# Org Attack Surface

Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE...

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill org-attack-surface -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill org-attack-surface -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill org-attack-surface -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill org-attack-surface -g -a gemini-cli -y`

## Description

Org-grade attack-surface mapping: given a company's legal identity, discover its ENTIRE owned internet footprint, corporate family -> owned domains -> owned netblocks/ASN -> live assets, with attribution discipline, not just DNS breadth. The org-first attribution pyramid (legal entity -> LEI/registration -> corporate family -> owned domains -> owned netblocks/ASN -> live assets). Corporate-identity resolution via the GLEIF LEI API (legal name -> LEI, exact-LEI direct-children expansion, downward-only depth-capped BFS, NEVER a name re-resolution), SEC-EDGAR full-text search + Exhibit-21 subsidiary entity names, OpenCorporates entity corroboration, Wikidata SPARQL corporate graph (P856/P355/P749/P1830). Domain attribution via reverse-WHOIS (WhoisXML preview-then-purchase quota guard, SecurityTrails associated-domains, both paid), crt.sh O= certificate-transparency organization pivot (keyless), infrastructure correlation (shared NS/MX/SaaS-TXT, netblock membership, reverse-DNS PTR), and the independent-evidence combiner (1-prod(1-w_i), rule of three, OwnerTier NONE/WEAK/MODERATE/STRONG/CONFIRMED), discover-only `related:` candidates are NEVER auto-scanned. Netblock/ASN attribution via org-first RIR queries (ARIN Whois-RWS org-handle search, RIPE DB organisation + inverse-org search) that recover 'dark netblocks' with no DNS link to the seed, ASN discovery (RIPEstat + BGPView union), the HYPERSCALER-SCOPE GUARD (never attribute a whole AWS/GCP/Azure/Cloudflare announced range

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Org Attack Surface, Corporate-Family Footprint Mapping

> Companion skills: [`osint-methodology`](../osint-methodology/) (the "how to think" 5-stage recon
> pipeline this plugs into) and [`offensive-osint`](../offensive-osint/) (the per-host arsenal you run
> once this skill hands you owned domains/netblocks, see its §14 Public Records and §28 Infrastructure
> OSINT for the tool directory this skill deepens rather than duplicates). This skill answers a
> different, upstream question: **not** "what does `acme.com` expose", but "what does **Acme
> Corporation, the legal entity**, own across every domain, netblock, and subsidiary it has, including
> the parts with no DNS trail back to the seed at all."

## 0. When to Use / When NOT

**Use this skill when:**

- The engagement starts from a **company name or legal entity**, not a domain, you need to derive
  the domain(s) first, not just enumerate one.
- You need to find an org's **subsidiaries, sister brands, or M&A-acquired footprint** that a
  DNS/CT-only sweep of one seed domain would never surface.
- You suspect **"dark" IP space**, netblocks or ASNs registered to the org's legal entity with
  no DNS record pointing at them (forgotten datacenter allocations, un-linked M&A infrastructure,
  IPs that only ever ran raw services).
- You need **attribution discipline**: every candidate domain/netblock/ASN this skill surfaces
  carries an explicit, auditable ownership score, never a bare "looks related."
- You are scoping a large or conglomerate engagement and need to prune scope by real corporate
  ownership before spending recon budget on strangers.

**Do NOT use this skill when:**

- You already have a confirmed, bounded target list and just need per-host recon, go straight to
  `offensive-osint`.
- The target's authorization isn't established, see §1.
- You need active exploitation or post-exploitation, out of scope here and everywhere in this
  skill family.

---

## 1. Authorization & Legal Posture

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/org-attack-surface/SKILL.md