Listen to this Post
Introduction:
The offensive security landscape is undergoing a paradigm shift as artificial intelligence transitions from a passive assistant to an active, autonomous operator. The introduction of structured `SKILL.md` files for Claude AI, such as the Claude-OSINT project, represents a quantum leap in external reconnaissance capabilities. By embedding over 4,600 lines of structured tradecraft, 90+ recon modules, 48 secret-regex patterns, and 80+ dorks directly into the AI’s context, security professionals can now deploy an agent that thinks and acts like a senior reconnaissance analyst, dramatically accelerating the surface discovery and vulnerability identification phases of authorized engagements.
Learning Objectives:
- Understand the architecture and operational mechanics of the Claude-OSINT skill set, differentiating between strategic methodology and tactical execution.
- Master the installation and configuration of `osint-methodology` and `offensive-osint` skills within Claude Code and Claude.ai projects.
- Execute advanced reconnaissance workflows, including subdomain enumeration, cloud asset discovery, credential hunting, and identity fabric mapping using AI-driven automation.
- Apply the integrated attack-path templates and reporting rubrics to streamline the transition from discovery to exploitation and disclosure.
You Should Know:
1. Understanding the Claude-OSINT Dual-Skill Architecture
The Claude-OSINT project is not a single tool but a paired set of complementary skills designed to provide both strategic direction and tactical firepower.
– `osint-methodology` (How to Think): This 455-line skill file focuses on the strategic and procedural aspects of an engagement. It primes Claude with concepts such as asset-graph discipline (mapping relationships between domains, IPs, and services), severity rubrics for prioritizing findings, time-budgeting profiles for engagements of varying durations, and deliverable templates for client reporting. It essentially provides the “playbook” for the reconnaissance phase, ensuring that the AI’s actions are methodical and aligned with professional standards.
– `offensive-osint` (What to Reach For): This is the tactical arsenal, containing 4,168 lines of executable knowledge. It includes probe paths, regex patterns for secret hunting (48 patterns covering AWS keys, modern AI API keys, and package registry tokens), scoring rules for endpoints, and curl one-liners for direct interaction with target services. This skill transforms Claude from a conversational AI into an active reconnaissance operator capable of running complex discovery tasks.
Step-by-Step Guide: Installing and Deploying Claude-OSINT
- Access the Repository: Navigate to the official GitHub repository at `https://github.com/elementalsouls/claude-osint`.
- Download the Skills: Clone the repository or download the `skills/` directory. The two critical files are located at `skills/osint-methodology/SKILL.md` and
skills/offensive-osint/SKILL.md. - Install for Claude Code: Copy the skill directories into your Claude Code skills path, typically
~/.claude/skills/. - Install for Claude.ai Projects: Create a new Project or open an existing one in Claude.ai. Click Add knowledge → Files and upload both `SKILL.md` files.
- Verify Installation: Run a smoke test prompt from the repository’s `tests/smoke-test-prompts.md` file to confirm the skills load and behave correctly.
2. Mastering the Reconnaissance & Asset Discovery Pipeline
The skills implement a comprehensive 5-stage external recon pipeline with time-budget profiles for 1-hour, 4-hour, 1-day, and 1-week engagements. This structured approach ensures that reconnaissance is systematic and thorough.
Core Reconnaissance Commands and Techniques:
- Subdomain Enumeration: The skills utilize a sophisticated stack starting with `crt.sh` and a 7-source fallback chain when `crt.sh` experiences downtime (e.g., 502 errors). This ensures resilience in data collection. A common-prefix subdomain sweep is also available, using over 100 ordered prefixes via PowerShell and bash scripts.
- Web Archive Mining: Leverage the Wayback CDX API for deep mining of historical web data, including the discovery of legacy applications (
.asp,.php,.jsp,.cfm) that may have been forgotten but remain exposed. - WHOIS and Public Records: Automate queries against WHOIS, RDAP, and historical WHOIS databases. Pivot using reverse-WHOIS to identify other assets owned by the same entity. The skills also integrate with public records from OpenCorporates, SEC EDGAR, and Companies House.
- Bulk IP to ASN Mapping: Enrich IP addresses with Autonomous System Number (ASN) data using services like Cymru, RIPEstat, and
bgp.tools.
Example Linux Command for Subdomain Discovery (Manual Execution):
While Claude automates this, the underlying technique often involves tools like `subfinder` or amass. A manual command to supplement the AI’s findings might be:
subfinder -d example.com -silent | httpx -silent -status-code -title -tech-detect
3. Identity Fabric Mapping and SSO Exploitation
A key differentiator of the Claude-OSINT skills is the focus on identity fabric—the interconnected systems that manage user authentication and authorization.
Step-by-Step Guide to Identity Discovery:
- Microsoft Entra (Azure AD) Fingerprinting: The skills guide Claude to fingerprint Microsoft Entra tenants and extract GUIDs, which can be used to confirm the organization’s use of Azure services.
- M365 Deep Enumeration: Perform deep enumeration of Microsoft 365 environments, including Teams federation, SharePoint, OneDrive, OAuth endpoints, and device-code phishing vectors. The skills include a technique to correlate Autodiscover IPs to passively confirm M365 usage, even when MX records are wrapped by services like Mimecast or Proofpoint.
- Third-Party IdP Discovery: Automate the discovery of Okta tenants (using the `/api/v1/authn` endpoint for user enumeration), ADFS fingerprints, Google Workspace OIDC discovery, and generic OIDC providers like Auth0, Keycloak, and Ping.
