seikaikyo/performing-open-source-intelligence-gathering
external/anthropic-cybersecurity-skills/skills/performing-open-source-intelligence-gathering/SKILL.md
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s
$ install --global
skillsauthnpx skillsauth add seikaikyo/dash-skills performing-open-source-intelligence-gatheringInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 13, 2026, 5:10 AM20.2s7 files scanned
SKILL.md
- name:
- performing-open-source-intelligence-gathering
- description:
- Open Source Intelligence (OSINT) gathering is the first active phase
- domain:
- cybersecurity
- subdomain:
- red-teaming
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Performing Open Source Intelligence Gathering
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Overview
Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OSINT directly shapes initial access strategies and reduces operational risk.
When to Use
- When conducting security assessments that involve performing open source intelligence gathering
- When following incident response procedures for related security events
- When performing scheduled security testing or auditing activities
- When validating security controls through hands-on testing
Prerequisites
- Familiarity with red teaming concepts and tools
- Access to a test or lab environment for safe execution
- Python 3.8+ with required dependencies installed
- Appropriate authorization for any testing activities
Objectives
- Enumerate the target organization's external attack surface (domains, IPs, cloud assets)
- Identify employees and their roles for social engineering targeting
- Discover leaked credentials, API keys, and sensitive documents
- Map the organization's technology stack and vendors
- Identify physical locations, office layouts, and access control details
- Build target profiles for spearphishing campaign development
Core Concepts
OSINT Categories
| Category | Sources | Value | |----------|---------|-------| | Domain Intelligence | DNS records, WHOIS, CT logs, subdomain enumeration | Network attack surface | | Personnel Intelligence | LinkedIn, social media, conference talks, publications | Social engineering targets | | Credential Intelligence | Breach databases, paste sites, GitHub leaks | Valid credential discovery | | Technology Intelligence | Job postings, Wappalyzer, Shodan, Censys | Vulnerability identification | | Physical Intelligence | Google Maps, social media photos, Glassdoor | Physical access planning | | Document Intelligence | SEC filings, public documents, metadata extraction | Organizational structure |
MITRE ATT&CK Mapping
- T1595.001 - Active Scanning: Scanning IP Blocks
- T1595.002 - Active Scanning: Vulnerability Scanning
- T1592 - Gather Victim Host Information
- T1589 - Gather Victim Identity Information
- T1590 - Gather Victim Network Information
- T1591 - Gather Victim Org Information
- T1593 - Search Open Websites/Domains
- T1594 - Search Victim-Owned Websites
- T1596 - Search Open Technical Databases
Workflow
Phase 1: Domain and Network Reconnaissance
- Perform WHOIS lookups for target domains
- Enumerate subdomains using Certificate Transparency logs, DNS brute-force, and web scraping
- Identify IP ranges and ASN ownership
- Scan for exposed services using Shodan/Censys
- Check for cloud storage buckets (S3, Azure Blob, GCS)
- Map CDN and hosting providers
Phase 2: Personnel and Social Intelligence
- Enumerate employees via LinkedIn, company website, and conference speaker lists
- Identify email naming conventions
- Discover personal social media accounts of key targets
- Map organizational hierarchy and reporting structure
- Identify recently hired IT/security personnel
- Check for conference presentations and technical publications
Phase 3: Credential and Data Leak Discovery
- Search breach databases (Have I Been Pwned, DeHashed)
- Check paste sites (Pastebin, GitHub Gists)
- Search GitHub/GitLab for leaked secrets and API keys
- Look for exposed configuration files and backups
- Check for leaked internal documents via Google dorking
Phase 4: Technology Stack Identification
- Analyze job postings for technology mentions
- Use Wappalyzer/BuiltWith for web technology fingerprinting
- Check for exposed admin panels and development environments
- Identify VPN and remote access technologies
- Map cloud services and SaaS applications
Tools and Resources
| Tool | Purpose | Type | |------|---------|------| | Amass | Subdomain enumeration and network mapping | Open Source | | Subfinder | Passive subdomain discovery | Open Source | | theHarvester | Email, subdomain, and name harvesting | Open Source | | Maltego | Visual link analysis and data correlation | Commercial | | SpiderFoot | Automated OSINT collection | Open Source | | Shodan | Internet-connected device search | Commercial | | Censys | Internet asset discovery | Commercial | | Recon-ng | Web reconnaissance framework | Open Source | | GitDorker | GitHub secret scanning | Open Source | | Photon | Web crawler for OSINT | Open Source |
Validation Criteria
- [ ] Complete list of target domains and subdomains
- [ ] Employee list with roles and email addresses
- [ ] Technology stack identified
- [ ] Credential leak assessment completed
- [ ] Attack surface map documented
- [ ] OSINT report compiled for engagement team
Related Skills
seikaikyo/conducting-gdpr-compliance-assessment
tools
VerifiedTrustedCommunity
Conduct comprehensive GDPR compliance assessments by evaluating data processing activities against EU Regulation 2016/679, including Article 30 records of processing, lawful basis validation, data subject rights implementation, Data Protection Impact Assessments (DPIAs) under Article 35, breach notification procedures, international transfer safeguards (SCCs, adequacy decisions), and technical/organizational measures under Article 32. Use when processing personal data of EU residents, preparing for supervisory authority audits, implementing privacy-by-design for new systems, scoping compliance gaps for M&A due diligence, assessing third-party processors, or responding to data subject access requests at scale. Incorporates 2026 guidance from ICO, EDPB, and post-Data (Use and Access) Act 2025 UK-GDPR considerations. Do not use for implementing specific Article 32 controls — use implementing-gdpr-data-protection-controls; or for DSAR automation — use implementing-gdpr-data-subject-access-request.
2SKILL.mdUpdated Sep 11, 2026
seikaikyo/parsing-artifacts-with-eric-zimmerman-tools
tools
VerifiedTrustedCommunity
Parse Windows forensic artifacts—$MFT/$J (MFTECmd), Prefetch (PECmd), registry hives (RECmd), shellbags, and Amcache—into normalized CSV/JSON with Eric Zimmerman's EZ Tools, then load results into Timeline Explorer for analysis. Use during DFIR/incident-response investigations, after triage collection (e.g. with KAPE), to establish program execution, file/folder access, and persistence evidence from acquired forensic images.
2SKILL.mdUpdated Jun 23, 2026
seikaikyo/orchestrating-llm-attacks-with-pyrit
development
VerifiedTrustedCommunity
Build automated multi-turn adversarial attacks against conversational LLM targets using Microsoft PyRIT's RedTeamingOrchestrator, CrescendoOrchestrator (gradual escalation), and TreeOfAttacksWithPruningOrchestrator (adaptive branching), with scorer feedback loops and persisted conversation memory. Use when single-shot LLM scanning is insufficient and you need multi-turn, scorer-driven AI red-team campaigns against a chatbot or agent.
2SKILL.mdUpdated Jun 23, 2026
seikaikyo/operationalizing-misp-threat-feeds
testing
VerifiedTrustedCommunity
Stand up MISP, enable and cache curated threat feeds (CIRCL, abuse.ch, Feodo Tracker), apply warninglists to suppress false positives, query indicators with PyMISP, and export attributes as auto-generated Suricata/Sigma/Wazuh detection rules. Use when maturing a MISP instance to actively drive detection, curating threat feeds with quality controls, or automating IOC-to-detection pipelines for the SIEM/IDS.
2SKILL.mdUpdated Jun 23, 2026