Offensive Osint

TL;DR

• 目的：Perform offensive osint assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the ta
• 适用：通用
• 输入：目标信息
• 输出：执行结果 + 证据
• 红线：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog
• 关联：上游：003-src-session-start → 下游：003-src-session-start（按需调用）

2. Confidence Levels

• TENTATIVE — plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).
• FIRM — directly observed (subdomain resolves, HEAD-confirmed bucket exists, banner returned).
• CONFIRMED — verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).

3. Output Format Conventions

Findings should carry: id, module, asset_key, category, severity (info/low/medium/high/critical), confidence, title, description, evidence (url + UTC timestamp + sha256 + raw ≤ 2 KiB), references, remediation. UTC timestamps everywhere.

4. Source Hygiene & Citations

URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.

5. Do NOT

• Don't paste creds/PII/session tokens into cloud LLMs.
• Don't run destructive probes outside DEEP/--aggressive.
• Don't use validated credentials for anything except read-only liveness check.
• Don't single-source attribute.
• Don't assume vendor labels are ground truth.

6. General OSINT (curated tool refs)

• OSINT Bookmarks — comprehensive bookmarks.
• OSINT Framework — tool/resource directory.
• IntelTechniques Tools — investigative suite.
• Bellingcat Toolkit — investigative journalism.
• CyberSudo OSINT Toolkit — OSINT websites list.
• Google Dorks — efficient Google searching.
• Distributed Denial of Secrets — leaked datasets.
• Country-Specific Resources — country-targeted OSINT.

7. Search Engines

Tools & Systems

• subfinder — Subdomain enumeration (passive + active)
• amass — Deep subdomain recon with graph database
• shodan — Internet-wide device search
• censys — Certificate transparency + scan data
• theHarvester — Email/subdomain/host harvesting
• SpiderFoot — Automated OSINT (200+ modules)

All tools run locally with -rate-limit 20 to avoid OPSEC issues.

Output Format

# Recon Report: <target>
Generated: <ISO timestamp>


## Subdomains
- sub1.target.com (resolved IP, ASN)
- sub2.target.com (resolved IP, ASN)


## Exposed services
- sub1.target.com:443 (HTTPS, cert issuer)
- sub2.target.com:80 (HTTP, server header)


## Email addresses
- admin@target.com (source)
- ceo@target.com (source)

Save as share/intel/recon/<target>-<timestamp>.md.

Workflow

1. Seed input — Root domain, company name, or ASN
2. Passive collection — crt.sh, shodan, censys, theHarvester (no touch)
3. Active enumeration — subfinder with public resolvers
4. Validation — Resolve and probe live hosts
5. Fingerprint — Identify technology stack
6. Reporting — Aggregate into recon report

When to Use

• Target presents indicators of the vulnerability class this skill covers
• Fingerprint or recon indicates the relevant technology stack is in use
• Authorized testing scope covers the target endpoint or component
• Findings need to be validated through this skill's methodology

When NOT to Use

• Target is clearly outside this skill's scope (refer to related skills)
• No authorization for testing
• Need a different category of testing (use related skills)