osint-methodology

# OSINT Methodology — External Red-Team Edition ## 0. When to use this skill / When NOT **Use this skill when:** - Planning or executing external reconnaissance against an authorized target (red team, bug bounty in-scope, ASM engagement). - Mapping an organization's external attack surface end-to-end (subdomains → assets → exposure → attack paths). - Investigating a person, entity, or threat actor where evidence discipline matters. - Tracing cryptocurrency flows, geolocating media, performing image/video forensics, or chronolocating events. - Building a structured OSINT campaign that needs reproducibility, severity grading, and clean handoffs. - Producing client-facing deliverables (exec summaries, technical reports, reproduction packages) from offensive engagements. **Do NOT use this skill when:** - The user is asking for active exploitation, post-exploitation, lateral movement, AD privilege escalation, malware development, or anything beyond reconnaissance — those are out of scope. - The user is asking for blue-team / defensive content (SIEM rules, detection engineering) — different domain. - The target's authorization is unclear and the user is asking you to act against a third-party asset they don't own — see §1 below; gently surface the scope question before proceeding. --- ## 1. Authorization & Legal Posture This skill is intended for assets the operator owns or has written authorization to assess (red-team rules of engagement, bug-bounty in-scope assets, ASM cont...