Org Attack Surface
Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE...
Install
npx skills add elementalsouls/Claude-OSINT --skill org-attack-surface -g -a claude-code -y- Repository
- elementalsouls/Claude-OSINT2.9k
- Category
- Security
- Updated
- 15d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint, corporate family -> owned domains -> owned netblocks/ASN -> live assets, with attribution discipline, not just DNS breadth. The org-first attribution pyramid (legal entity -> LEI/registration -> corporate family -> owned domains -> owned netblocks/ASN -> live assets). Corporate-identity resolution via the GLEIF LEI API (legal name -> LEI, exact-LEI direct-children expansion, downward-only depth-capped BFS, NEVER a name re-resolution), SEC-EDGAR full-text search + Exhibit-21 subsidiary entity names, OpenCorporates entity corroboration, Wikidata SPARQL corporate graph (P856/P355/P749/P1830). Domain attribution via reverse-WHOIS (WhoisXML preview-then-purchase quota guard, SecurityTrails associated-domains, both paid), crt.sh O= certificate-transparency organization pivot (keyless), infrastructure correlation (shared NS/MX/SaaS-TXT, netblock membership, reverse-DNS PTR), and the independent-evidence combiner (1-prod(1-w_i), rule of three, OwnerTier NONE/WEAK/MODERATE/STRONG/CONFIRMED), discover-only `related:` candidates are NEVER auto-scanned. Netblock/ASN attribution via org-first RIR queries (ARIN Whois-RWS org-handle search, RIPE DB organisation + inverse-org search) that recover 'dark netblocks' with no DNS link to the seed, ASN discovery (RIPEstat + BGPView union), the HYPERSCALER-SCOPE GUARD (never attribute a whole AWS/GCP/Azure/Cloudflare announced range
Org Attack Surface, Corporate-Family Footprint Mapping
Companion skills:
osint-methodology(the "how to think" 5-stage recon pipeline this plugs into) andoffensive-osint(the per-host arsenal you run once this skill hands you owned domains/netblocks, see its §14 Public Records and §28 Infrastructure OSINT for the tool directory this skill deepens rather than duplicates). This skill answers a different, upstream question: not "what doesacme.comexpose", but "what does Acme Corporation, the legal entity, own across every domain, netblock, and subsidiary it has, including the parts with no DNS trail back to the seed at all."
0. When to Use / When NOT
Use this skill when:
- The engagement starts from a company name or legal entity, not a domain, you need to derive the domain(s) first, not just enumerate one.
- You need to find an org's subsidiaries, sister brands, or M&A-acquired footprint that a DNS/CT-only sweep of one seed domain would never surface.
- You suspect "dark" IP space, netblocks or ASNs registered to the org's legal entity with no DNS record pointing at them (forgotten datacenter allocations, un-linked M&A infrastructure, IPs that only ever ran raw services).
- You need attribution discipline: every candidate domain/netblock/ASN this skill surfaces carries an explicit, auditable ownership score, never a bare "looks related."
- You are scoping a large or conglomerate engagement and need to prune scope by real corporate ownership before spending recon budget on strangers.
Do NOT use this skill when:
- You already have a confirmed, bounded target list and just need per-host recon, go straight to
offensive-osint. - The target's authorization isn't established, see §1.
- You need active exploitation or post-exploitation, out of scope here and everywhere in this skill family.
