About

Imported from mukul975/anthropic-cybersecurity-skills (skills/performing-open-source-intelligence-gathering/SKILL.md). Install upstream with npx skills add mukul975/anthropic-cybersecurity-skills --skill performing-open-source-intelligence-gathering. Copyright stays with the author (Apache-2.0).

Performing Open Source Intelligence Gathering

Name: performing-open-source-intelligence-gathering
Author: mukul975

Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.

Overview

Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OSINT directly shapes initial access strategies and reduces operational risk.

When to Use

When conducting security assessments that involve performing open source intelligence gathering
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Prerequisites

Familiarity with red teaming concepts and tools
Access to a test or lab environment for safe execution
Python 3.8+ with required dependencies installed
Appropriate authorization for any testing activities

Objectives

Enumerate the target organization's external attack surface (domains, IPs, cloud assets)
Identify employees and their roles for social engineering targeting
Discover leaked credentials, API keys, and sensitive documents
Map the organization's technology stack and vendors
Identify physical locations, office layouts, and access control details
Build target profiles for spearphishing campaign development

Core Concepts

OSINT Categories

Category	Sources	Value
Domain Intelligence	DNS records, WHOIS, CT logs, subdomain enumeration	Network attack surface
Personnel Intelligence	LinkedIn, social media, conference talks, publications	Social engineering targets
Credential Intelligence	Breach databases, paste sites, GitHub leaks	Valid credential discovery
Technology Intelligence	Job postings, Wappalyzer, Shodan, Censys	Vulnerability identification
Physical Intelligence	Google Maps, social media photos, Glassdoor	Physical access planning
Document Intelligence	SEC filings, public documents, metadata extraction	Organizational structure

MITRE ATT&CK Mapping

T1595.001 - Active Scanning: Scanning IP Blocks
T1595.002 - Active Scanning: Vulnerability Scanning
T1592 - Gather Victim Host Information
T1589 - Gather Victim Identity Information
T1590 - Gather Victim Network Information
T1591 - Gather Victim Org Information
T1593 - Search Open Websites/Domains
T1594 - Search Victim-Owned Websites
T1596 - Search Open Technical Databases

Workflow

Phase 1: Domain and Network Reconnaissance

Perform WHOIS lookups for target domains
Enumerate subdomains using Certificate Transparency logs, DNS brute-force, and web scraping
Identify IP ranges and ASN ownership
Scan for exposed services using Shodan/Censys
Check for cloud storage buckets (S3, Azure Blob, GCS)
Map CDN and hosting providers

Phase 2: Personnel and Social Intelligence

Enumerate employees via LinkedIn, company website, and conference speaker lists
Identify email naming conventions
Discover personal social media accounts of key targets
Map organizational hierarchy and reporting structure
Identify recently hired IT/security personnel
Check for conference presentations and technical publications

Phase 3: Credential and Data Leak Discovery

Search breach databases (Have I Been Pwned, DeHashed)
Check paste sites (Pastebin, GitHub Gists)
Search GitHub/GitLab for leaked secrets and API keys
Look for exposed configuration files and backups
Check for leaked internal documents via Google dorking

Phase 4: Technology Stack Identification

Analyze job postings for technology mentions
Use Wappalyzer/BuiltWith for web technology fingerprinting
Check for exposed admin panels and development environments
Identify VPN and remote access technologies
Map cloud services and SaaS applications

Tools and Resources

Tool	Purpose	Type
Amass	Subdomain enumeration and network mapping	Open Source
Subfinder	Passive subdomain discovery	Open Source
theHarvester	Email, subdomain, and name harvesting	Open Source
Maltego	Visual link analysis and data correlation	Commercial
SpiderFoot	Automated OSINT collection	Open Source
Shodan	Internet-connected device search	Commercial
Censys	Internet asset discovery	Commercial
Recon-ng	Web reconnaissance framework	Open Source
GitDorker	GitHub secret scanning	Open Source
Photon	Web crawler for OSINT	Open Source

Validation Criteria

Complete list of target domains and subdomains
Employee list with roles and email addresses
Technology stack identified
Credential leak assessment completed
Attack surface map documented
OSINT report compiled for engagement team

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-open-49261e/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

mukul975-anthropic-cybersecurity-skills-performing-open-49261e.ocm.jsonjson

{
  "ocm": "1",
  "id": "mukul975-anthropic-cybersecurity-skills-performing-open-49261e",
  "kind": "skill",
  "name": "performing-open-source-intelligence-gathering",
  "description": "Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s",
  "publisher": "mukul975",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "general"
    ],
    "tags": [
      "skill-md",
      "red-team",
      "adversary-simulation",
      "mitre-attack",
      "exploitation",
      "post-exploitation",
      "osint",
      "reconnaissance",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Open Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack s"
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/mukul975/anthropic-cybersecurity-skills",
      "path": "skills/performing-open-source-intelligence-gathering/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/mukul975/anthropic-cybersecurity-skills/blob/HEAD/skills/performing-open-source-intelligence-gathering/SKILL.md",
      "key": "mukul975/anthropic-cybersecurity-skills/skills/performing-open-source-intelligence-gathering/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Performing Open Source Intelligence Gathering\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Overview\n\nOpen Source Intelligence (OSINT) gathering is the first active phase of a red team engagement, where operators collect publicly available information about the target organization to identify attack surfaces, potential targets for social engineering, technology stacks, and credential exposures. Effective OS",
  "cost": {
    "context_tokens": 1302
  }
}

Fetch it by URL: GET /api/v1/registry/mukul975-anthropic-cybersecurity-skills-performing-open-49261e/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.