agentsclimarketplace

Offensive osint

Skill SnailSploit/Claude-Red/Skills/recon/offensive-osint

claude-red is a curated library of offensive security skills designed for the Claude skills system. Each skill is a structured SKILL.md file that primes Claude with expert-level methodology for a specific attack surface — from SQLi to shellcode, EDR evasion to exploit development.

Install
npx -y skills add SnailSploit/Claude-Red --skill offensive-osint

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.

SKILL.md

22.1 KB, as published. Nobody here has run it

Offensive OSINT Methodology

Workflow

  1. Define target scope (domain, org, person, crypto address, or geo subject)
  2. Select applicable categories below based on scope
  3. Work top-down within each category; pivot on discovered artifacts
  4. Archive every key artifact: URL + timestamp + screenshot (PNG) + hash (SHA-256)
  5. Log findings in JSONL with a run_id and tool versions for reproducibility
  6. Suggest next steps based on what each tool returns

General OSINT

Search Engines

ToolNotes
Carrot2Clusters results by topic
etoolsMetasearch engine
KagiPrivacy-first, non-personalized results
Brave SearchIndependent index; Goggles for custom ranking
PDF SearchSearch PDF files and view table of contents
Google Fact Check ExplorerCross-site fact-check search

Username & Email Investigation

ToolPurpose
SherlockUsername search across social networks
MaigretCollect profiles by username from many sites
What's My NameUsername search across platforms
HoleheCheck if email is registered on platforms
EpieosEmail address pivots and metadata
OSINT IndustriesEmail/username/phone lookups
Hunter.ioFind email addresses for a domain
EmailRepEmail reputation and associated data
EmailableVerify email existence
MugetsuX/Twitter username history
RocketReach / ApolloEmail enrichment and pattern guessing
PhoneInfogaPhone number intelligence framework

Browser extensions: GetProspect, SignalHire

People Search

Phone Number OSINT

Social Media

PlatformTool
InstagramPicuki — view profiles without account
X/Twittersnscrape — preferred CLI scraper; use Twint only as fallback
FacebookGraph Search, sowsearch.info, lookup-id.com, whopostedwhat.com
Facebook (research)Meta Content Library — CrowdTangle successor (researcher-gated)
YouTube/TwitchSocial Blade — analytics
TikTokTokboard — trend and profile analytics
RedditReveddit — removed content; RedTrack.social — user history
BlueskyFiresky — real-time firehose; SkyView — follower graphs
MastodonFediSearch — cross-instance search; Fedifinder — find Twitter users on Mastodon
FacesSearch4Faces

Public Records & Company Information

RU/CN Registries

Russia: Rusprofile, Kontur.Focus (freemium), zakupki.gov.ru (procurement), EGRUL/EGRIP (official, captcha-gated)

China: GSXT (National Enterprise Credit), Qichacha/Tianyancha (freemium), MIIT ICP/Beian (ICP filings)

Sanctions & Compliance

Breach & Leak Data

Infrastructure & Attack-Surface OSINT

ASN/BGP & Internet Measurement

Certificates & CT Monitoring

  • crt.sh — Search Certificate Transparency logs
  • Censys Certificates — CT and x509 attribute pivots
  • CertStream — Real-time CT feed via WebSocket
  • Rapid7 Open Data — Sonar DNS/HTTP/SSL datasets
  • Cert Spotter [Freemium] — CT monitoring and alerts
  • Favicon hash (mmh3): cluster infrastructure; pair with Shodan/Censys favicon search

Threat Intel & IOCs

Malware Analysis & Sandboxes

Cryptocurrency OSINT

Blockchain Explorers

ChainExplorer
BitcoinBlockchain.com, Blockchair
EthereumEtherscan
BNB ChainBSCScan
Polygon PoSPolygonScan
SolanaSolscan
Multi-chainOKLink [Freemium], Cielo

L2 Explorers: Arbiscan, Optimistic Etherscan, BaseScan, zkSync Era, L2Beat (risk/TVL comparison)

Transaction Tracking & Analytics

NFT & Exchange Intelligence

Bridge Monitoring

Media Intelligence

Reverse Image & Facial Search

Image Forensics

Video Analysis

Browser Extensions for Media

Geospatial Intelligence

Satellite Imagery & Mapping

Geolocation Tools

Street View: Google Street View, Apple Maps, Yandex Maps, Baidu Maps

Flight OSINT

Maritime OSINT

AI-Assisted OSINT

Warning: Never paste PII, sensitive IOCs, or unique pivots into cloud LLMs. They log inputs and may use them for training. Use local models (Ollama, LM Studio) for sensitive analysis.

ToolStrength
ChatGPT (paid)Log parsing, dataset analysis, Code Interpreter for CSVs/JSON, GPT-4 Vision for image OCR
Claude (paid)200K token context for large document dumps and report synthesis
Gemini 1.5 Pro2M token context; Deep Research mode with citations
Perplexity Pro (paid)Real-time web search + reasoning; multi-query synthesis

Local/privacy-preserving: Ollama (Llama 3, Mistral), LM Studio, GPT4All

Commercial AI OSINT Platforms

Deepfake & Synthetic Media Detection

Archiving & Evidence Preservation

  • archive.today — One-page content archiver with screenshot
  • URLScan.io — On-demand webpage scan with resource map
  • ArchiveBox — Self-hosted archiving (HTML, PDF, screenshots, media)
  • Hunchly — Evidence capture for investigators (paid)
  • Wayback SavePageNow API v3 — On-demand archiving with job IDs
  • SingleFileZ — Browser extension for offline HTML archives
  • Kasm Workspaces — Containerized OSINT workspace/browser isolation

Evidence handling:

  • Capture: URL + timestamp + PNG screenshot + WARC/SingleFileZ archive
  • Hash all downloaded files (SHA-256) and record in case notes
  • Separate work profiles/containers per case; store evidence read-only
  • Use JSONL (NDJSON) logs with run_id and tool versions for reproducibility

Automation & Workflows

  • n8n — Self-hosted workflow automation (e.g., RSS → scrape → alert pipelines)
  • Huginn — Agent-based monitoring, scraping, alerting
  • Playwright — Headless browser automation with stealth plugins
  • Browsertrix Crawler — Archival crawling with WARC export
  • Prefect / Apache Airflow — Workflow orchestration for data pipelines

Regional Search Engines

Telegram & Messaging Intelligence

  • TGStat — Channel analytics and search
  • Telemetr — Channel growth, overlaps, forwards
  • Combot — Group analytics (partially paid)
  • TelegramDB Search Bot — Basic Telegram OSINT
  • Discord ID — Basic Discord account information
  • Sogou Weixin search — WeChat Official Accounts content search
  • View public Telegram channels: https://t.me/s/<channel>

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.