Recon Osint

This is a full reconnaissance workflow that chains together subdomain enumeration, port scanning, breach lookups, and CVE correlation into one coordinated phase. It's built around tools like subfinder, amass, nmap, h8mail, and nuclei, moving methodically from passive intel gathering through active service discovery to credential hunting. The GitHub dorking section is especially thorough, with specific search patterns for leaked AWS keys and historical secrets in git logs. Use this at the start of an engagement when you need a complete attack surface map, or when you're preparing a target profile before exploitation. It outputs structured reports with prioritized attack vectors, which is helpful for deciding where to focus next. The social engineering recon techniques are a nice addition that goes beyond pure technical enumeration.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill recon-osint --agent claude-code

Installs into .claude/skills of the current project.

Files

Reconnaissance & OSINT

When to Activate

A new engagement begins and you need a full external attack-surface map for a set of root domains / ASNs.
Expanding scope: pivoting from one discovered asset (subdomain, IP block, cloud account) to the rest of the estate.
Hunting dangling DNS / subdomain-takeover candidates, including S3 buckets referenced by CI/CD assets.
Building a target profile for social engineering / initial access (emails, usernames, breach + infostealer exposure).
Discovering leaked secrets in public GitHub/GitLab orgs and exposed cloud storage.
Triaging which discovered CVEs actually matter (KEV + EPSS + exposure) before weaponization.