | sort -u | grep -v '^$'")
kali(command="exiftool -Creator -Producer -Software -r /tmp/meta/ 2>/dev/null | awk -F': ' '{print $2}' | sort -u | grep -v '^$'")

Phase 11 — DNS History & Passive DNS (thorough)

Zone transfer attempt:

kali(command="dig axfr DOMAIN @NS_SERVER")

Passive DNS sources:

kali(command="curl -s 'https://www.virustotal.com/api/v3/domains/DOMAIN/subdomains?limit=40' -H 'x-apikey: VT_KEY' | jq -r '.data[].id'")
kali(command="curl -s 'https://api.securitytrails.com/v1/history/DOMAIN/dns/a' -H 'APIKEY: ST_KEY' | jq '.records[] | {first_seen: .first_seen, last_seen: .last_seen, values: [.values[].ip]}'")
kali(command="curl -s 'https://api.hackertarget.com/hostsearch/?q=DOMAIN' | head -50")

Historical MX/NS changes:

kali(command="curl -s 'https://api.securitytrails.com/v1/history/DOMAIN/dns/mx' -H 'APIKEY: ST_KEY' | jq '.records[] | {first_seen: .first_seen, values: [.values[].host]}'")

What DNS history reveals: A record changes = hosting migrations (old IPs may still serve content). MX changes = email provider switches. NS changes = DNS provider migrations. Old IPs = check with Shodan for residual services.

Call report(action="finding", data={...}) if old infrastructure is still reachable.

Phase 12 — Credential Leak Check (thorough)

kali(command="curl -s 'https://haveibeenpwned.com/api/v3/breachedaccount/test@DOMAIN' -H 'hibp-api-key: KEY' 2>/dev/null || echo 'HIBP API key required'")

Search paste sites manually. Call report(action="finding", data={...}) for confirmed leaks.

Phase 13 — Report & Wrap-Up

1. Call report(action="diagram", data={...}) with OSINT map:

flowchart TD
    Org["Target Organization"] --> People["People: N employees"]
    Org --> Domains["Domains: N subdomains"]
    Org --> Tech["Tech Stack"]
    Org --> Email["Email: pattern at target.com"]
    Org --> Repos["Code: N repos"]
    Org --> Cloud["Cloud: N buckets"]
    Domains --> Takeover["Takeover candidates: N"]

2. Call report(action="note", data={...}) with summary:

OSINT Summary:
  Subdomains:        [count] ([count] crt.sh, [count] subfinder, [count] amass)
  Email pattern:     [pattern] — [count] addresses — [verification method]
  Employees:         [count] ([count] confirmed / [count] likely / [count] speculative)
  Tech stack:        [technologies]
  Cloud storage:     [count] buckets — [access levels]
  Subdomain takeover: [count] candidates
  Credential leaks:  [findings or "none confirmed"]
  Wayback findings:  [count] endpoints — [secrets found or "none"]
  DNS history:       [notable changes]

3. Call session(action="complete", options={...}) with summary
4. Chain to /pentester if active scanning is authorized

Chaining Other Skills

Rules

• session(action="start", options={...}) is mandatory — never run any other tool before it
• All techniques must be PASSIVE — no active exploitation (SMTP VRFY/RCPT TO is acceptable as standard email verification)
• Batch independent tools in the same response — they execute in parallel
• When any tool returns a LIMIT message, stop immediately and call session(action="complete", options={...})
• Call report(action="finding", data={...}) for significant discoveries — email patterns, credential leaks, exposed cloud storage, subdomain takeover candidates, secrets in repos
• Include confidence level in every finding — Confirmed, Likely, or Speculative — with source list
• Cross-reference sources — upgrade confidence when multiple tools agree; downgrade single-source findings
• Build the org map progressively — domain, then people, infrastructure, technology, cloud
• Use report(action="note", data={...}) liberally — document sources and confidence for each finding
• Never fabricate findings — only report what tool output confirms
• Respect privacy — focus on publicly available information relevant to security assessment
• Mermaid syntax rules: use flowchart TD, quote labels, no em-dashes, short alphanumeric node IDs
• Call session(action="stop_kali") at the end if kali(command=...) was used