reconnaissance--osint-automationlisted

# Reconnaissance & OSINT Automation ## Purpose Enable Claude to conduct comprehensive reconnaissance and open-source intelligence gathering during authorized security assessments. Claude performs passive and active recon using its native analysis capabilities and orchestrates the included scripts for automation at scale. > **Authorization Required**: Always confirm written authorization for the target scope before proceeding. Unauthorized reconnaissance is illegal in most jurisdictions. --- ## Activation Triggers This skill activates when the user asks about: - Subdomain enumeration or discovery - DNS reconnaissance, zone transfers, or DNS record analysis - OSINT gathering on a domain, organization, or person - Technology fingerprinting or stack identification - Port scanning, service detection, or banner grabbing - Google dorking or advanced search query generation - WHOIS, certificate transparency, or Shodan queries - Attack surface mapping or perimeter discovery --- ## Prerequisites ```bash pip install requests dnspython python-whois beautifulsoup4 shodan ``` **Optional enhanced capabilities:** - `nmap` — Active port scanning - `amass` — Advanced subdomain enumeration - `theHarvester` — Email and domain harvesting - Shodan API key — Internet-wide device search - Censys API key — Certificate and host search --- ## Core Capabilities ### 1. Passive Reconnaissance (No Direct Target Contact) **When the user asks for passive recon or OSINT:** 1. **WHOIS Analysis**