Osint Recon Automation

Name: Osint Recon Automation
Author: Garyson26

ASecurity

OSINT and reconnaissance automation skill for passive collection, pivoting, deduplication, and graph-based analysis using subfinder, amass, dnsx, chaos, crt.sh, github-dorks, waybackurls, gau, gitleaks, trufflehog, theHarvester, h8mail, holehe, sherlock, Shodan, Censys, FOFA, and Hunter. Use for asset discovery, exposure monitoring, and authorized reconnaissance only.

19 stars
0 votes
0 copies
2 views
Added October 11, 2026

ai-agentsgonodegit

Security analysis

A100/100

Pro scans all 2 files and shows the line behind each finding

Scanned October 11, 2026

npx -y skills add Garyson26/Trident-SecOps-Skills --skill osint-recon-automation --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Osint Recon Automation?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Osint Recon Automation

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/garyson26-osint-recon-automation/badge)](https://www.skillsdirectory.com/skills/garyson26-osint-recon-automation)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro

SKILL.md

---
name: osint-recon-automation
description: OSINT and reconnaissance automation skill for passive collection, pivoting, deduplication, and graph-based analysis using subfinder, amass, dnsx, chaos, crt.sh, github-dorks, waybackurls, gau, gitleaks, trufflehog, theHarvester, h8mail, holehe, sherlock, Shodan, Censys, FOFA, and Hunter. Use for asset discovery, exposure monitoring, and authorized reconnaissance only.
---

# OSINT Recon Automation

## Authorization Boundary

- Restrict to your own assets, bug bounty programs with explicit scope, or assignments with written authorization.
- No social engineering, doxing, harassment, or targeting individuals.
- Respect rate limits and provider terms; never weaponize discovered credentials.

## Recon Workflow

1. Seed: registered domains, ASNs, org names, GitHub orgs, app store handles.
2. Expand passively: cert transparency, passive DNS, reverse WHOIS, ASN ranges, code search, leaked credential repos, archive snapshots.
3. Resolve and validate: `dnsx`, `httpx`, screenshot with `gowitness` or `aquatone`.
4. Pivot: shared favicons (`favfreak`), Google Analytics IDs, S3 bucket naming, JS endpoints, ASN neighbors.
5. Dedupe and graph: build a node-edge model `(asset)-[relation]->(asset)` and store in Neo4j or JSONL.
6. Monitor: diff snapshots; alert on new subdomain, new exposed service, leaked secret, or impersonation domain.

## Exposure Signals

- Exposed admin panels, dev/stage hosts, open S3/Blob/GCS, leaked `.env`, `.git/`, `.DS_Store`, swagger, GraphQL introspection, package registry takeover candidates, dangling DNS.

## Output Contract

- `seeds.yaml`, `assets.jsonl`, `graph.json`, `screenshots/`, `exposures.csv`, `diff/<date>.md`.
- `report.md`: new exposures since last run with severity and owner.
- `takedowns.md`: impersonation domains and reporting paths.