# Offensive Osint

> Perform offensive osint assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the target environment.

- Skill: `wufufu770/offensive-osint` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add wufufu770/offensive-osint`
- Raw SKILL.md: https://api.skillmd.com/api/skills/wufufu770/offensive-osint/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: wufufu770 (https://skillmd.com/u/wufufu770)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/wufufu770/offensive-osint

---


## TL;DR

- **目的**：Perform offensive osint assessment during authorized security testing. Use this skill when indicators of the vulnerability class are present in the ta
- **适用**：通用
- **输入**：目标信息
- **输出**：执行结果 + 证据
- **红线**：仅限授权范围内；扫描限速 -c 10 -rl 10；所有动作记 oplog
- **关联**：上游：003-src-session-start → 下游：003-src-session-start（按需调用）




## 2. Confidence Levels

- **TENTATIVE** — plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).
- **FIRM** — directly observed (subdomain resolves, HEAD-confirmed bucket exists, banner returned).
- **CONFIRMED** — verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).

---


## 3. Output Format Conventions

Findings should carry: `id`, `module`, `asset_key`, `category`, `severity` (info/low/medium/high/critical), `confidence`, `title`, `description`, `evidence` (url + UTC timestamp + sha256 + raw ≤ 2 KiB), `references`, `remediation`. UTC timestamps everywhere.

---


## 4. Source Hygiene & Citations

URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.

---


## 5. Do NOT

- Don't paste creds/PII/session tokens into cloud LLMs.
- Don't run destructive probes outside DEEP/`--aggressive`.
- Don't use validated credentials for anything except read-only liveness check.
- Don't single-source attribute.
- Don't assume vendor labels are ground truth.

---


## 6. General OSINT (curated tool refs)

- [OSINT Bookmarks](https://tools.myosint.training/) — comprehensive bookmarks.
- [OSINT Framework](https://osintframework.com/) — tool/resource directory.
- [IntelTechniques Tools](https://inteltechniques.com/tools/) — investigative suite.
- [Bellingcat Toolkit](https://www.bellingcat.com/resources/2024/09/24/bellingcat-online-investigations-toolkit/) — investigative journalism.
- [CyberSudo OSINT Toolkit](https://docs.google.com/spreadsheets/d/1EC0sKA_W9znzsxUt0wye9UYtyATXw5m8) — OSINT websites list.
- [Google Dorks](https://dorksearch.com/) — efficient Google searching.
- [Distributed Denial of Secrets](https://ddosecrets.com/) — leaked datasets.
- [Country-Specific Resources](https://digitaldigging.org/osint/) — country-targeted OSINT.


## 7. Search Engines

| Tool | Notes |
|------|-------|
| [Carrot2](https://search.carrot2.org/#/search/web) | Clusters results by topic |
| [etools](https://www.etools.ch/) | Metasearch |
| [Kagi](https://kagi.com/) | Privacy-first, non-personalized |
| [Brave Search](https://search.brave.com/) | Independent index; Goggles for custom ranking |
| [PDF Search](https://www.pdfsearch.io/) | PDF + table of contents |
| [Google Fact Check Explorer](https://toolbox.google.com/factcheck/explorer) | Cross-site fact-check |

---


## Tools & Systems

- **subfinder** — Subdomain enumeration (passive + active)
- **amass** — Deep subdomain recon with graph database
- **shodan** — Internet-wide device search
- **censys** — Certificate transparency + scan data
- **theHarvester** — Email/subdomain/host harvesting
- **SpiderFoot** — Automated OSINT (200+ modules)

All tools run locally with `-rate-limit 20` to avoid OPSEC issues.


## Output Format

```markdown
# Recon Report: <target>
Generated: <ISO timestamp>


## Subdomains
- sub1.target.com (resolved IP, ASN)
- sub2.target.com (resolved IP, ASN)


## Exposed services
- sub1.target.com:443 (HTTPS, cert issuer)
- sub2.target.com:80 (HTTP, server header)


## Email addresses
- admin@target.com (source)
- ceo@target.com (source)
```

Save as `share/intel/recon/<target>-<timestamp>.md`.


## Workflow

1. **Seed input** — Root domain, company name, or ASN
2. **Passive collection** — crt.sh, shodan, censys, theHarvester (no touch)
3. **Active enumeration** — subfinder with public resolvers
4. **Validation** — Resolve and probe live hosts
5. **Fingerprint** — Identify technology stack
6. **Reporting** — Aggregate into recon report



## When to Use

- Target presents indicators of the vulnerability class this skill covers
- Fingerprint or recon indicates the relevant technology stack is in use
- Authorized testing scope covers the target endpoint or component
- Findings need to be validated through this skill's methodology


## When NOT to Use

- Target is clearly outside this skill's scope (refer to related skills)
- No authorization for testing
- Need a different category of testing (use related skills)