offensive-osint

> **⚠️ AUTHORIZED USE ONLY**

> This skill is for educational purposes or authorized security assessments only.

> You must have explicit, written permission from the system owner before using this tool.

> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**

> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

> 1. Ask the user to state the exact target URL, IP, account, or resource.

> 2. Ask the user to confirm written authorization and the permitted scope.

> 3. Show the exact command(s) and explain their expected effect.

> 4. Wait for explicit confirmation in the current conversation.

>

> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

# Offensive OSINT — External Red-Team Arsenal

> **v3.0** — Refactored 2026-05-02 from a 4,168-line monolith into a lean SKILL.md (~400 lines) plus 15 modular reference files in `references/`. Detail content loads on demand — Claude reads only the reference files relevant to the current task.

0. When to use / When NOT

**Use this skill when:**

- You need concrete probe paths, wordlists, regexes, payloads, scoring rules, or tool URLs.

- You're executing reconnaissance and need the actual technical reference (vs. methodology).

- You're building a recon automation and need specific lists to seed it.

**Do NOT use this skill when:**

- The user is asking for active exploitation, post-exploitation, or anything past reconnaissance.

- The user is asking for defensive / blue-team detections.

- The target's authorization isn't established — see §1.

---

1. Authorization & Legal Posture

For assets the operator owns or has written authorization to assess. Soft scope check before acting against an unverified third-party target — see methodology skill §1 for the full posture.

---

2. Confidence Levels

- **TENTATIVE** — plausible based on indirect evidence (snippet-only dork match, single-source asset, inferred email pattern).

- **FIRM** — directly observed (subdomain resolves, HEAD-confirmed bucket exists, banner returned).

- **CONFIRMED** — verified via independent corroboration OR direct verification (live PMAK validation, multiple sources agree, listable bucket with object retrieval).

---

3. Output Format Conventions

Findings should carry: `id`, `module`, `asset_key`, `category`, `severity` (info/low/medium/high/critical), `confidence`, `title`, `description`, `evidence` (url + UTC timestamp + sha256 + raw ≤ 2 KiB), `references`, `remediation`. UTC timestamps everywhere.

---

4. Source Hygiene & Citations

URL + UTC timestamp + SHA-256 + tool version + run_id, every artifact. PNG screenshots, JSONL run logs, raw HTTP captures capped at 2 KiB body.

---

5. Do NOT

- Don't paste creds/PII/session tokens into cloud LLMs.

- Don't run destructive probes outside DEEP/`--aggressive`.

- Don't use validated credentials for anything except read-only liveness check.

- Don't single-source attribute.

- Don't assume vendor labels are ground truth.

---

6. General OSINT (curated tool refs)

- [OSINT Bookmarks](https://tools.myosint.training/) — comprehensive bookmarks.

- [OSINT Framework](https://osintframework.com/) — tool/resource directory.

- [IntelTechniques Tools](https://inteltechniques.com/tools/) — investigative suite.

- [Bellingcat Toolkit](https://www.bellingcat.com/resources/2024/09/24/bellingcat-online-investigations-toolkit/) — investigative journalism.

- [CyberSudo OSINT Toolkit](https://docs.google.com/spreadsheets/d/1EC0sKA_W9znzsxUt0wye9UYtyATXw5m8) — OSINT websites list.

- [Google Dorks](https://dorksearch.com/) — efficient Google searching.

- [Distributed Denial of Secrets](https://ddosecrets.com/) — leaked datasets.

- [Country-Specific Resources](https://digitaldigging.org/osint/) — country-targeted OSINT.

---

How to use this skill

This skill is a **lea