Osint Methodology
Comprehensive OSINT methodology for external red-team operations and authorized...
Install
npx skills add elementalsouls/Claude-OSINT --skill osint-methodology -g -a claude-code -y- Repository
- elementalsouls/Claude-OSINT2.9k
- Category
- Security
- Updated
- 15d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 6-stage recon pipeline (seed → asset expansion → enrichment → exposure analysis → convergence → operator-armed active validation) with connector-resilience and stage-vs-gating discipline, asset-graph discipline, severity rubric, confidence upgrade workflows, time budgeting, identity-fabric mapping, breach×identity correlation with per-person identity dossiers, detectability tagging, detection-aware probing, WAF/CDN bypass, vulnerability prioritization, phishing infrastructure planning, bug bounty submission, and client deliverable templates. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, or producing client deliverables.
OSINT Methodology, External Red-Team Edition
0. When to Use / When NOT
Use this skill when: planning or executing authorized external recon (red team, bug bounty, ASM); mapping an org's attack surface; investigating a person/entity/threat-actor; producing client deliverables.
Do NOT use this skill when: the user needs active exploitation, post-exploitation, or malware dev; blue-team/detection content; or the target's authorization is unclear, surface the scope question first.
1. Authorization & Legal Posture
Intended for assets the operator owns or has written authorization to assess.
Soft scope check, when authorization isn't established, ask once:
"Quick scope check: is this a target you own or have written authorization to assess? I want to make sure we stay on the right side of the engagement boundary."
Once asserted, don't re-ask. If the engagement type is stated ("pentest of acme.com under contract"), proceed.
Always-on guardrails:
- Never weaken auth, rate limits, or safety controls on the target side.
- No destructive probes (SYN scans at line-rate, masscan, fuzzing) outside explicit
--aggressivemode. - Never paste real PII, credentials, session tokens, or API keys into cloud-hosted LLMs.
- Never act against assets outside documented scope, even "obviously related" ones.
2. Confidence Levels
Every assertion carries a confidence level.
| Level | Meaning |
|---|---|
| TENTATIVE | Plausible from indirect evidence; unverified. Snippet-only dork match, email pattern inferred from name, single passive-source subdomain. |
| FIRM | Directly observed, uncorroborated. Subdomain resolves; Shodan banner returned; CT-log entry. |
| CONFIRMED | Multiple independent corroborations OR directly verified. Live-validated token; bucket listable; three-source subdomain convergence. |
Rule of three for attribution: 3 independent weak signals, OR 1 strong + 1 weak. Never single-source attribute.
