1---2name: osint-recon-automation3description: OSINT and reconnaissance automation skill for passive collection, pivoting, deduplication, and graph-based analysis using subfinder, amass, dnsx, chaos, crt.sh, github-dorks, waybackurls, gau, gitleaks, trufflehog, theHarvester, h8mail, holehe, sherlock, Shodan, Censys, FOFA, and Hunter. Use for asset discovery, exposure monitoring, and authorized reconnaissance only.4---56# OSINT Recon Automation78## Authorization Boundary910- Restrict to your own assets, bug bounty programs with explicit scope, or assignments with written authorization.11- No social engineering, doxing, harassment, or targeting individuals.12- Respect rate limits and provider terms; never weaponize discovered credentials.1314## Recon Workflow15161. Seed: registered domains, ASNs, org names, GitHub orgs, app store handles.172. Expand passively: cert transparency, passive DNS, reverse WHOIS, ASN ranges, code search, leaked credential repos, archive snapshots.183. Resolve and validate: `dnsx`, `httpx`, screenshot with `gowitness` or `aquatone`.194. Pivot: shared favicons (`favfreak`), Google Analytics IDs, S3 bucket naming, JS endpoints, ASN neighbors.205. Dedupe and graph: build a node-edge model `(asset)-[relation]->(asset)` and store in Neo4j or JSONL.216. Monitor: diff snapshots; alert on new subdomain, new exposed service, leaked secret, or impersonation domain.2223## Exposure Signals2425- Exposed admin panels, dev/stage hosts, open S3/Blob/GCS, leaked `.env`, `.git/`, `.DS_Store`, swagger, GraphQL introspection, package registry takeover candidates, dangling DNS.2627## Output Contract2829- `seeds.yaml`, `assets.jsonl`, `graph.json`, `screenshots/`, `exposures.csv`, `diff/<date>.md`.30- `report.md`: new exposures since last run with severity and owner.31- `takedowns.md`: impersonation domains and reporting paths.
Masriyan