# Offensive Osint

Operational arsenal for external red-team and bug-bounty reconnaissance.

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: yes, review before use

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill offensive-osint -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill offensive-osint -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill offensive-osint -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill offensive-osint -g -a gemini-cli -y`

## Description

Operational arsenal for external red-team and bug-bounty reconnaissance. Concrete wordlists (28 Swagger paths, 13 GraphQL paths, 35 high-risk ports, 6 missing-header findings, 15 always-on HTTP checks, 5 SAML paths, cloud bucket permutations, JS guess-paths, vendor product fingerprints for Citrix/F5/Pulse/Fortinet/Cisco/PaloAlto/VMware/Exchange, cloud-native service fingerprints, container/K8s exposure paths, CI/CD platform paths, documentation/wiki leak paths, WHOIS/RDAP, DNS record catalog, Wayback CDX recipes), 80-pattern secret-regex catalog (incl. modern AI API keys: Anthropic/OpenAI/HuggingFace/Cloudflare/DigitalOcean/npm/PyPI/Docker Hub/Atlassian/DataDog/Sentry/ngrok; plus a provider-expansion tier: Postman PMAK/GitLab/Square/Shopify/Mailchimp/PagerDuty/Asana/Databricks/Grafana/Terraform Cloud/Fastly/Algolia/Segment/Airtable/GCP+Google OAuth/Azure AD/Facebook OAuth/RubyGems/JFrog/Okta/Slack app-level/Dropbox/Doppler/HashiCorp Vault/Firebase Cloud Messaging), 80+ dork corpus across 9 categories, GitHub code-search dorks, copy-paste curl/httpie probes for every check, post-discovery enumeration workflows (AWS/GitHub/Slack/JWT/PMAK/Anthropic/OpenAI), endpoint interest scoring rubric (0, 100), mobile app ownership confidence + APK static-analysis pipeline (acquisition, apktool/aapt2/jadx/androguard decompile, manifest exported-component/deep-link/misconfig extraction, Firebase config, network-security-config, embedded-secret scan), identity-fabric endpoints (Entra/Okta/ADFS

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Offensive OSINT, External Red-Team Arsenal

> Companion skill: `osint-methodology` (the "how to think" skill). This skill is the "what to reach for." Use them together.

## 0. When to use / When NOT

**Use this skill when:**

- You need concrete probe paths, wordlists, regexes, payloads, scoring rules, or tool URLs.
- You're executing reconnaissance and need the actual technical reference (vs. methodology).
- You're building a recon automation and need specific lists to seed it.

**Do NOT use this skill when:**

- The user is asking for active exploitation, post-exploitation, or anything past reconnaissance.
- The user is asking for defensive / blue-team detections.
- The target's authorization isn't established, see §1.

---

## 1. Authorization & Legal Posture

For assets the operator owns or has written authorization to assess. Soft scope check before acting against an unverified third-party target, see methodology skill §1 for the full posture.

---

## 2. Confidence Levels

- **TENTATIVE**, plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).
- **FIRM**, directly observed (subdomain resolves, HEAD-confirmed bucket exists, banner returned).
- **CONFIRMED**, verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).

---

## 3. Output Format Conventions

Findings should carry: `id`, `module`, `asset_key`, `category`, `severity` (info/low/medium/high/critical), `confidence`, `title`, `description`, `evidence` (url + UTC timestamp + sha256 + raw ≤ 2 KiB), `references`, `remediation`. UTC timestamps everywhere.

---

## 4. Source Hygiene & Citations

URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.

---

## 5. Do NOT

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/offensive-osint/SKILL.md