- AWS Account Identification: Extract AWS account IDs from response headers and ARN regex patterns, providing a critical foothold for cloud-focused attacks.
4. Web Application Attack Surface and API Security
The offensive-osint skill contains a comprehensive arsenal for dissecting web applications and APIs, making it a powerful ally for bug bounty hunters.
Critical API and Web Discovery Techniques:
- Swagger/OpenAPI Discovery: The skills probe for Swagger/OpenAPI documentation across 28 common paths, instantly revealing the entire API attack surface.
- GraphQL Enumeration: Discover GraphQL endpoints and attempt introspection using a POST body across 13 paths. Even when introspection is disabled, the skills employ field-suggestion enumeration, alias batching, and depth bypass techniques to extract schema information.
- Always-On HTTP Checks: Automatically check for sensitive files and endpoints, including
.git/,.env,/actuator, and/heapdump. - JavaScript Deep Analysis: Analyze JavaScript files for sourcemap leakage, hardcoded secrets, and internal-host regex patterns that reveal backend infrastructure.
- Subdomain Takeover: Identify vulnerable subdomains using fingerprints for 27 providers, allowing for quick escalation of low-hanging fruit.
5. Cloud, Container, and Credential Hunting
Modern infrastructures are heavily cloud-based. The Claude-OSINT skills are built to navigate this complexity.
Cloud and Container Discovery:
- Bucket Hunting: Probe for cloud storage buckets across AWS S3, Google Cloud Storage (GCS), and Azure Blob Storage using 6 prefixes, 15 suffixes, and 47 common stems.
- Container and Orchestration Exposure: Detect exposed Kubernetes, etcd, and kubelet components by scanning for 12 common ports and probes. Hunt for container registry leaks on Docker Hub, Quay, GHCR, ECR, GCR, and ACR.
- CI/CD Exposure: Identify exposed CI/CD platforms including Jenkins, GitLab, TeamCity (vulnerable to known KEVs), Argo CD, Spinnaker, and CircleCI.
Credential Hunting with `secret_scan.py`:
The skills include a runnable helper script, secret_scan.py, which is a stdlib-only secret scanner that outputs findings in JSONL format. This script can be run against cloned repositories or text dumps.
python3 skills/offensive-osint/scripts/secret_scan.py -f /path/to/target/files.txt
The skill also includes 9 read-only credential validators for services like Postman, AWS, GitHub, Slack, Anthropic, OpenAI, npm, Atlassian, and DataDog, allowing Claude to verify the validity of discovered secrets without causing harm.
6. Breach Intelligence and Reporting
The final phase of any reconnaissance engagement is making sense of the findings and delivering actionable intelligence.
Breach Intelligence Integration:
The skills integrate with the HudsonRock Cavalier API for free access to breach data, mapping domain-level breach severity. This is combined with other breach data sources like HaveIBeenPwned (HIBP), DeHashed, and IntelX to correlate exposed credentials with identity fabric findings. The methodology skill includes a findings rubric with severity decision matrices and 88 worked examples.
Reporting and Escalation:
- Attack Path Templates: The skills provide 27 attack-path hint templates that guide the user from a discovered vulnerability to a potential exploit chain.
- Bug Bounty Submission Templates: Pre-formatted templates for HackerOne, Bugcrowd, and Intigriti submissions streamline the disclosure process.
- Client Deliverables: Templates for executive summaries, risk-translation matrices, and reproduction packages ensure that the findings are communicated effectively to both technical and non-technical stakeholders.
What Undercode Say:
- AI is a Force Multiplier, Not a Replacement: The Claude-OSINT skills demonstrate that AI can handle the heavy lifting of reconnaissance, but they are not a replacement for a senior red teamer. They encode best practices and automate routine tasks, allowing human analysts to focus on complex reasoning and exploitation.
- Operational Security is Paramount: The skills include a soft scope-check that triggers when a user asks Claude to act against an unverified third-party target, reminding the user to confirm authorization. This built-in guardrail is crucial for preventing accidental unauthorized access and maintaining ethical boundaries in security research. The ability to pin skill versions (e.g.,
v2.1) is also a recommended security best practice to ensure consistency and prevent supply chain issues.
Prediction:
- +1: The adoption of AI-driven reconnaissance tools like Claude-OSINT will significantly reduce the time required for initial engagement phases, enabling security teams to conduct more frequent and comprehensive assessments. This will lead to a higher overall security posture for organizations that embrace these technologies.
- +1: The commoditization of expert-level reconnaissance tradecraft through AI skills will lower the barrier to entry for aspiring bug bounty hunters and security analysts, democratizing access to advanced techniques and potentially increasing the global pool of skilled security professionals.
- -1: As AI-powered reconnaissance becomes more accessible and powerful, the volume and sophistication of automated attacks will likely increase. Threat actors will also leverage similar or more advanced AI systems to discover and exploit vulnerabilities at scale, creating an AI arms race in the cybersecurity domain. Organizations that fail to adopt AI-driven defensive measures may find themselves significantly disadvantaged.
- -1: The reliance on large language models for reconnaissance introduces a new supply chain risk. A compromised or backdoored `SKILL.md` file could lead to the exfiltration of sensitive target data or the execution of malicious commands. Strict version control, code review, and signing of such skill files will become a critical necessity.
▶️ Related Video (80% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Mariosantella Osint – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
